CNAME Lookup

A CNAME record makes a name an alias for another name, called the canonical name or target. When a resolver is asked for www.example.com and finds a CNAME to example.net, it continues with example.net and answers with that name's records. The value of a CNAME is always a host name, never an IP address or a URL.

Common CNAME records:

This tool asks a recursive DNS resolver for the CNAME record at exactly the name you enter and shows the target and the TTL. It shows one step: the result links to a lookup of the target, so you can follow the chain. The raw answer and the resolver that gave it are in the Raw evidence panel.

A lookup does not tell you whether the target answers or serves the right content. For email records, check the target with the matching tool, for example a TXT lookup of a DKIM key.

A CNAME lookup has three possible verdicts: Pass, Warning and Could not check. It never shows Fail: finding a record, finding none or getting no answer is all a lookup can observe.

Pass: CNAME record found

The name is an alias. The result shows the target, and the TTL: how many seconds resolvers may keep this answer. Pass means the alias exists, not that its target is right. Compare the target with what your provider asks for, letter by letter.

Warning: no CNAME record

The resolver answered that this name has no CNAME record (shown as NODATA: NOERROR with an empty answer), or that the name does not exist at all (NXDOMAIN). That is normal for most names: a domain itself (example.com) should never have a CNAME (if it has one, see “CNAME at the top of the zone” below), and a name with an A record is not an alias. If you expected a CNAME, the usual reasons are:

• a typo, or the record was added at another name than intended;
• the DNS panel added your domain twice: typing www.example.com into a Host field that appends the domain creates www.example.com.example.com;
• the record is proxied at Cloudflare: Cloudflare then answers with its own IP addresses instead of the CNAME, so no CNAME is visible from outside;
• the record was added at a DNS provider your domain does not use (check its NS records);
• the record is new, and resolvers still remember the earlier “no record” answer (negative caching). The result shows how much longer the resolver we asked may keep it.

Check that the target exists (this lookup shows one step)

The target of a CNAME must exist. When it does not, anyone looking up the name gets nothing back. This usually happens after a service is canceled or renamed: the CNAME still points to the old name at the provider. Point the CNAME to the value your provider gives you now, or delete it if the service is no longer used.

This lookup asks for the CNAME record itself and does not follow it, so a CNAME whose target is gone still shows as Pass here. To see whether a target exists, open the lookup of the target from the result. If the details say NXDOMAIN, the target does not exist. An empty answer (NOERROR with no records) does not prove that it exists: DNSSEC-signed zones at some DNS providers, Cloudflare among them, give that answer for names that do not exist.

Warning: CNAME at the top of the zone

The name you entered is the top of its DNS zone (for example example.com itself) and it has a CNAME. The top of a zone must also hold SOA and NS records, and a name with a CNAME may hold nothing else. Many DNS servers then hide or refuse the other records, MX and TXT included, which can stop your email. Replace the CNAME with A and AAAA records, or use your provider's flattening feature (Cloudflare calls it CNAME flattening), which answers with addresses instead of a CNAME.

A CNAME must be alone at its name

A CNAME turns a name into an alias, and an alias may not have records of its own (RFC 1034 §3.6.2, RFC 2181 §10.1). A name with a CNAME and other records at the same time gets different answers from different DNS servers. Keep either the CNAME or the other records. GoDaddy and Namecheap, for example, do not let you create it; their instructions say so.

This lookup cannot see such a conflict: a CNAME query returns only the CNAME, so the result stays Pass. Check the records at that name in your DNS provider's panel.

TTL: how long the answer is kept

The TTL is in seconds. After you change a CNAME, some resolvers keep the old target until the TTL runs out. The TTL we show is what remains in the resolver's cache, so it can be lower than the value set in your DNS panel.

Could not check

The resolver did not give a usable answer: it timed out, reported a server failure (SERVFAIL), refused the query, or sent something we could not decode safely. This says nothing about whether the record exists. We never turn a missing answer into a pass or a fail. Try again in a minute; if it stays, the domain's DNS servers may be unreachable or its DNSSEC may be broken.

Could not check: a fault on our side

Rarely, the result says the check could not be completed because of an internal error. That is a fault in our software, not a finding about your domain and not a network problem, so trying again will most likely give the same result. Please write to [email protected] with the address of the result page, and we will fix it.

These rules apply at every DNS provider:

1. Add the record where your DNS is hosted: at the provider your domain's NS records point to.
2. Enter only the part before your domain as the name: www, shop or selector1._domainkey. Most panels add the domain themselves.
3. Enter a host name as the target, exactly as your provider gives it: no https://, no path, no IP address.
4. Do not put a CNAME on the domain itself (@) or on a name that has other records.
5. Check the result here (a repeat check within 60 seconds shows the saved result). A new record is usually visible within minutes, but resolvers that cached the old answer keep it until its TTL runs out.

Cloudflare

1. In the Cloudflare dashboard, open your domain's DNS Records page and select Add record.
2. Type CNAME, Name the prefix (for example www), Target the host name.
3. Choose the proxy status. Records for email and domain verification, such as DKIM CNAMEs, should be DNS only, as Cloudflare recommends; a proxied CNAME answers with Cloudflare's addresses instead of your target.
4. Select Save. For the domain itself, Cloudflare accepts a CNAME and flattens it, answering with addresses.

GoDaddy

1. Sign in to your Domain Portfolio, select the domain, then DNS.
2. Select Add New Record and choose CNAME.
3. Name: the prefix without your domain, such as www. GoDaddy does not accept @ here or a name another record already uses.
4. Value: the target host name (or @ for your domain itself). Keep the default TTL of 1 hour and select Save.

Namecheap

1. Open Domain List, select Manage, then the Advanced DNS tab.
2. Select Add New Record, choose CNAME Record, enter the Host (for example www) and the target in Value.
3. Select Save all changes. Namecheap adds your domain to the Host itself, advises against a CNAME on the bare domain because it may affect email, and says changes take about 30 minutes.

CNAME records for email services

• Microsoft 365 DKIM uses two CNAMEs, selector1._domainkey and selector2._domainkey. Copy both values from the Microsoft 365 admin center (Settings, Domains, your domain, DNS records; DKIM is under Advanced options). Publishing them does not start signing: turn it on for the domain in the Microsoft Defender portal (Email authentication settings, DKIM).
• Amazon SES Easy DKIM uses three CNAMEs named <token>._domainkey with values ending in amazonses.com. Amazon warns about panels that append the domain a second time, and says verification can take up to 72 hours.
• SendGrid domain authentication uses CNAMEs such as em123 plus two for DKIM; copy them from SendGrid's sender authentication page.
• Mailgun, Zoho and other services: copy the exact Host and Value from the provider's dashboard, and look each name up here after publishing it.
• Google Workspace publishes its DKIM key as a TXT record, not a CNAME: check it with the TXT lookup.

With dig on macOS or Linux:

dig +short CNAME www.github.com
dig +noall +answer CNAME www.microsoft.com
dig +noall +answer A www.microsoft.com

On 22 September 2026 the first command printed github.com.. The second and third show the difference between a CNAME query and a normal lookup:

www.microsoft.com.  3600  IN  CNAME  www.microsoft.com-c-3.edgekey.net.

www.microsoft.com.  3589  IN  CNAME  www.microsoft.com-c-3.edgekey.net.
www.microsoft.com-c-3.edgekey.net. 889 IN CNAME e13678.dscb.akamaiedge.net.
e13678.dscb.akamaiedge.net. 9 IN  A  95.100.178.81

A CNAME query returns only the first alias; an A query follows the whole chain to the address. With nslookup (Windows, macOS, Linux):

nslookup -type=CNAME www.github.com
www.github.com  canonical name = github.com.