Why a CNAME at the Zone Apex Breaks (and What to Use Instead)

A CNAME at your zone apex (the bare root domain) breaks your domain because the apex must hold SOA and NS records, and a CNAME is forbidden from coexisting with any other record. This is not a quirk of one provider — it is baked into how DNS works. Here is precisely why, and what to do instead.

The rule: a CNAME must be alone

The DNS standard says a name with a CNAME can have no other records. The reasoning is that a CNAME means "this name is really an alias for that name", so any other record on the same name would be contradictory.

Why that clashes with the apex

Your zone apex is not an ordinary name — it is required to carry:

• An SOA record — every zone has one at its apex; see the SOA record.
• NS records — delegating the zone to its nameservers.
• Often MX records — for mail.

A CNAME cannot sit alongside any of these, so putting one at the apex either gets rejected outright or, worse, breaks mail delivery and delegation where it is wrongly accepted.

What actually breaks

• Email stops — the MX records are effectively hidden by the CNAME.
• Delegation and SOA behaviour get confused.
• Resolvers may error on the invalid configuration.

The correct alternatives

• ALIAS or ANAME — the purpose-built solution for pointing the apex at a hostname; see CNAME vs ALIAS vs ANAME.
• A/AAAA records — if the target has stable IP addresses, point the apex directly at them.
• Redirect the apex to www — some setups redirect the bare domain to www (which can safely use a CNAME) at the web-server or provider level.

Frequently asked questions

My provider let me add a CNAME at the root — is that fine?

Some providers quietly convert it to an ALIAS/ANAME behind the scenes, which is fine. But a literal CNAME at the apex is invalid and can break mail and delegation. Confirm what your provider actually did.

Why does my email stop when I add an apex CNAME?

Because a CNAME cannot coexist with other records, it effectively suppresses your MX records, so receiving servers cannot find your mail servers. Removing the CNAME and using an apex-safe record fixes it.

What should I use to point my root at a CDN?

An ALIAS or ANAME record if your DNS provider supports it, since CDNs usually give you a hostname rather than a fixed IP. If not, and the CDN offers stable IPs, an A record works.