Cybersecurity glossary
What is a CNAME Record?
Learn what a DNS CNAME record is, how aliases resolve to canonical names, apex limitations, conflicts with other records, and security risks like dangling CNAMEs.
Definition
A CNAME (Canonical Name) record is a DNS resource record that aliases one hostname to another canonical hostname, so clients follow the alias chain to reach the final address or service data.
Why CNAME records are everywhere
Vendors rarely ask you to hard-code their changing IPs. Instead they give you a hostname. A CNAME record lets www.example.com or app.example.com alias to that vendor name so address changes stay on the provider side.
Aliases simplify onboarding for CDNs, SaaS apps, and verification endpoints—but they also create takeover risk when forgotten.
How a CNAME resolves
Query the alias name
A client asks for data about blog.example.com.
Receive a CNAME answer
Authoritative DNS returns a canonical target such as blogs.example.net.
Follow the target
The resolver queries the canonical name for A/AAAA or further CNAMEs.
Stop at address data
The chain ends when address records (or other terminal data) are found.
Connect using final IPs
The application connects to resolved addresses while still using the original hostname for TLS SNI and HTTP Host.
Cache each hop
TTLs on the CNAME and on terminal records both influence how long the path stays cached.
CNAME compared with address records
| Property | CNAME | A / AAAA |
|---|---|---|
| Points to | Another hostname | IP addresses |
| Who updates IPs | Often the target owner (CDN/SaaS) | You manage the published addresses |
| Same-name neighbors | Must be alone at that owner name | Can coexist with many other types |
| Apex suitability | Not with classic DNS rules | Normal choice for apex hosting |
Benefits and failure modes
Vendor agility
Providers can move backends without asking every customer to edit A records.
Cleaner ownership
Application teams alias to a platform hostname instead of tracking raw IPs.
Chain fragility
Each extra hop adds dependency on another zone’s availability and correctness.
Dangling alias risk
Abandoned SaaS targets can be claimed by attackers while your CNAME still points there.
Hardening checklist
- Inventory every CNAME and the third-party service it is supposed to reach.
- Remove aliases immediately when decommissioning CDN, blog, or SaaS hostnames.
- Prefer short chains; avoid aliasing through unused intermediate domains.
- Monitor for NXDOMAIN or unexpected targets on external CNAME destinations.
- Do not place CNAMEs where MX, NS, or SOA must exist on the same owner name.
- Use provider ALIAS/ANAME features for apex needs instead of invalid classic CNAMEs.
- Treat unexpected CNAME edits as high-severity DNS incidents.
- Include CNAME destinations in subdomain-takeover scanning.
The practical takeaway
A CNAME record aliases one hostname to another so DNS clients follow the canonical name to reach services. It is the standard way to attach domains to CDNs and SaaS platforms without embedding provider IPs.
Use CNAMEs for flexibility, keep chains short, and retire them the moment the target service is gone. An alias without an owner is an invitation.
Related security terms
A Record
Direct IPv4 mapping often found at the end of a CNAME chain.
AAAA Record
Direct IPv6 mapping that aliases may ultimately resolve to.
Dangling DNS Record
Stale CNAMEs are a common dangling-record takeover path.
Subdomain Takeover
Attackers claim abandoned targets still referenced by CNAMEs.
Content Delivery Network (CDN)
CDNs frequently ask customers to CNAME hostnames to provider endpoints.
Frequently asked questions
What is a CNAME in simple terms?
A CNAME says “this name is an alias for that other name.” Resolvers look up the target name to find the real addresses or records.
Can a CNAME coexist with other records on the same name?
Generally no. If a name has a CNAME, it should not also have A, MX, TXT, or other data at that same owner name (DNSSEC exceptions aside).
Why can’t I put a CNAME on the zone apex?
The apex already needs SOA and NS records. A classic CNAME cannot share the owner name with those required records. Many providers offer ALIAS/ANAME flattening instead.
What is a CNAME chain?
When one alias points to another alias. Long chains add latency and failure points; keep them short.
What is a dangling CNAME?
An alias that still points to a third-party hostname you no longer control, such as an abandoned SaaS or CDN endpoint.
Is CNAME the same as a redirect?
No. CNAME is a DNS alias resolved before connection. HTTP redirects happen after the client already reached a web server.
Do email domains use CNAME for MX?
MX targets should be hostnames with address records. Aliasing the mail domain itself with CNAME is constrained; follow your mail provider’s documented pattern.
References
Explore authoritative guidance and frameworks related to cname record.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.