I don't get how CNAME DNS records work.

I always thought setting

bar.example.org.        CNAME  foo.example.com.

would let me request bar.example.org and receive foo.example.com while I own the domain foo.example.com, and somebody else owns bar.example.org.

That doesn't make sense, because I could point any domains (even without permission) to my content.

So, I thought it's rather the other way around, and if I'm the owner of bar.example.org I can point this domain to foo.example.com. That would be weird as well, as my page would display somebody else's content that the owner might not even be aware of.

So how does a CNAME actually work?

2 Answers 2


Anybody can create a CNAME that points at your site. If your site is configured as the default host on its server, this will cause your site to be served under that domain name.

Because of this, I recommend that you always configure your site to run as a virtual host on your server. The default host can be configured to redirect to your website. That way all CNAME records pointed to your website will just cause a HTTP redirect and the user will end up on the correct URL.

If you are using shared hosting (most websites do), then your site is already configured as a virtual host. Any requests for unrecognized hosts names to the server will give error messages or redirect to the hosting company website.

If you want a CNAME to point to your site you will need to set up a second virtual host directive for it. If you are using Apache, you can use allow, deny rules to limit the IP addresses that can view the site under that cname. Here is an example adapted from a stack overflow question:

<VirtualHost *:80>
  ServerName cname.someothersite.example.com
  DocumentRoot /var/www/mysite
  <Directory /var/www/mysite>
    Order Deny,Allow
    Deny from all
    Allow from 
  • Good advice to follow.
    – dan
    Jun 11, 2013 at 3:06
  • That's interesting. So in my case, I actually want to allow somebody else's domain to access my website. How can I restrict access to a certain domain / IP?
    – horen
    Jun 11, 2013 at 7:31
  • I added a section to my answer to address that. Jun 11, 2013 at 11:51

CNAME records work like links do, except at the DNS-level. Just like you can link to any site, you can create a CNAME record to any host as well.

As is the case with links, webmasters/server admins should always check for allowed hosts and IP's, but unfortunately many do not, which is where "leaching" becomes a real problem. It can also create issues with search engine indexing, among other things...

So is it OK to just CNAME-away? That depends on who and what you're making the CNAME to. Most sites/hosts that allow this, such as a Content Delivery Network (CDN), will state this in their TOS agreement, and will likely check a database of allowed hosts too.

Also, for legal and ethical reasons, I should state that anyone planning on making a CNAME to an outside host should first confirm that it's OK to do so - not that I'm saying you wouldn't! <--Great way to lose points, right?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.