Domains, CDN & Web Delivery

Apex Domain

Definition

The apex is the top of a DNS zone: the exact name the zone was cut from, with no label to its left. What makes it awkward is that the zone's own housekeeping records live there and nowhere else — the SOA record that defines the zone and the NS records that name its nameservers. The DNS specification also says that a name holding a CNAME may hold no other records of any kind. Put those two rules together and the result is unavoidable: a CNAME cannot legally sit at the apex, because the SOA and NS records are already there and cannot be removed. In every other respect the apex is ordinary and can hold A, AAAA, MX and TXT records like any name below it.

Why It Matters

This is where most custom-domain setups stall, because hosts hand out a hostname to point at, not an address, and a hostname is exactly what a CNAME is for. A provider that accepts a CNAME at the apex anyway has either implemented a workaround or is about to break something: in the strict reading, that CNAME masks the MX and NS records, so mail stops and the delegation gets shaky. The usual escape, hardcoding an A record, swaps one problem for a slower one. An address pasted into a zone in 2021 keeps pointing wherever the provider has since moved that IP, and the resulting outage arrives with no warning and no deploy to blame it on.

How It Works

There are four honest ways round it and every host uses one of them. The first is a provider-side pseudo-record — ALIAS, ANAME, or CNAME flattening depending on the vendor — where your DNS provider resolves the target itself and returns the resulting A records at query time, so the answer on the wire is a plain address and the SOA and NS records stay intact. The second is a documented anycast IP: the host publishes a fixed address, promises to keep it, and you set a normal A record to it. The third is to serve the apex only as a redirect, usually a 301 to the www subdomain, which the registrar or host can do without any special record. The fourth is to move your nameservers to the host, so their DNS does the flattening on your behalf. Whichever you pick, the browser still sends the original name in the Host header, so the host knows which site to return.

Real-World Example

Say you connect a custom domain to a deck published on 99helpers. The subdomain half is trivial: pitch.acme.com gets a CNAME and is live in minutes. The apex half is where you choose — either your DNS provider offers ALIAS on acme.com, or you set acme.com to redirect to pitch.acme.com and keep one canonical address. Pick the redirect and you also avoid running two copies of the same content at two names, which is the tidier outcome anyway.

Common Mistakes

  • Pasting the host's CNAME target into the apex record — providers that reject it leave you stuck, and providers that accept it quietly break your MX records
  • Treating acme.com and www.acme.com as one address — they are two names, each needing its own record and its own place on the certificate
  • Hardcoding an A record to an IP you found by resolving the host's hostname yourself — that address was never promised to you and rotates without notice

Related Terms

Put a file online in seconds

Drop in a document, an image, a page or a whole static website and share the link — free, with no build step and no server to set up.

Host a file free →