DNS Routing & Apex Domain Infrastructure — Knowledge Base
A reference wiki for how apex/root domain redirects are routed to our AWS ALB infrastructure, why the architecture looks the way it does, the incident that exposed a gap in it, and the fix + best-practice standards going forward.
Pages
- DNS Fundamentals — Apex vs CNAME
- Architecture Overview
- Static-IP Options Compared
- Apache Virtual Host Best Practices
- Incident Postmortem — Apex Vhost Fallthrough
- Recommended Apache Config Templates
- New Apex Domain Onboarding Checklist
Quick summary
- Apex/root domains (
example.com, no subdomain) cannot use a CNAME record per DNS spec (RFC 1034/1035) — they need an A record, which means a static IP. - Our ALB has no static IP, so apex domains are pointed at a small dedicated
"MainDomains" Apache server with a fixed IP, which 301-redirects
example.com→www.example.com. - That server hosts vhosts for multiple unrelated clients. A missing or misconfigured vhost entry causes Apache to fall through to whichever vhost loaded first — which briefly served one client's traffic to another client's site. Root cause + fix are documented in the Incident Postmortem.
- Long-term, Global Accelerator or a Route 53 Alias record are both stronger alternatives to the shared-server pattern.