104

CNAME records were originally created to allow multiple names that provide the same resource to be aliased to a single "canonical name" for the resource. With the advent of name based virtual hosting, it has instead become commonplace to use them as a generic form of IP address aliasing. Unfortunately, most people who come from a web hosting background ...


62

Multiple CNAME records for the same fully-qualified domain name is a violation of the specs for DNS. Some versions of BIND would allow you to do this (some only if you specified the multiple-cnames yes option) and would round-robin load-balance between then but it's not technically legal. There are not supposed to be resource records (RRs) with the same ...


43

The certificate name must match what the user entered in the browser, not the 'final' DNS record. If the user enters docs.tenantcompany.com then your SSL certificate has to cover that. If docs.tenantcompany.com is a CNAME to foo.example.com, the certificate does not need to cover foo.example.com, just docs.tenantcompany.com.


33

No you don't because DNS records don't propagate. What you do need to allow for is for any cached records to expire, based on the TTL of the record in question. If this is a new record, no caching can have occurred so the new record should be available and should resolve immediately. Additionally, the root servers (first level; .) don't host DNS zones or ...


29

You can't. As RFC1034 says in s3.6.2, If a CNAME RR is present at a node, no other data should be present If you want a TXT record for (say) www.example.com, you can't have a CNAME for www.example.com, and will have to find another way to achieve what you want. This may mean monitoring example.herokuapp.com yourself, and when the IP address changes, ...


28

Jason's answer is correct. But just to clarify terms a bit here, "DNS redirect" is a bit of a misnomer. DNS has CNAME records (a.k.a. aliases) which is a name pointing to another name. But it's not a redirect. The translation from name to name to IP all happens in the background and your browser only cares about the initial name. The only thing that does ...


19

It would definitely create a problem if you were to point your MX records at CNAME records since it is against the standards. The clearest explanation is provided by RFC2181 ยง10.3: 10.3. MX and NS records The domain name used as the value of a NS resource record, or part of the value of a MX resource record must not be an alias. Not only is ...


16

Route 53 DNS record changes propagate in less than a minute, but TTL times will impact on how quickly DNS resolvers check back for updated records. Q. How quickly will changes I make to my DNS settings on Amazon Route 53 propagate globally? Amazon Route 53 is designed to propagate updates you make to your DNS records to its world-wide network of ...


16

I think you're confusing terms a little bit. A CNAME is not a redirect per se. It's just a record type in DNS, also known as a DNS alias. The DNS protocol is ultimately about mapping names to IP addresses. The most common record type is a "A" record which is a one-way mapping of Name to IP. The CNAME record instead is a one way mapping of Name1 to Name2. ...


15

Is this kind of multi level CNAME a bad design in general ? CNAME to CNAME chains are not forbidden but as you already experience it is not a very robust solution. Each additional CNAME increases the recursion depth for the resolver, and that depth is not always unlimited. Also you run the risk of creating loops, or triggering the loop detection ...


14

host, dig, and nslookup all share most of the same functionality. In the case you are asking about (asking a particular DNS question to a particular nameserver), dig and host (and indeed nslookup) behave exactly the same. For DNS troubleshooting, dig is preferred because its output format is more "raw": in its output it directly shows the contents of all 4 ...


14

If I'm not mistaken, the problem is that your registrar has published DS records for your domain - that is, DNSSEC signing keys: [me@risby player]$ dig ds ultreyatours.com [...] ;; ANSWER SECTION: ultreyatours.com. 85920 IN DS 49864 8 1 0152C1213569799FAFA42C7699A20132A293F908 ultreyatours.com. 85920 IN DS 20536 8 1 ...


13

The wildcard (the *) must be the leftmost part of the domain. So you can't do stage.*.example.com. If you need to do wildcard DNS for this, I suggest using *.stage.example.com. This may require some minor changes to your deployment processes, but should not be significant.


13

You cannot. A CNAME makes one record another name for another. If a record could have CNAMES for two names, it wouldn't be another name for either of them, but a name for something entirely new, making a CNAME entry inappropriate. There's likely a good way to solve your outer problem though. For example, you can have multiple A records.


12

Well it's not that the root of a domain can't be a CNAME - It's that a CNAME cannot coexist with other record types for the same domain. Simply put, it would make no sense for a domain with a CNAME to have any other record type, because the CNAME would ensure that they would never be seen or read. Let's say we did try to give example.net both a CNAME (...


12

You use the name the service is accessed as. So if your portal clients visit https://portal.dlinkddns.com, use portal.dlinkddns.com. And if they visit https://portal.company.com, use portal.company.com. If your clients will access both, get a certificate with one of the names as DN and the other as subjectAltName, so it can be used for both. If I'm reading ...


12

As mentioned in the comments, you will need to use A records instead of CNAME records. CNAME records will not be able to point at an IP Address. The key to making each of the sites to work is to specify ServerName correctly for each virtual server in your Apache config.


12

Barring unusual behavior from a web-browser or poorly coded application, there's nothing special about the www domain. I would suggest looking for a new DNS provider if they're willing to change DNS records without your approval or your knowledge.


11

There is a trick you can use here. That said, Wesley is a smart dude and you should listen to him. I don't get paid to say that but I'm hoping to change that one day. Assuming that you're trying to change a record called www in a zone called example.com.... Create a temporary wildcard A record (*) in the zone. Commit the change. Test it, make sure the ...


11

HBrujin is correct, but in truth recursion depth is a lot worse than anything dig +trace is going to show you. Recursion depth is something that often gets sneered at and over-trivialized, but those people forget that you aren't just resolving ~5 CNAME records. This is because resolving the target of a CNAME record creates a need to look up every nameserver ...


11

Use A record to point to the sub domains myurl.com. A 300 123.123.123.123 api.myurl.com. A 300 123.123.123.123 app.myurl.com. A 300 123.123.123.123 preview.myurl.com. A 300 123.123.123.123 www.myurl.com. CNAME 300 myurl.com.


10

As others have stated, it's not possible to perform HTTP redirection with DNS alone. DNS and HTTP work together to redirect a user from one web page to another. You can use DNS by itself to make domain A show the same content as domain B, but the web browser will show domain A in the URL. You need to be very careful with this as it's quite bad from an SEO ...


10

Using Google's public DNS servers, the expiration of the A record causes a query of the CNAME record as well, even if the CNAME has a longer TTL. We painfully experienced that because the DNS provider charged us for DNS queries. The CNAME hosted by the DNS provider had a TTL of several days. The TTL of the A record was hosted on Windows Azure with a TTL of ...


10

The Wikipedia article you are quoting reports what the relevant RFC 2782 for SRV records states: Target The domain name of the target host. There MUST be one or more address records for this name, the name MUST NOT be an alias (in the sense of RFC 1034 or RFC 2181). What you are seeing is a clear violation of the rules; however, it might work (and ...


10

I wanted to understand if I my tenant company has a wildcard SSL certificate, will it work with this setup or a new SSL certificate has to be purchased for docs.tenantcompany.com? Short answer: No. If your tenant company has a wildcard in the name *.tenantcompany.com, that is sufficient to install on your server to cover accesses via that name. Whether you ...


10

CAA records are supposed to follow CNAMEs, so you need a CAA record for the target of the CNAME record instead. Citing https://letsencrypt.org/docs/caa/ CAA validation follows CNAMEs, like all other DNS requests. If www.community.example.com is a CNAME to web1.example.net, the CA will first request CAA records for www.community.example.com, then seeing ...


9

Either this, or a direct A record (saves one lookup) are the best options you have, yes. *.example.net. 60 IN A 1.2.3.4


9

The standards discourage such a solution. It probably works with most DNS software, but your clients might encounter some which is not willing to follow multiple CNAMEs in succession. In that case, those clients using such a DNS resolver will likely not be able to access your service using those domain names. In RFC1034: Domain names in RRs which point ...


9

CNAMES are not redirections, they are aliases. CNAME also includes all other resource records such as A,MX,TXT. so if you query for an A record, the cname will send you to the A record of it's alias. Many registrars include additional options such as redirect services, godaddy and Google for example. also, be careful entering values for CNAMES, some ...


8

Just to clarify, www.example.com is not the root of the domain, example.com is. A CNAME on www.example.com is valid, but a CNAME on example.com is not - cpanel is right to reject the attempt. A CNAME record can only exist on a name when no other record type exists for that name, since it indicates that all lookups (of any type, not just A) for that name ...


Only top voted, non community-wiki answers of a minimum length are eligible