127

We are hosting many web applications for our customers. As is obvious they want to use their own domains to refer to those applications, usually they want that any user that either type http://www.customer1.example or http://customer1.example goes to their web application.

The situation we are facing is that we need to have the flexibility to change IP addresses in the near future. And we don't want to rely on the customer doing the A record change on their domains. So we thought that using CNAME records will work, but as we find out CNAME records will not work for the root domain.

Basically:

customer1.example IN CNAME customer1.mycompanydomain.example //this is invalid as the RFC
www.customer1.example IN CNAME customer1.mycompanydomain.example //this is valid and will work

We want to be able to change the IP address of customer1.mycompanydomain.example or the A record and our customers will follow this record which we have control over.

in our DNS it will look like:

customer1.mycompanydomain.example IN A 192.0.2.1

Any ideas?

8
  • I do not understand why "customer1.com IN CNAME customer1.mycompanydomain.com" is invalid. I believe it should work. Could you explain where the problem with that solution was?
    – sleske
    Mar 17, 2009 at 21:34
  • 3
    Yes, please read the following question and answer. It is invalid as per the DNS RFC. stackoverflow.com/questions/655235/…
    – Geo
    Mar 17, 2009 at 21:53
  • 2
    I do not understand the title of the question. Where is the "root" (.) involved?
    – bortzmeyer
    Mar 18, 2009 at 7:50
  • 2
    he means the root of a zone, not "the root"
    – Alnitak
    Mar 18, 2009 at 10:51
  • 2
    Well, it is not usual DNS vocabulary, then. Isn't "apex" the proper word? Or "top-level" for Lisp programmers? :-)
    – bortzmeyer
    Mar 19, 2009 at 13:56

10 Answers 10

66

The reason this question still often arises is because, as you mentioned, somewhere somehow someone presumed as important wrote that the RFC states domain names without subdomain in front of them are not valid. If you read the RFC carefully, however, you'll find that this is not exactly what it says. In fact, RFC 1912 states:

Don't go overboard with CNAMEs. Use them when renaming hosts, but plan to get rid of them (and inform your users).

Some DNS hosts provide a way to get CNAME-like functionality at the zone apex (the root domain level, for the naked domain name) using a custom record type. Such records include, for example:

  • ALIAS at DNSimple
  • ANAME at DNS Made Easy
  • ANAME at easyDNS
  • CNAME at CloudFlare

For each provider, the setup is similar: point the ALIAS or ANAME entry for your apex domain to example.domain.com, just as you would with a CNAME record. Depending on the DNS provider, an empty or @ Name value identifies the zone apex.

ALIAS or ANAME or @ example.domain.com.

If your DNS provider does not support such a record-type, and you are unable to switch to one that does, you will need to use subdomain redirection, which is not that hard, depending on the protocol or server software that needs to do it.

I strongly disagree with the statement that it's done only by "amateur admins" or such ideas. It's a simple "What does the name and its service need to do?" deal, and then to adapt your DNS config to serve those wishes; If your main services are web and e-mail, I don' t see any VALID reason why dropping the CNAMEs for-good would be problematic. After all, who would prefer @subdomain.domain.org over @domain.org ? Who needs "www" if you're already set with the protocol itself? It's illogical to assume that use of a root-domainname would be invalid.

3
  • 1
    This particular answer was very helpful to me since I wanted to point a root level domain at a CDN. Most CDNs are by necessity an FQDN, since it could resolve to different IPs at different locations or times. I use DNS Made Easy and was able to use the ANAME record type.
    – Rubix
    Oct 1, 2015 at 6:26
  • 3
    I couldn't agree more. Wanting to host a site from the 'naked' domain name is a common and logical thing to do. It uses less characters, it looks better etc. The url's own protocol identifier (www) is a vestigial part of the url if was even necessary in the first place (it wasn't).
    – Ed Bishop
    May 19, 2016 at 6:57
  • 3
    ANAME's are nice, or you can just 301 all non-www to www. via free 301 redirection service 198.251.86.133 Sep 22, 2016 at 14:10
57

CNAME'ing a root record is technically not against RFC, but does have limitations meaning it is a practice that is not recommended.

Normally your root record will have multiple entries. Say, 3 for your name servers and then one for an IP address.

Per RFC:

If a CNAME RR is present at a node, no other data should be present;

And Per IETF 'Common DNS Operational and Configuration Errors' Document:

This is often attempted by inexperienced administrators as an obvious way to allow your domain name to also be a host. However, DNS servers like BIND will see the CNAME and refuse to add any other resources for that name. Since no other records are allowed to coexist with a CNAME, the NS entries are ignored. Therefore all the hosts in the podunk.xx domain are ignored as well!

References:

5
  • 19
    But WHY are there no other record allowed to coexist with a CNAME. Is this just a limitation added by the author of the RFC or is there a technical reason for it? If there is no technical reason for it, then one could easily come up with an extension RFC.
    – Sven
    Aug 23, 2013 at 1:17
  • So, if it works for me (use CNAME for the root record, other subdomains for that domain still working), that means I'm just lucky and my providers DNS implementation doesn't ignore that additional records altought it could? And it also means I don't need to fear any issues on client side, as long as the DNS server handles it like this?
    – didi_X8
    Mar 4, 2014 at 14:49
  • This is an attempt to answer another question, "why are CNAMEs not allowed at apex", whereas the actual question is "how to overcome this limitation". -1.
    – rustyx
    Dec 3, 2016 at 13:53
  • 1
    For the why see serverfault.com/questions/613829/…
    – rhand
    Jul 3, 2018 at 7:26
  • CNAME'ing a root record is technically not against RFC you will need to explain how it is not against RFC1034 section 3.6.2: If a CNAME RR is present at a node, no other data should be present; this ensures that the data for a canonical name and its aliases cannot be different.. Of course the "root" (that is the apex precisely in this context) has already NS and SOA records and hence can not have CNAME records. Aug 2, 2018 at 23:18
4

I don't know how they are getting away with it, or what negative side effects their may be, but I'm using Hover.com to host some of my domains, and recently setup the apex of my domain as a CNAME there. Their DNS editing tool did not complain at all, and my domain happily resolves via the CNAME assigned.

Here is what Dig shows me for this domain (actual domain obfuscated as mydomain.com):

; <<>> DiG 9.8.3-P1 <<>> mydomain.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2056
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;mydomain.com.          IN  A

;; ANSWER SECTION:
mydomain.com.       394 IN  CNAME   myapp.parseapp.com.
myapp.parseapp.com. 300 IN  CNAME   parseapp.com.
parseapp.com.       60  IN  A   54.243.93.102
1
  • Obfuscation, if really needed (the DNS is public....), should use RFC2606 guidance. And RFC5737 or 3849 for IP addresses Aug 2, 2018 at 23:33
3

My company does the same thing for a number of customers where we host a web site for them although in our case it's xyz.company.com rather than www.company.com. We do get them to set the A record on xyz.company.com to point to an IP address we allocate them.

As to how you could cope with a change in IP address I don't think there is a perfect solution. Some ideas are:

  • Use a NAT or IP load balancer and give your customers an IP address belonging to it. If the IP address of the web server needs to change you could make an update on the NAT or load balancer,

  • Offer a DNS hosting service as well and get your customers to host their domain with you so that you'd be in a position to update the A records,

  • Get your customers to set their A record up to one main web server and use a HTTP redirect for each customer's web requests.

3

Sipwiz is correct the only way to do this properly is the HTTP and DNS hybrid approach. My registrar is a re-seller for Tucows and they offer root domain forwarding as a free value added service.

If your domain is blah.com they will ask you where you would like the domain forwarded to, and you type in www.blah.com. They assign the A record to their apache server and automaticly add blah.com as a DNS vhost. The vhost responds with an HTTP 302 error redirecting them to the proper URL. It's simple to script/setup and can be handled by low end would otherwise be scrapped hardware.

Run the following command for an example: curl -v eclecticengineers.com

3

You have to put a period at the end of the external domain so it doesn't think you mean customer1.mycompanydomain.com.localdomain;

So just change:

customer1.com IN CNAME customer1.mycompanydomain.com

To

customer1.com IN CNAME customer1.mycompanydomain.com.
1
  • For me (BIND 9.8.2), if the records are for domain customer1.com, this works...but is interpreted as specifying CNAMe for a subdomain customer1.com.customer1.com. If I add a point to the first item, the record will be interpreted correctly, but it does not work anymore. I see no solution here. Nov 20, 2019 at 10:10
1

One solution is to create CNAME for www subdomain, then forward the root domain to your www subdomain. First step is done in DNS setting, and the second step is done in Forward Domain section.

Reference: https://www.tachyonstemplates.com/2018/google-domains-forward-root/.

0
  • If your domain register supports ANAME, then you can redirect your root domain using ANAME record.

  • if NO, but it supports forwarding DNS, such as Google Domain, then you can

  1. add a CNAME record to redirect http://www.customer1.example to the domain name you want.
  2. in forward DNS setting, set http://customer1.example to url: http://www.customer1.example,

Then it's done. Usually you may need to wait for a few minutes for it take effect

-2

I see readytocloud.com is hosted on Apache 2.2.

There is a much simpler and more efficient way to redirect the non-www site to the www site in Apache.

Add the following rewrite rules to the Apache configs (either inside the virtual host or outside. It doesn't matter):

RewriteCond %{HTTP_HOST} ^readytocloud.com [NC]
RewriteRule ^/$ http://www.readytocloud.com/ [R=301,L]

Or, the following rewrite rules if you want a 1-to-1 mapping of URLs from the non-www site to the www site:

RewriteCond %{HTTP_HOST} ^readytocloud.com [NC]
RewriteRule (.*) http://www.readytocloud.com$1 [R=301,L]

Note, the mod_rewrite module needs to be loaded for this to work. Luckily readytocloud.com is runing on a CentOS box, which by default loads mod_rewrite.

We have a client server running Apache 2.2 with just under 3,000 domains and nearly 4,000 redirects, however, the load on the server hover around 0.10 - 0.20.

1
  • The question was about DNS. Not about Apache web-server.
    – SamTzu
    Apr 20, 2018 at 8:29
-8

Thanks to both sipwiz and MrEvil. We developed a PHP script that will parse the URL that the user enters and paste www to the top of it. (e.g. if the customer enters kiragiannis.com, then it will redirect to www.kiragiannis.com). So our customer point their root (e.g. customer1.com to A record where our web redirector is) and then www CNAME to the real A record managed by us.

Below the code in case you are interested for future us.

<?php
$url = strtolower($_SERVER["HTTP_HOST"]);

if(strpos($url, "//") !== false) { // remove http://
  $url = substr($url, strpos($url, "//") + 2);
}

$urlPagePath = "";
if(strpos($url, "/") !== false) { // store post-domain page path to append later
  $urlPagePath = substr($url, strpos($url, "/"));
  $url = substr($url, 0, strpos($url,"/"));
}


$urlLast = substr($url, strrpos($url, "."));
$url = substr($url, 0, strrpos($url, "."));


if(strpos($url, ".") !== false) { // get rid of subdomain(s)
  $url = substr($url, strrpos($url, ".") + 1);
}


$url = "http://www." . $url . $urlLast . $urlPagePath;

header( "Location:{$url}");
?>
4
  • 10
    This does not actually answer the question that 69k+ people have come to this thread looking for. The question is more about DNS and has nothing to do with PHP.
    – Matt Clark
    Apr 20, 2016 at 21:36
  • 1
    The question was about DNS. Not about PHP coding.
    – SamTzu
    Apr 20, 2018 at 8:30
  • 1
    HTTP_HOST is the hostname, like its name implies, not an URL. Hence there won't be any http:// to remove, nor / ($urlPagePath will always be empty). Cf httpd.apache.org/docs/2.4/expr.html. Due to the way the code tries to get rid of subdomain, it will also not work for things like www.example.co.uk where co.uk has to be considered as a whole. It also does not handle HTTPS. And finally using PHP just do a an HTTP redirection where any webserver can do it in configuration, is overcomplicated. So in short this certainly should not be the validated answer for this question. Aug 2, 2018 at 23:41
  • If this rule should apply to all hosts then it should be done as a apache config Aug 28, 2018 at 6:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.