Can I use a CNAME at my root domain?

Standard DNS does not allow a CNAME at the apex (root) domain like example.com. Some DNS providers offer ALIAS or ANAME records as a workaround. Cloudflare calls this CNAME flattening. You must use an A record at the root domain in standard DNS.

Why is there a CNAME for my DKIM selector?

Some email providers like Microsoft 365, Mailchimp, and HubSpot ask you to create a CNAME for your DKIM selector. The CNAME points to their infrastructure which serves the actual DKIM key. This lets them rotate keys without requiring you to update your DNS.

Can MX records point to a CNAME?

No. MX records must point to hostnames that have A records, not CNAMEs. Pointing an MX record to a CNAME is against RFC standards and can cause some mail servers to reject or delay inbound email.

CNAME Lookup - Check DNS Canonical Name Records

Q: What is a CNAME record?

A CNAME (Canonical Name) record is a DNS alias that points one hostname to another hostname instead of directly to an IP address. It is used for subdomains, CDNs, email provider setup, and services where the target IP may change.

Built for operators & agencies

Live DNS - no cached APIs

No login required

No data retention

Privacy first diagnostics

Prevents blacklisting - not causes it

Look up CNAME records for any domain or subdomain. Verify redirections are configured correctly, check DKIM canonical names, and debug alias chains that are not resolving as expected.

What is a CNAME record?

A CNAME (Canonical Name) record is a DNS alias. Instead of pointing directly to an IP address, it points to another domain name which is then resolved to an IP. For example, www.example.com might be a CNAME for example.com, meaning both names resolve to the same server.

CNAME records are widely used for services like email providers, CDNs, and SaaS platforms where the target IP may change. By using a CNAME, the service provider can update their IPs without requiring you to change your DNS records.

CNAME records in email deliverability

CNAME records appear in email authentication in a few places:

DKIM with CNAMEs
Some providers (Microsoft 365, Mailchimp, HubSpot) ask you to publish a CNAME record for your DKIM selector instead of a TXT record. The CNAME points to their infrastructure, which serves the actual DKIM key. This lets the provider rotate keys without requiring you to update DNS.
Custom sending domains
Email sending platforms like SendGrid and Mailchimp often require a CNAME for the subdomain you send from (e.g., em123.yourdomain.com).
MX record pointing via CNAME
MX records should not point to a CNAME - they must point directly to an A record. If your MX record points to a hostname that is itself a CNAME, some mail servers may reject inbound email.

CNAME restrictions

Rule	Detail
No CNAME at apex	You cannot use a CNAME at the root of a domain (`example.com`). Use an A record or ALIAS/ANAME if available.
No other records alongside a CNAME	A hostname with a CNAME cannot also have an MX, TXT, or other record at the same label.
No MX pointing to CNAME	MX records must point to hostnames with A records, not CNAMEs.
Chains are allowed but should be short	CNAME chains (A points to B which points to C) work but add latency and can cause issues with some resolvers.

FAQ

Why does my subdomain have a CNAME to a long provider hostname?

This is normal when using email services, CDNs, or SaaS platforms. Providers like Mailchimp, SendGrid, or HubSpot give you a CNAME to point to their infrastructure. The long hostname they provide (e.g., u123456.wl.sendgrid.net) is their server that handles your email or DNS verification.

Can I use a CNAME for my root domain instead of an A record?

Standard DNS does not allow a CNAME at the apex (root) domain. Some DNS providers offer a workaround called ALIAS or ANAME records that behave like a CNAME but resolve at the DNS level. Cloudflare calls this "CNAME flattening." If you need to point your root domain to a hostname, check whether your DNS provider supports ALIAS/ANAME.

My DKIM checker says no record found, but my provider says CNAME is set up correctly

If your DKIM selector is set up via CNAME, the CNAME itself may not contain v=DKIM1 - that is in the target record your provider controls. Use the DKIM Checker which follows CNAMEs when looking up the selector record.