CNAME at apex: why it breaks (ALIAS, ANAME, flattening)
People search “CNAME at apex” when a CDN or host says “point example.com with a CNAME.” Classic DNS cannot do that. Here is the conflict—and the legal workarounds.
Why a CNAME at the apex is a problem
A CNAME says “this name is an alias of that name, and nothing else.” The zone apex (example.com) already must have SOA and NS records. Putting a CNAME on the same name violates the spec. Strict DNS panels reject it; sloppy ones accept it and then mail or other records break.
Apex domain CNAME vs www CNAME
www.example.com may be a CNAME to your CDN. example.com (the apex / bare domain) may not, unless the DNS host synthesizes addresses. If a tutorial says “CNAME the domain,” they usually mean www—or they assume Cloudflare-style flattening. Confirm you edited host @ only when the provider documents apex aliasing.
ALIAS, ANAME, and CNAME flattening
Providers invent apex-friendly types: ALIAS/ANAME (Route53 alias, DNSimple ANAME, and similar) or CNAME flattening (Cloudflare). The panel stores an alias; public resolvers still see A/AAAA. That is the supported way to “CNAME the apex.” A raw CNAME row next to SOA/NS is not.
What CrowWake checks
The free apex checker looks for A and AAAA at the bare domain and whether a CNAME appears there. A CNAME at the apex → warn so you notice flattening vs a mis-paste. Missing address records → warn. Hourly watch still tracks whether the apex resolves. For the repeat “watch zone apex hourly” job, see apex domain monitoring.
How to fix a bad apex CNAME
1) Run the free apex checker. 2) If your DNS host supports ALIAS/ANAME/flattening, use that feature—not a raw CNAME. 3) Otherwise delete the apex CNAME and add A/AAAA for the IPs your host lists. 4) Keep www as its own CNAME if you want. 5) Re-check A records and HTTPS, then add the domain so CrowWake crows if the apex goes dark.
What “good enough” looks like
Public DNS for example.com answers with the IPs you expect. www is a separate choice. If you use flattening, CrowWake cares about what the internet sees, not the proprietary record type in the panel.
Watch this on CrowWake
Add the domain, leave the boxes checked, and the flock will crow when this drifts.
Or try the free CNAME at apex checker with no login.
Deep dive: Apex monitoring — watch A/AAAA + CNAME-at-apex hourly, with the same free apex checker.
Related: what is an apex / zone apex and the free apex checker.