A CNAME record maps one hostname to another hostname rather than directly to an IP address. The resolver follows the alias to the target and uses whatever A or AAAA records it finds there. The target must always be a hostname; pointing a CNAME at an IP is invalid.
Why it matters
CNAME records are how most platform integrations work: you point app.example.com at a vendor hostname, and they manage the IPs, CDN edges, and certificate provisioning behind it. The trade-off is that a hostname with a CNAME cannot also carry other record types, and apex domains usually cannot use CNAME at all unless the provider offers ALIAS or ANAME flattening.
How to check
- Resolve with
dig CNAME app.example.comand confirm the target is owned by the intended vendor. - Avoid chains: each extra
CNAMEadds a lookup and failure surface. - Do not place a
CNAMEat the apex unless your DNS provider supports apex aliasing. - Match TTL values to how often the target hostname changes.
- Watch for conflicts: a hostname with a
CNAMEcannot also haveMXorTXTrecords on the same name. - Remove the
CNAMEwhen you stop using a vendor — abandoned aliases are a common subdomain takeover vector.