--- title: Free CNAME Lookup description: See where a hostname is aliased — the CNAME target, its TTL and the chain it resolves through. Verify a CDN or SaaS custom-domain setup, find the alias that points at a decommissioned host, and catch a CNAME placed where one isn't allowed. canonical: https://watchfor.io/cname-lookup --- [Back to all free tools](/free-tools) # CNAME Lookup See where a hostname is aliased — the CNAME target, its TTL and the chain it resolves through. Verify a CDN or SaaS custom-domain setup, find the alias that points at a decommissioned host, and catch a CNAME placed where one isn't allowed. Result No result yet Enter the inputs above and press Run. Results appear here in a moment. Monitor this 24/7 — get alerts on the first failure. [Start free](/auth/sign-up) Only run these tools against systems you own or are authorized to test. Using them to scan or probe systems without permission violates our [Terms](/legal/terms). ## What is CNAME Lookup ? A CNAME record says "this name is an alias for that name": www.example.com → example.com , shop.example.com → shops.myshopify.com , cdn.example.com → d111111abcdef8.cloudfront.net . Resolvers follow the alias and return whatever records the target has. It is how you hand a subdomain to a SaaS product or a CDN without ever knowing their IP addresses — and how a subdomain silently keeps pointing at a service you cancelled two years ago. This tool shows the CNAME target of any name, the chain if the target is itself an alias, and the addresses at the end of it. It also makes the two classic CNAME mistakes visible: a CNAME at the zone apex (which the DNS spec forbids and many providers quietly reject), and a target that no longer resolves — a dangling CNAME, which is both a broken subdomain and a subdomain-takeover risk. ## How it works A CNAME query is answered with the whole chain: - 1 Query `QTYPE=CNAME` — The resolver returns the CNAME record for the name, if there is one. A name that is not an alias returns an empty answer — it has A/AAAA/MX records directly, not a CNAME. - 2 Show the target — The canonical name the alias points to, with its TTL. If that name is also a CNAME, the resolver includes the next link, and so on until a name with real records. - 3 Confirm the end of the chain resolves — Follow up with an A or AAAA lookup of the same name — the tool returns the resolved addresses in the answer when the resolver includes them — to catch a target that no longer exists. A CNAME cannot coexist with other records on the same name (RFC 1034). That is why the apex, which must hold SOA and NS records, cannot be a CNAME. ## When you'd use it ### Verifying a SaaS custom domain Shopify, HubSpot, Netlify, GitHub Pages, Zendesk — they all ask for a CNAME to their name. When their dashboard says "DNS not configured", look the CNAME up: it's missing, points at the wrong target, has a typo, or is still cached from before you added it. ### "The certificate is for another site" A subdomain aliased to a provider that hasn't been told about your hostname serves its default certificate. The CNAME is right; the provider-side configuration isn't. The lookup confirms which is which. ### Hunting dangling records Old staging. , demo. and blog. names pointing at services that were cancelled. If the target name is now unregistered or claimable, an attacker can host content under your subdomain. Look up each CNAME and check that its target still resolves to something you control. ### Understanding why a record "won't save" The DNS provider refuses a CNAME on example.com or refuses to add a TXT next to an existing CNAME. Both are the spec, not the provider: use ALIAS/ANAME on the apex, and put TXT records on a name that isn't an alias. ## Reading the result ### Target name Where the alias points. Note the trailing dot in raw DNS output — shops.myshopify.com. is fully qualified; without it, some tools append your own zone and produce shops.myshopify.com.example.com . ### Chain length One CNAME is normal; two happen with CDNs in front of SaaS; more than that adds a lookup per link and is a sign something can be simplified. ### Empty answer The name is not a CNAME. It may hold direct records or nothing at all — an A lookup tells you which. ### NXDOMAIN at the end of the chain The alias exists but its target doesn't. Clients get an error; the subdomain is effectively dead and, if the target is claimable, dangerous. ## Check it yourself dig CNAME www.example.com @1.1.1.1 +noall +answer dig www.example.com +short follows the chain and prints each link on its own line, ending with the addresses. ## Common pitfalls ### CNAME at the apex example.com cannot be a CNAME because it must carry SOA and NS records. Use your provider's ALIAS / ANAME / CNAME-flattening feature, which answers with A records on the apex while following a target name behind the scenes. ### MX pointing at a CNAME Mail servers must be named by A/AAAA records, not aliases (RFC 2181). Some MTAs tolerate it; others refuse to deliver. Point MX at the real hostname. ### TXT verification on an aliased name You can't add a TXT record on a name that is a CNAME. Providers that ask for both a CNAME and a TXT on the same name expect the TXT on a different label ( _verification.www ) — read their instructions carefully. ## Run CNAME Lookup on every change, not just once. Get alerts the moment something breaks — across HTTP, DNS, SSL, RDAP, ping, blacklist and more. Free forever for 10 monitors. No card. [Start free](/auth/sign-up) ## Frequently asked questions What's the difference between a CNAME and an A record? An A record points at an IP address; a CNAME points at another name and inherits whatever that name resolves to. Use CNAME when someone else controls the addresses (CDN, SaaS); use A when you do. What's the difference between CNAME and ALIAS/ANAME? ALIAS (also ANAME, or CNAME flattening) is a provider feature, not a DNS record type: the provider resolves the target itself and answers with A/AAAA records, so it works at the apex and alongside other records. Clients never see a CNAME. Why does the CNAME target have a trailing dot? In zone files a trailing dot marks a fully qualified name. Without it the name is relative to the zone, which is how cdn.provider.net accidentally becomes cdn.provider.net.example.com . Can I chain CNAMEs? Yes — resolvers follow chains, typically up to 8–16 links. Each link is an extra lookup on a cold cache, so keep chains short. How long does a CNAME change take to propagate? Up to the old record's TTL, like any record. Caches also hold the target's records with their own TTL, so a target change can take the longer of the two. ## Related dns tools - [DNS LookupResolve A, AAAA, MX, TXT, NS, SOA, CNAME, PTR, CAA, SRV records for any domain.](/dns-checker) - [DNS PropagationCheck how a DNS record looks from every prober region simultaneously — spot stale anycast nodes and propagation gaps on a world map.](/dns-propagation-checker) - [Whois LookupModern RDAP-based domain registration lookup: registrar, expiry, nameservers, status flags.](/whois-lookup) - [A Record LookupFind the IPv4 address a domain resolves to — every A record with its TTL, from the resolver of your choice. Spot a stale IP after a migration, a missing record behind a 'site can't be reached', or a round-robin set that is one address short.](/a-record-lookup) --- Canonical page: https://watchfor.io/cname-lookup · Site guide: https://watchfor.io/llms.txt