How to Create a Subdomain: DNS Records, Server Setup and SSL

This article is a localized edition of the Japanese original. Read the Japanese original

You can create a subdomain (such as blog.example.com) without registering a new domain: just add one line of records to DNS. Resolving the name is not enough to display anything, though; the subdomain becomes usable only once the receiving server is configured and an SSL certificate is in place. This article explains how to choose and add DNS records, configure the web server, switch to HTTPS, and the options for running WordPress on a subdomain, along with commands to check each step.

What creating a subdomain actually involves

Creating a subdomain is easier to reason about if you split it into three tasks:

1. DNS: register which IP address (or which host name) the name blog.example.com points to
2. Web server: configure which directory (which app) to serve when a request arrives for that name
3. SSL certificate: prepare a certificate that is valid for that name

The "subdomain settings" feature of a rental hosting service handles tasks 2 and 3 (and sometimes 1) in one go. If that host also manages your domain's DNS, the DNS records are often created automatically, but if your DNS is managed elsewhere, such as Cloudflare or your registrar, you have to add the record on the DNS side yourself. Start by confirming where your DNS is managed.

# Check the domain's authoritative DNS servers (where DNS is managed)
dig NS example.com +short

The control panel of the name servers shown here is where you add records. Even if you create a subdomain in your hosting control panel, it will not appear in DNS if the NS records point to a different provider. This mismatch is behind most cases of "I created a subdomain but it does not show up."

Choosing a DNS record (A / AAAA / CNAME)

Subdomains mainly use three record types:

• A record: points the name to an IPv4 address. Use it when you know the IP address of your VPS or hosting server.
• AAAA record: for IPv6 addresses. Add it only if the server supports IPv6 and the web server is listening on IPv6. If you add it without IPv6 support, only devices that try to connect over IPv6 will fail to connect.
• CNAME record: makes the name an alias of another host name. Use it when an external service (such as an online store builder or a help desk tool) tells you to "set a CNAME to this host name." Its advantage is that it follows changes on the service side even if the IP address changes.

CNAME has restrictions. A name with a CNAME cannot hold any other records (such as MX or TXT) at the same time. You also cannot put a CNAME at the zone apex (example.com itself), so treat it as something for subdomains only.

In zone file format it looks like this. In control panels you usually enter it in separate fields: "Host name", "Type", "Value" and "TTL".

; Many control panels expect just "blog" in the host name field (the domain name is appended automatically)
blog    3600  IN  A      203.0.113.10
blog    3600  IN  AAAA   2001:db8::10
shop    3600  IN  CNAME  shops.example-saas.net.

The host name field is where people trip up. In some control panels entering blog gives blog.example.com, while entering blog.example.com gives blog.example.com.example.com. After saving, check in the record list that the full name is what you intended.

If you have no changes planned, a TTL of around 3600 seconds (one hour) is enough. If you expect to tweak the settings several times right after creating the record, set it short, such as 300 seconds, and raise it again once things are stable; this makes adjustments easier.

If you use Cloudflare

If Cloudflare manages your DNS, you can choose per record whether to enable the proxy (the orange cloud icon). When it is enabled, visitors get Cloudflare's IP addresses and content is delivered through Cloudflare. For names used for non-web purposes such as SSH or FTP, disable the proxy (DNS only). The wording on screen may change, so also check the official documentation (as of October 2026).

Check that the record has propagated

After adding a record, first query the authoritative DNS server directly. If it returns the correct value, the DNS configuration itself is right.

# Query the authoritative DNS server directly (bypassing caches)
dig @ns1.example-dns.net blog.example.com A +short

# Check through the resolver you normally use
dig blog.example.com A +short

If the authoritative server answers correctly but your machine still gets an old result or "does not exist", the cause is caching. In particular, if you accessed the name once before creating the record, the "does not exist" response (NXDOMAIN) itself is cached. How long this negative answer is kept is set by the SOA record, so wait a while or check with another resolver (for example dig @1.1.1.1).

Web server configuration

Even if DNS resolves correctly, the main site or a default page is shown if the web server does not know the name.

On rental hosting

When you add blog.example.com in the control panel's subdomain settings, a public directory is usually created automatically. Note where that directory is and put your files or WordPress there. If your DNS is managed externally, look up the hosting server's IP address and add an A record.

On a VPS (Apache)

Add one virtual host. Configuration file locations and how to enable them differ by distribution, so adapt this to your setup.

<VirtualHost *:80>
    ServerName blog.example.com
    DocumentRoot /var/www/blog
    <Directory /var/www/blog>
        AllowOverride All
        Require all granted
    </Directory>
    ErrorLog ${APACHE_LOG_DIR}/blog_error.log
    CustomLog ${APACHE_LOG_DIR}/blog_access.log combined
</VirtualHost>

After changing the configuration, run a syntax check before applying it.

sudo apachectl configtest
sudo systemctl reload apache2

Nginx works the same way: add a server block with server_name blog.example.com;, check it with sudo nginx -t, then reload.

Get an SSL certificate

These days HTTPS is expected even on subdomains. Obtain the certificate after DNS resolves and the site is reachable over HTTP. If you apply before DNS has propagated, domain ownership validation fails.

Rental hosting services often have a setting to enable free SSL per subdomain. If you use Let's Encrypt on a VPS, obtain the certificate with Certbot by specifying the name.

sudo certbot --apache -d blog.example.com

If you expect to add more subdomains, a wildcard certificate for *.example.com is another option. To get a wildcard certificate from Let's Encrypt you need the DNS-01 method, which proves ownership with a TXT record in DNS. A plugin that integrates with your DNS provider's API makes it easier to automate renewal.

Options for putting WordPress on a subdomain

There are two ways to run WordPress on a subdomain:

• Install a separate WordPress: do a normal fresh install with a database separate from the main site (or a different table prefix). This suits cases where you want separate plugins and users.
• Use Multisite (subdomain type): manage several sites with one WordPress. This setup sets SUBDOMAIN_INSTALL to true in wp-config.php, and it is common to combine a wildcard DNS record (an A record for *) with a wildcard certificate so you do not have to touch DNS each time you add a site.

Multisite is hard to undo later, so we recommend taking a backup before enabling it and testing in a staging environment before moving to production.

What to check, in order, when it does not work

1. Does the output of dig NS example.com +short match the control panel where you added the record?
2. Does dig @authoritative-server against the authoritative server return the correct value (no doubled host name)?
3. Is the response from curl -I http://blog.example.com/ coming from the intended server and directory?
4. Has the certificate been issued for that name? (Check browser warnings or the output of curl -vI https://blog.example.com/.)

Summary

• Creating a subdomain consists of three tasks: DNS, the web server and the SSL certificate.
• Add records in the control panel of the authoritative DNS server you identified with dig NS.
• Use A (plus AAAA if needed) for your own server and CNAME to point to an external service. A CNAME cannot coexist with other records.
• Start checks by querying the authoritative server directly, to rule out caching effects.
• Get the certificate after DNS has propagated, and consider a wildcard certificate if you will add more subdomains.

• DNS A records vs. CNAME records and how to set them
• What to do when your subdomain's DNS settings do not take effect

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)