Are website subdomains that start with "www." and those which do not start with "www." one and the same thing?

Question

For a website, e.g. example.co.uk, when I write it in the URL bar of browser, it takes me to the URL https://example.co.uk.

When I enumerate the subdomains of the website, I get subdomains like www.example.co.uk, kneal.example.co.uk, www.kneal.example.co.uk, sink.example.co.uk, www.sink.example.co.uk etc.

When I visit e.g. kneal.example.co.uk and www.kneal.example.co.uk in the browser, I see the same webpage. I have been observing it for a while and this is always the case.

When I perform vulnerability assessment scans on e.g. sink.example.co.uk and www.sink.example.co.uk, I get the exact same vulnerabilities. Even if I perform a site-structure enumeration of the website, I see the exact same site-structure. I have been observing it for a while and this is always the case.

Are subdomains of websites that start with www., same thing (with two different names - one starting with www. and one starting without www.) as those subdomains which do not start with www.?

If so (that is if they are not different), why do I get both something.example.co.uk and www.something.example.co.uk when enumerating example.co.uk?

Answer 1

They aren't necessarily the same, but the convention is to configure them to work that way. But it's just a convention, and there are sites where it does make a difference.

Answer 2

Subdomains named www (for World Wide Web) are not special compared to other subdomains. That is, there is no mechanical reason for a domain to be named www.example.com instead of hello.example.com. Both of them are simply subdomains of example.com, which is a subdomain of the top-level domain com. Each of them could resolve to the same or to different servers, depending on their DNS entries. And, since the HTTP protocol requires browsers to use the Host header, to let servers know through which domain name they were accessed, servers can freely choose to serve the same or different content.

It is generally accepted to use either example.com or www.example.com as your official domain name, and have the other automatically redirect to the equivalent page with the domain name changed. Other subdomains usually serve different content, like that for a sub-organisation, for a specific user (like how Tumblr serves Neil Gaiman's blog on neil-gaiman.tumblr.com) or for different communities (like Stack Overflow), but they don't have to.

And since subdomains can have subdomains of their own, website owners could decide that they'd prefer to use www.specific-subdomain.example.com over specific-subdomain.example.com, but that's not fundamentally different from the choice to have something like incredibly.nested.specific-subdomain.example.com.

So the answer to your question is domains with www. and without www. are not the same. Unless the server is configured to make it the same.

Answer 3

This depends how it is set up in DNS. You will likely find that www is a CNAME (an alias) of the main domain - especially on a cpanel server. But this is only convention, it is a subdomain just like all the other subdomains.

You could have the www subdomain be a completely different website, but you would only confuse people.

Answer 4

To add to existing answers, a large (and recent) contributor to this confusion is Google Chrome's series of decisions to "simplify" the address bar, which results in hiding the www. prefix if present.

So if a user manually enters the address with www., the bar always shows it without www., even if the website is actually configured to prefer www., and in fact 301 redirects to it from the bare/naked domain. I can see how this therefore makes people think www. and no www. is the same thing. It takes focusing on the address bar twice to reveal the actual full domain name and if it has a www. or not.

Lastly, if you're deciding on www. for your site, here are some articles providing background on the issue and arguing you may want it for cookie efficiency and CNAME convenience.

Answer 5

As others have said, it's conventional to make them equivalent, as a convenience to users.

But for very popular web sites they're often not implemented the same way in DNS. Large sites generally use a content delivery network (CDN, such as Akamai or Cloudflare) to implement their services. This typically requires making the www name (and often other subdomains) a CNAME for the CDN's server name. But the apex of the site's domain can't be a CNAME, so redirecting this to the CDN must be done differently. The CDN might provide DNS service and host the domain, with the DNS server integrated into the CDN architecture so it provides the appropriate IP address. Another option is to point the apex to the IP of specific server(s), which send HTTP redirects to the www address that uses the CDN.

Apple is an example of this.

$ host www.apple.com
www.apple.com is an alias for www.apple.com.edgekey.net.
www.apple.com.edgekey.net is an alias for www.apple.com.edgekey.net.globalredir.akadns.net.
www.apple.com.edgekey.net.globalredir.akadns.net is an alias for e6858.dscx.akamaiedge.net.
e6858.dscx.akamaiedge.net has address 104.88.72.214
e6858.dscx.akamaiedge.net has IPv6 address 2600:1401:4000:5a6::1aca
e6858.dscx.akamaiedge.net has IPv6 address 2600:1401:4000:59c::1aca

edgekey.net, akadns.net, and akamaiedge.net are parts of the Akamai CDN service.

$ host apple.com
apple.com has address 17.253.144.10

17.253.144.10 is an Apple server. If you try to fetch a web page from this server, you get a redirect.

$ curl -D/dev/stdout -s apple.com
HTTP/1.1 301 Redirect
Date: Thu, 06 Oct 2022 14:00:47 GMT
Connection: close
Via: http/1.1 usbos3-edge-bx-006.ts.apple.com (acdn/167.13279)
Cache-Control: no-store
Location: https://www.apple.com/
Content-Type: text/html
Content-Language: en
X-Cache: none
CDNUUID: 01b82426-c712-4dd6-935e-de920112331f-1455864698
Content-Length: 304

Answer 6

Usually but not necessarily.

The internet and the domain name system predate the web.

It was the traditional practice to use a different subdomain for each service, this gave flexibility in hosting, the web server could be on a different machine to the ftp server which could be on a different machine to the irc server and so-on. The bare domain would often have no A record at all.

As the web became more and more dominant compared to other services it became common practice to offer web services on the bare domain. How exactly this was done varied, some sites simply offered the same pages on both hostnames, some sites redirected the bare domain to the www subdomain, some sites redirected the bare domain to the www subdomain.