What is CNAME Record?

A CNAME (canonical name) record is a DNS alias. Instead of answering with an address, it tells the resolver that the name it asked for is really another name, and that it should restart the lookup there:

shop.example.com.   CNAME   example.myshopify.com.

A client resolving shop.example.com receives the CNAME, then resolves example.myshopify.com to get an A or AAAA record. This indirection is what makes CDNs, SaaS platforms and load balancers workable: the provider can change addresses freely and your zone never needs editing.

Rules and limits

• A name with a CNAME can hold nothing else. If shop.example.com has a CNAME, it cannot also have A, MX or TXT records. This regularly breaks email authentication and domain verification on aliased hostnames.
• The zone apex cannot use a CNAME. example.com itself must hold SOA and NS records, so a literal CNAME is not permitted there. Providers work around this with non-standard ALIAS/ANAME types or CNAME flattening, which resolve the target and serve the resulting address.
• Chains are legal but costly. A CNAME may point at another CNAME; each hop adds a lookup, and loops break resolution entirely.

The security angle

CNAME records are the main source of subdomain takeover. When the third-party resource behind the alias is deleted but the record is left in place, the name becomes a dangling DNS record: anyone who can claim that resource on the provider inherits content control of your subdomain, along with the ability to pass HTTP validation and obtain a TLS certificate for it.

CNAME records are also an inventory disclosure. Reading a zone’s aliases tells an outsider which providers an organisation depends on, which is useful both for targeting and for spotting shadow IT. Where zone transfers are unrestricted, that list is available without guessing.

Related concepts

See DNS record types for the wider set, asset discovery for building an inventory from them, and DNS propagation for why an edited alias can take hours to take effect everywhere.