DNS Fundamentals — Apex vs CNAME

The core rule

• CNAME records cannot coexist with other record types at the same name, and an apex/root domain (example.com) always needs at least an SOA and NS record at that name — so a CNAME is not allowed at the apex. (RFC 1034 / RFC 1035)
• Subdomains (www.example.com, app.example.com) have no such restriction — CNAME works fine there.

Why this matters for AWS

• An ALB has no static IP — its DNS name resolves to a rotating set of IPs, which is exactly why CNAME (or ALIAS) is the intended way to point a domain at it.
• Since apex domains can't use CNAME, you cannot point example.com directly at an ALB's DNS name with a plain A record — an A record needs a fixed IP, and the ALB doesn't have one.

The three ways around this

Approach	Needs static IP?	Works without Route 53?
Route 53 ALIAS record	No — Route 53 resolves it server-side	No, Route 53-only feature
AWS Global Accelerator	Provides 2 fixed Anycast IPs	Yes
Dedicated redirect server (current)	Yes — the EC2 instance's IP	Yes

Details and trade-offs for each are in Static-IP Options Compared.

Record types quick reference

Record	Used for	Apex-safe?
A	Domain → IPv4 address	Yes
AAAA	Domain → IPv6 address	Yes
CNAME	Domain → another domain name	No
ALIAS / ANAME (Route 53 calls it Alias)	Domain → AWS resource, apex-safe	Yes
NS	Delegates the zone to nameservers	Required at apex
SOA	Zone authority metadata	Required at apex

← Back to the DNS series index