49 votes
Accepted

Do I need a separate SSL certificate for a DNS redirect?

The certificate name must match what the user entered in the browser, not the 'final' DNS record. If the user enters docs.tenantcompany.com then your SSL certificate has to cover that. If docs....
  • 4,935
45 votes
Accepted

Adding both CNAME and TXT DNS records for one subdomain

You can't. As RFC1034 says in s3.6.2, If a CNAME RR is present at a node, no other data should be present If you want a TXT record for (say) www.example.com, you can't have a CNAME for www.example....
  • 78.7k
29 votes

Do I need a separate SSL certificate for a DNS redirect?

Jason's answer is correct. But just to clarify terms a bit here, "DNS redirect" is a bit of a misnomer. DNS has CNAME records (a.k.a. aliases) which is a name pointing to another name. But it's not a ...
  • 16.6k
26 votes
Accepted

CNAME with S3 buckets

In the past S3 supported FQDN bucket names - i.e. exactly what you needed. Where FQDN = Fully Qualified Domain Name, i.e. full host name like static.mypage.com. The problem is that this only works ...
  • 24.1k
19 votes
Accepted

Replacing an MX record with a CNAME that doesn't match the hostname

It would definitely create a problem if you were to point your MX records at CNAME records since it is against the standards. The clearest explanation is provided by RFC2181 §10.3: 10.3. MX and NS ...
  • 32k
18 votes
Accepted

SSL encryption with CNAME redirect

I think you're confusing terms a little bit. A CNAME is not a redirect per se. It's just a record type in DNS, also known as a DNS alias. The DNS protocol is ultimately about mapping names to IP ...
  • 16.6k
16 votes

Having Multiple CNAMEs

Is this kind of multi level CNAME a bad design in general ? CNAME to CNAME chains are not forbidden but as you already experience it is not a very robust solution. Each additional CNAME increases ...
  • 73k
14 votes
Accepted

Some visitors cannot access my website

If I'm not mistaken, the problem is that your registrar has published DS records for your domain - that is, DNSSEC signing keys: [me@risby player]$ dig ds ultreyatours.com [...] ;; ANSWER SECTION: ...
  • 78.7k
14 votes
Accepted

CAA and CNAME together

CAA records are supposed to follow CNAMEs, so you need a CAA record for the target of the CNAME record instead. Citing https://letsencrypt.org/docs/caa/ CAA validation follows CNAMEs, like all ...
  • 97.6k
13 votes

Resolve a domain name to CNAME alias locally using dnsmasq

You can add the following to your configuration file in dnsmasq: cname=somedomain.com,some-balancer-1213231237.ap-southeast-2.elb.amazonaws.com as specified in the man page: --cname=<cname>,[&...
  • 5,577
12 votes
Accepted

Changing an `A` record to a `CNAME` without downtime

There is a trick you can use here. That said, Wesley is a smart dude and you should listen to him. I don't get paid to say that but I'm hoping to change that one day. Assuming that you're trying to ...
  • 32k
12 votes

How to redirect domain A to domain B using A-Records and CNAME records only

As others have stated, it's not possible to perform HTTP redirection with DNS alone. DNS and HTTP work together to redirect a user from one web page to another. You can use DNS by itself to make ...
  • 121
12 votes
Accepted

Published SRV records pointing to CNAME alias in violation of RFC 2782?

The Wikipedia article you are quoting reports what the relevant RFC 2782 for SRV records states: Target The domain name of the target host. There MUST be one or more address records for this ...
  • 69.1k
12 votes

Having Multiple CNAMEs

HBrujin is correct, but in truth recursion depth is a lot worse than anything dig +trace is going to show you. Recursion depth is something that often gets sneered at and over-trivialized, but those ...
  • 32k
12 votes
Accepted

Using a CNAME record to redirect a subdomain to another website?

CNAMES are not redirections, they are aliases. CNAME also includes all other resource records such as A,MX,TXT. so if you query for an A record, the cname will send you to the A record of it's alias....
  • 7,716
12 votes
Accepted

Changing A record and CNAME records

As mentioned in the comments, you will need to use A records instead of CNAME records. CNAME records will not be able to point at an IP Address. The key to making each of the sites to work is to ...
  • 1,375
12 votes
Accepted

Using a CNAME record with www

Barring unusual behavior from a web-browser or poorly coded application, there's nothing special about the www domain. I would suggest looking for a new DNS provider if they're willing to change DNS ...
  • 2,057
11 votes

What's the difference between `dig` and `host` when querying a specific name-server?

If you're using the non-FQDN hostname, the results can be different because host will use the search domains in resolv.conf, whereas dig does not by default. You have to use the +search option if you ...
  • 1,009
11 votes

Changing A record and CNAME records

Use A record to point to the sub domains myurl.com. A 300 123.123.123.123 api.myurl.com. A 300 123.123.123.123 app.myurl.com. A 300 123.123.123.123 preview.myurl.com. A 300 123.123.123....
11 votes
Accepted

record DKIM on IONOS makes sense?

it is IONOS who signs those emails, right? It would be, if they signed them. But they don't. (But they should.) Here are some excerpts of a conversation I had less than 10 minutes ago with their ...
10 votes

Do I need a separate SSL certificate for a DNS redirect?

I wanted to understand if I my tenant company has a wildcard SSL certificate, will it work with this setup or a new SSL certificate has to be purchased for docs.tenantcompany.com? Short answer: No. ...
8 votes

Changing an `A` record to a `CNAME` without downtime

We're moving across to Amazon EC2 and are using a load balancer, with the recommendation that we use a CNAME instead of an A record I sincerely hope that you're not CNAMEing your apex domain. If ...
  • 32.4k
8 votes

Why can't a CNAME record be used at the apex (aka root) of a domain?

June 2022 Update New SVCB and HTTPS resource records enable aliasing of apex domains and facilitate lookups for connecting to services like HTTP origins. Many DNS providers and browsers already ...
8 votes

What does the TTL on a CNAME record mean?

All you CNAME records will be cached for a maximum of 3600, 10800 and 21600 seconds. The A records are handled independently and will be queried again every 60 seconds. However, in case the CNAME ...
7 votes

CNAME record/alias in windows hosts file?

PowerDNS is not supported on Windows. I would recommend a tool such as "SimpleDNS" (14 day Trial) or "Technitium DNS Server" (free) which can be used to create a simple local DNS server. Once you ...
7 votes
Accepted

Cloudflare integration with Azure websites

The DNS settings for your website in Cloudflare allow you to proxy traffic so that requests to example.com and www.example.com will be protected. You do not control azurewebsites.net though so you ...
7 votes

How to do "dynamic apex" right in DNS/BIND?

I'm the guy who wrote the Q&A that was linked to in the comments, so suffice it to say I've spent some time studying the brain damage surrounding attempts to "make this work". This is basically a ...
  • 32k
7 votes
Accepted

DNS to direct url with path to another domain

This cannot be done with DNS. This must be done with URL rewrites in your HTTP server. If you don't have access to any configuration settings for your web server, you're out of luck.
  • 32.4k
7 votes

CNAME working - but not for directories

It's not DNS CNAME problem. DNS only help clients to resolve IP from FQDN. If virtual host root works, then IP resolving works fine. You need to check you web server configuration, and web server ...
  • 3,265
6 votes
Accepted

Best CNAME TTL strategy for fallover switching

Assuming that the apex A record for example.com. was pointing at a broken IP address, most companies I know would change the A record and skip the www change entirely: Most admins would rather not ...
  • 32k

Only top scored, non community-wiki answers of a minimum length are eligible