CNAME Lookup
See what a hostname is an alias for.
A CNAME record makes one hostname an alias for another. Looking up www.example.com might return example.com, and the resolver then starts again on that name to find an address. It is the mechanism behind nearly every "add a CNAME pointing at us" instruction from a CDN, SaaS platform or email provider.
Two rules cause most CNAME confusion. First, a name with a CNAME may hold no other records — so you cannot put a CNAME on a domain that also needs MX or TXT records, which is why the apex of a domain cannot be a CNAME and providers offer ALIAS or ANAME records as a proprietary workaround. Second, CNAMEs chain: an alias can point at another alias, and each hop is another round trip before anything resolves.
The security dimension is worth understanding. If a subdomain CNAMEs to a cloud resource that is later deleted, the alias keeps pointing at a hostname nobody owns — and on many platforms anyone can claim that name and serve content from your subdomain. This is subdomain takeover, and the vulnerable state is exactly a CNAME whose target does not resolve.
How to check a CNAME record from the command line
The lookup above returns the first hop: the name this hostname is an alias for. If that target is itself an alias, look it up here again, or let dig print the whole chain in one go. Asking for the address rather than the CNAME makes a recursive resolver return every alias it followed on the way, in order, with the address records at the end.
# The alias target only (first hop) dig CNAME www.example.com +short # The whole chain, down to the address dig www.example.com +noall +answer # On Windows nslookup -type=CNAME www.example.com Resolve-DnsName www.example.com -Type CNAME
Each line of the +noall +answer output is one hop, with the remaining cache time in seconds in the second column. More than two CNAME lines on a hostname you control is usually worth flattening.
Verifying a CNAME a vendor asked you to add
Most "add this CNAME" instructions fail for one of a handful of reasons, and the lookup tells you which. Work through them in order:
- Look up the exact name the vendor gave you, including any leading label such as
em1234or_domainkey— not the domain it sits under. A CNAME onwwwsays nothing aboutshop. - If nothing comes back, look up the name with your domain doubled, such as
www.example.com.example.com. DNS dashboards append the zone to whatever you type in the name field, so entering the full hostname there creates exactly this. - If the hostname resolves to addresses but shows no CNAME, the record is probably proxied or flattened. A proxied record in Cloudflare answers with Cloudflare's own addresses, so the alias is never visible to the vendor's verifier — switch that record to DNS-only while it verifies.
- If the target differs from what was asked for by a character or a region suffix, it is wrong. Verifiers compare strings exactly.
- If you looked the name up before creating the record, the resolver may still be caching the "does not exist" answer. Check it across several public resolvers with the DNS propagation checker before assuming the record is wrong.
Checking for a dangling CNAME
A dangling alias is one whose target no longer exists. When you query such a name, the answer still contains the CNAME, but the response status is NXDOMAIN, because the status describes the last name in the chain rather than the one you asked about. That makes it easy to spot from a terminal:
# Empty output: nothing at the end of the chain dig A shop.example.com +short # NXDOMAIN on a name that has a CNAME means the target is gone dig shop.example.com | grep status
A target that still resolves is not automatically safe. Some platforms answer DNS for every name under their domain and only reveal at the HTTP layer that the resource behind it was deleted. The subdomain takeover checker tests for those service fingerprints, and the subdomain finder helps you build the list of hostnames worth checking in the first place.
What this tool does
See the real target
A CNAME points at another name, which may itself be an alias. The answer shows what this hostname actually delegates to.
Catch dangling aliases
A CNAME pointing at a de-provisioned SaaS or cloud hostname is the precondition for subdomain takeover. An alias whose target no longer resolves is worth acting on today.
Verify vendor setup
Most SaaS onboarding asks for a CNAME. This confirms yours resolves to the exact hostname the vendor specified, rather than something close to it.
Understand apex limits
A CNAME cannot sit on a bare domain. If a lookup for the apex comes back empty, that is the specification, not a misconfiguration.
Frequently asked questions
What is a CNAME record?
A CNAME ("canonical name") record makes one hostname an alias for another. When a resolver finds a CNAME it restarts the lookup against the target name, following the chain until it reaches records with actual addresses.
Why can I not use a CNAME on my root domain?
Because the DNS specification forbids a CNAME from coexisting with any other record on the same name, and a root domain must carry SOA and NS records. Providers work around this with ALIAS, ANAME or flattened-CNAME features that resolve the target server-side and answer with an address record instead.
What is the difference between a CNAME and a redirect?
They operate at different layers. A CNAME is DNS: the browser resolves a different name but the URL in the address bar never changes. An HTTP redirect is the web server telling the browser to request a different URL, which does change the address bar. If you want visitors to land on a different address, you need the redirect, not the CNAME.
How many CNAMEs can chain together?
There is no hard limit in the specification, but resolvers cap the chain — typically around eight to sixteen hops — and abandon the lookup beyond that. Each hop costs a round trip, so long chains are slow as well as fragile. Keep it to one or two.
What is a dangling CNAME and why does it matter?
A dangling CNAME points at a hostname that no longer resolves, usually because the cloud or SaaS resource behind it was deleted. On platforms that let anyone claim an unused hostname, an attacker can register the target and serve their own content from your subdomain — which means valid TLS, your cookies in scope, and your brand on their page.
Does a CNAME slow down my site?
Slightly, for the first visitor. Each alias hop is an extra DNS lookup before a connection can open, though the results are then cached for the TTL. One hop is negligible; a chain of five on a latency-sensitive path is worth flattening.
Why does the CNAME I just created not show up?
Usually one of three things. The record was created at a doubled name such as www.example.com.example.com, because the DNS dashboard appended the zone to a full hostname. It is proxied or flattened, so resolvers answer with addresses and never reveal the alias. Or a resolver cached a "does not exist" answer from before you created it and will keep serving that until the negative cache time runs out.
Monitor it, don't just check it
One-off checks catch what is broken today. CertNotify re-checks your certificates and domains every day and emails you before either expires; paid plans add a daily DNS check and a scan of connected repositories on every push.