Why a CNAME Record Cannot Be Used on a Root Domain

When you want to understand why a CNAME record cannot be set on a root domain. This article explains DNS limitations that prevent this setup. 

CNAME Records (Canonical Name Record) are used to make aliases.

In existing systems, hosts and other resources often have several names that identify the same resource, but only one of the equivalent set of names will be the canonical or primary name and all others would be aliases. For example, the names 'bar.example.com' and 'foo.example.com' both may be used to identify the same host, but one of them will be the primary name and the other will be the alias name. In the DNS system, the label on the right-hand side is the CNAME or Canonical (primary) name and the one on the left-hand side is the alias name. So, if a DNS zone is created as follows:

In the CNAME record above, the label on the right-hand side (i.e. 'foo.example.com') is the Canonical Name whereas the label on the left-hand side (i.e. 'bar.example.com') is the Alias Name.

When an A record lookup for 'bar.example.com' is carried out, the resolver will see a CNAME record and restart the checking at 'foo.example.com' and will then return 192.0.2.23.
 

As per RFC 1034 Section 3.6.2, if a CNAME RR is present at a node, no other data should be present; this ensures that the data for a canonical name and its aliases cannot be different.
 

For this reason, CNAME records take priority over other types of records for the same hostname. In other words, the resolver will not see the other records (if any) if a CNAME record is found for the hostname which is being looked up.
 

CNAME records work flawlessly for subdomains as we don't normally run multiple services on a single subdomain. But if a CNAME record is added for the apex/naked hostname (e.g. 'example.com'), then it will disrupt all other services running on that domain and its subdomains within that zone. This is because the resolver will not see any other records for that domain and its subdomains if a CNAME is found for the naked hostname; it will restart the query at the canonical name and will possibly end without returning any values as there won't be any services configured at the canonical host for the other records present in the zone of your alias domain.
 

For example, if a zone is added as follows:
 

When an A record lookup for 'bar.home.com' is carried out, the resolver will first have to look for the NS record(s) for 'home.com' to reach the DNS zone where it can find the A record for 'bar.home.com'. But, unfortunately, it won't reach that zone as it will pick up the CNAME record and start looking in the zone of 'office.com' where it is unlikely to find the A record for 'bar.home.com'.
 

Similarly, if someone sends an email to 'user@home.com', the email won't reach because 'home.com' has delegated its zone to 'office.com' through that CNAME record. So, the email will land up at 'office.com' from where it will most likely bounce back as the user won't be found on office.com's mail server.
 

Hence, it is not recommended to add a CNAME record for the naked domain. Use A records for pointing the naked domain to the destination host.