FREE · NO ACCOUNT REQUIRED

CNAME Record Lookup — see what any subdomain is aliased to.

Query the CNAME (Canonical Name) record for a subdomain in real time. Returns the alias target, TTL, follows the chain until it terminates in an A/AAAA record, and flags dangling CNAMEs (targets that no longer exist) as subdomain-takeover risks. Every dangling CNAME is a live security bug — a target hostname an attacker can claim, inheriting your subdomain.

01 · TRY IT

Look up a CNAME record

CNAMEs only exist on subdomains — never at the zone apex per RFC 1034. Also invisible when the subdomain is behind Cloudflare-style CNAME flattening (proxied records serve A directly). Try `www.reddit.com` (Fastly) or `www.linkedin.com` (LinkedIn CDN).

02 · WHAT IT RETURNS

What the CNAME lookup shows

Alias target (Canonical name)

The domain the CNAME resolves to — the actual host clients follow up on. Empty answer means no CNAME exists at this name.

Chain resolution (Multi-hop)

CNAMEs can chain: A → B → C → actual host. This tool follows the chain until it terminates in an A/AAAA record. Chain depth shown.

Dangling CNAME detection (Takeover risk)

Target hostnames that don't resolve are flagged as subdomain-takeover risks. Cross-checked against 15 cloud-provider fingerprints (S3, CloudFront, Heroku, Azure Blob, GitHub Pages, Vercel, Netlify, Zendesk, HelpScout, more).

TTL per hop (Slowest wins)

The slowest TTL in the chain dominates propagation. Useful for planning cutovers — you can't shorten upstream TTL by aliasing to a fast-TTL name.

Provider fingerprint (CDN identified)

Common CDN + SaaS target patterns are labelled — see whether the CNAME points at Cloudflare, Fastly, CloudFront, Webflow, Framer, Shopify, etc.

Apex-CNAME check (RFC 1034)

If you queried the apex (root domain), this tool flags whether the DNS host is using CNAME flattening (Cloudflare) or ALIAS records (Route 53, DNSimple) to work around the apex-CNAME prohibition.

03 · WHY IT MATTERS

When to check CNAME

  • Subdomain-takeover audit Every dangling CNAME is a live security bug. Regular CNAME lookup across all your subdomains catches takeover exposure before an attacker does.
  • SaaS CNAME provisioning SaaS platforms typically require a CNAME (`support.yourcompany.com` → `yourcompany.zendesk.com`). This tool verifies the CNAME resolves and chains cleanly to the SaaS backend.
  • CDN migration verification Moving from CloudFront to Cloudflare (or the reverse)? Confirm the new CNAME target actually resolves before flipping DNS.
  • Marketing subdomain hygiene Marketing teams often provision `landing.yourcompany.com` → `webflow.io` and forget about them. Regular audit catches abandoned aliases.
  • M&A DNS due-diligence Acquiring a company? A CNAME audit across their zone reveals every third-party SaaS relationship — Zendesk, Intercom, Marketo, HubSpot, etc. Also surfaces the takeover risks you're inheriting.
04 · QUESTIONS

Common questions

  • What is a CNAME record? A DNS record that aliases one hostname to another. Resolvers follow the chain until they hit an A or AAAA. Typical uses: `www` → load balancer, marketing subdomain → SaaS, subdomain → CDN edge.
  • Why can't I have a CNAME at the zone apex? RFC 1034 forbids it — the apex must hold SOA and NS records, and a CNAME cannot coexist with any other record. Workarounds: CNAME flattening (Cloudflare), ALIAS/ANAME (Route 53, DNSimple, DNS Made Easy) resolve at query time so the apex looks like an A record externally.
  • What is a dangling CNAME? A CNAME pointing at a hostname that no longer exists — a deprovisioned S3 bucket, an expired Heroku app, a deleted Azure Blob container. If the target can be claimed by anyone (as with all major cloud providers), an attacker inherits your subdomain.
  • How long can a CNAME chain be? Technically unlimited but resolvers abandon after ~8-16 hops to prevent loops. Good hygiene keeps chains ≤ 3.
  • Can MX or NS point to a CNAME target? No — RFC 5321 / RFC 2181 forbids it. MX and NS must resolve directly to A/AAAA. Chaining MX or NS through a CNAME is a common misconfiguration that some resolvers silently follow anyway.
05 · RELATED

Related DNS + security tools

Subdomain Finder (Enumeration)

Enumerate every subdomain via crt.sh + DNS brute-force with takeover detection.

A Record Lookup (IPv4)

Check the final A record the CNAME chain resolves to.

DNS Query (All Records) (Super tool)

Full DNS dump — see CNAME alongside every other record type.

DNS Propagation (Global spread)

Check whether the CNAME change has propagated worldwide.