Why You Can’t Mix CNAME and A Records: DNS Rules, Failures, and Fixes

This article is a localized edition of the Japanese original. Read the Japanese original

You must not put a CNAME and an A record (or any other record, such as MX or TXT) together on the same name, because a CNAME means "this name is an alias, and all kinds of information are at the target name," and if other records sit alongside it, the answers contradict each other. It is also prohibited by the DNS standards (RFC 1034 and RFC 2181); many DNS services refuse to register it, and BIND fails to load the zone at all. This article explains why it is prohibited, what problems occur when you mix them, the situations where conflicts are likely and how to replace records correctly, and how to find conflicts in an existing zone.

What is prohibited

What is prohibited is placing a CNAME and other data on the same name.

; NG: CNAME and A on the same www
www.example.com.   3600  IN  CNAME  site.example-cdn.net.
www.example.com.   3600  IN  A      192.0.2.10

; NG: CNAME and TXT on the same shop
shop.example.com.  3600  IN  CNAME  shops.example-saas.net.
shop.example.com.  3600  IN  TXT    "verification=your-token"

; OK: no problem if the names are different
example.com.       3600  IN  A      192.0.2.10
www.example.com.   3600  IN  CNAME  example.com.

RFC 1034 states that no other data may be placed at a name that has a CNAME, and RFC 2181 confirms this again. Also, a name can have only one CNAME. The exception is the RRSIG and NSEC records used for DNSSEC signatures, which the DNSSEC standard (RFC 4035) allows to coexist with a CNAME. For the records that you register yourself, it is enough to remember that "nothing else goes on a name that has a CNAME."

Why they cannot be placed together

When a caching DNS resolver is looking for the A record of www.example.com and finds a CNAME, it stops looking up www.example.com and starts over by querying the target, site.example-cdn.net. This is the same not just for A but for MX and TXT as well. A CNAME is not a redirect for one specific record type; it re-points the name itself.

If the same name also has an A record, two answers exist at the same time: "the information for www is at the CDN's name" and "the IP address of www is here." Which one is used varies with the software and the state of the cache, and mismatches like the following occur.

• A resolver that has cached the CNAME returns an answer that follows the CNAME even for A queries
• A resolver that cached the A first returns the A as is for the same name
• For MX and TXT queries, the MX and TXT at the CNAME's target are used, and the records you placed yourself are ignored

The result is hard-to-reproduce problems, such as the destination differing from user to user and email or domain verification failing only occasionally, which is why the standards prohibit it.

What actually happens when you mix them

You cannot register it: Many of the DNS screens of Cloudflare, Amazon Route 53, and rental servers show an error when you try to add another record to a name that has a CNAME. The wording on the screen differs by service (as of October 2026).

The zone cannot be loaded: In BIND, if a zone file contains a mixture, named-checkzone reports a "CNAME and other data" error and fails to load that zone. At startup, the entire zone stops responding, and because of one mixed line, even unrelated MX records and other subdomains may go down.

Unstable even in environments that accept it: Old software and some services may accept the registration, but as described in the previous section, the answers are not consistent.

Why you cannot put a CNAME at the domain apex

At the apex of a domain such as example.com (the zone apex), the SOA and NS records, which hold the basic information of the zone, are essential elements. Placing a CNAME there would mix it with SOA and NS, so a CNAME cannot be placed at the apex. The apex also often holds MX records and TXT records for verifying ownership for various services, so it conflicts in two ways.

This constraint often becomes a problem in situations where "you want to point the apex of the site at a CDN or hosting service that gives you a hostname."

Situations where conflicts are likely, and the correct replacements

You want to point the domain apex at a CDN or hosting service

Handle it with one of the following.

• Write A/AAAA records directly: If the service gives you fixed IP addresses for the apex, register them as A (and AAAA) records
• Use a feature specific to your DNS service: Features offered under names such as Cloudflare's CNAME flattening, Route 53's alias records, and ALIAS or ANAME. The authoritative DNS looks up the target's IP addresses and returns them as A/AAAA, so there is no conflict with the standard. However, because these are not standard records, you may not be able to reproduce the same setup when you move DNS services, and with a CDN that returns the best IP address for each region, accuracy may change. Check each service's documentation for the specifications

On a WordPress site, if you first decide which of the apex and www is the canonical URL and redirect from the other, the DNS configuration also becomes simpler. If you make www canonical, you can split it up like this: www is a CNAME to the CDN, and the apex is an A record for redirecting.

You need TXT or MX on a name that has a CNAME

If a service asks for a domain-verification TXT or a mail MX on the same name as a CNAME, either drop the CNAME and use an A record, or check whether the service can verify using a different name (such as a dedicated name like _verify.shop).

You want to change a CNAME to an A record during a server migration

In many control panels, you cannot change the record type in place, so you have to delete the CNAME and then add an A record. Between the deletion and the addition, the name cannot be resolved, and resolvers that query during that time cache the answer "does not exist."

1. A few days before, lower the CNAME's TTL to about 300 seconds
2. Have the value of the A record you will add ready before you start
3. Delete the CNAME and add the A record back to back
4. Query the authoritative DNS directly and confirm that the A record is returned

Before you start, note the contents of the records you are changing so that you can restore them right away if there is a problem.

Find conflicts in an existing zone

You can check whether the zones you manage contain a mixture with the following method.

# Ask the authoritative DNS directly for the CNAME and other types of each name
NS=ns1.example-dns.net
for name in example.com www.example.com shop.example.com; do
  for t in CNAME A AAAA MX TXT; do
    printf '%-20s %-6s ' "$name" "$t"
    dig @"$NS" "$name" "$t" +norec +noall +answer | awk -v n="$name." -v t="$t" '$1==n && $4==t {$1=$2=$3=$4=""; printf "%s ", $0}'
    echo
  done
done

# If you have a BIND-format zone file, check it all at once
named-checkzone example.com db.example.com

If the CNAME row has a value for a name and other types also show values, there is a mixture. Some DNS services have a feature or API that exports a zone in BIND format, and if you run the exported file through named-checkzone, you can check all records at once.

Summary

• A CNAME re-points the name itself, so if other records exist on the same name, the answers contradict each other
• It is prohibited by RFC 1034 and RFC 2181; DNS services refuse to register it, and BIND fails to load the zone
• The domain apex has SOA and NS, so it cannot have a CNAME. Use A/AAAA, or a provider-specific feature such as CNAME flattening or aliases
• When switching from CNAME to A, lower the TTL first, then delete and add back to back
• Find existing conflicts by querying the authoritative DNS for each type with dig, or with named-checkzone

• DNS settings when adopting a CDN (CNAME flattening)
• How to unify the domain with and without www

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)