Why can't you put a CNAME at the root of a zone, and how do DNS providers work around it?
Show the answer
Say this first
A CNAME says the name is only an alias, so no other record may exist at the same name. The zone apex (example.com itself) must carry SOA and NS records, so a CNAME there is illegal. Providers work around it with ALIAS, ANAME or CNAME-flattening records: the provider resolves the target itself and serves the result as ordinary A and AAAA records at the apex. AWS Route 53 does the same with alias records.
Go deeper
The rule
RFC 1034: if a CNAME exists at a name, no other data may exist there. DNSSEC later made the only exception, for its own records (RRSIG and NSEC) at that name. That rules out a CNAME at the apex and next to MX, TXT or any other record.
Why people want it
Cloud load balancers and CDNs give you a hostname, not a fixed address, because their addresses
change. www can be a CNAME to it. The bare example.com cannot.
The workarounds
- Flattening, ALIAS, ANAME: the provider looks up the target and answers with A and AAAA records. Fine for most cases. The provider resolves the target from its own location, so geo-based answers reflect the provider, not the user, unless the platform handles that.
- Route 53 alias records: point the apex at AWS resources directly.
- HTTPS record in alias mode (RFC 9460): designed partly for this, but it only helps clients that query HTTPS records.
- Redirect: serve the apex from a fixed address that redirects to
www.
They will ask next
Can a CNAME point to another CNAME?
Yes, resolvers follow chains. Every hop is another lookup and another TTL to manage, so keep chains short.
What happens if someone adds an MX record at a name that already has a CNAME?
A strict server refuses to load the zone. BIND reports "CNAME and other data". Some web consoles refuse the change instead.
Traps
- Saying a CNAME at the apex works because the provider's console allowed it. The console is flattening it behind the scenes.