How a domain name is built from labels
A domain name is a series of labels separated by dots, read from right to left, from most general to most specific. In www.example.com, com is the top-level domain (TLD), example is the second-level domain, and www is a subdomain. Above them all is the root, an empty label written as a final dot.
Each label can be up to 63 characters long, and the full name up to 253. Hostnames use letters, digits and hyphens, and labels in other scripts are stored in an ASCII form that starts with xn--.
TLDs come in two main kinds: generic ones such as com, org and app, and two-letter country codes such as uk and de. Some registries sell names one level lower, as in example.co.uk, so the name you register is not always at the second level.
Registry, registrar, registrant and DNS host
Four parties are involved in a working domain. The registrar and the DNS host are the two most often confused, because one company can play both roles.
- The registry runs the database and authoritative nameservers for a TLD. Verisign, for example, operates the .com registry.
- The registrar is the company you register and renew the domain through. It sends your contact details and nameserver choices to the registry, and registrars for generic TLDs are accredited by ICANN.
- The registrant is you or your organization, the holder of the registration for a paid term that must be renewed.
- The DNS host runs the authoritative nameservers that answer for your zone, and it is where you edit records. It can be your registrar, a CDN, a cloud provider or your own servers.
Delegation: how the TLD points to your nameservers
When you set nameservers at your registrar, the registry publishes NS records for your domain in the TLD zone. That entry is the delegation, and it tells every resolver which servers are authoritative for your domain. Your zone should list the same nameservers in its own NS records.
If your nameservers are named inside the domain they serve, such as ns1.example.com for example.com, the registry also publishes glue records holding their IP addresses. Without glue, a resolver would have to resolve example.com in order to find the server for example.com.
Editing records at a provider that is not in the delegation has no effect, and it is a frequent reason a change never appears. Check which nameservers are delegated before you edit anything.
The zone apex and why a CNAME cannot go there
The zone apex is the name at the top of your zone, such as example.com, often called the root or naked domain. Every zone must have its SOA record and NS records at the apex.
A name that has a CNAME record cannot have any other records, apart from DNSSEC signatures. A CNAME at the apex would have to sit beside the SOA and NS records, so the DNS standards rule it out (RFC 1034, clarified in RFC 2181).
This matters when a hosting platform gives you a hostname to point at instead of an IP address. A subdomain such as www can use a CNAME to that hostname, but the apex cannot.
Workarounds for pointing the apex at a hostname
DNS hosts and platforms offer several ways around the rule, each with a catch.
- ALIAS or ANAME records and CNAME flattening are provider features, not standard record types. The DNS host looks up the target hostname itself and answers apex queries with the resulting A and AAAA records.
- Plain A and AAAA records work when the platform publishes fixed IP addresses for apex domains. Use them only if the provider commits to keeping those addresses stable.
- You can redirect example.com to www.example.com and give the www name a normal CNAME. The apex still needs A or AAAA records for a server that performs the redirect.
- An HTTPS record (RFC 9460) is allowed at the apex and can alias it to another name. Only clients that query HTTPS records follow it, so you still need A and AAAA records.
The trade-offs of CNAME flattening
With flattening, the answer reflects where your DNS host resolved the target. When the target answers differently by location, as many CDNs do, visitors may not get their nearest endpoint.
The setting is also specific to one provider. If you move to a different DNS host, check that it offers an equivalent feature before you switch, or the apex stops resolving.