Halloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsSlow PC?RecommendedPC slow today? Run a repair scan before it gets worseResolve common Windows issues and optimize system performance.Scan NowHalloween DealsAmazon USOctober picks are moving - compare before checkoutAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
World desk10 min

Adding a Subdomain: Should You Use an A Record or CNAME?

Use A for an IPv4 address, AAAA for IPv6, and CNAME for a provider's hostname. This guide covers subdomain setup, apex limitations, delegation, TTLs, proxying, TLS, verification, and troubleshooting.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Use an A record when your host gives you an IPv4 address. Use a CNAME when it gives you another hostname. If the host supplies an IPv6 address, add an AAAA record. Then configure the web host and TLS certificate for that same name; DNS only directs requests and does not create the site.

The short decision: match the record to the destination you were given

A subdomain such as blog.example.com is normally added to the authoritative DNS zone for example.com. The record type depends on what the service you are connecting to supplies:

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • IPv4 address: create an A record.
  • IPv6 address: create an AAAA record.
  • Hostname: create a CNAME record pointing to that fully qualified name.

Do not put an IP address in a CNAME field. A CNAME target is a DNS name, not an address. Conversely, do not turn a provider’s hostname into an A record unless the provider explicitly gives you an IP address and says it is stable enough for that use. Hosted platforms often change the addresses behind their hostname; the alias lets their DNS continue to direct your traffic without requiring you to edit your zone.

A record versus CNAME: what changes in practice?

Question A record CNAME record
Destination One IPv4 address Another DNS hostname
Typical use A server or load balancer whose IPv4 address you control or were assigned A SaaS, CDN, or hosted service that gives you an endpoint name
When the endpoint changes You must update the address in your zone The target provider can change its own addresses behind the hostname
IPv6 Use a separate AAAA record for an IPv6 address The target name can resolve to IPv4, IPv6, or both
Zone-apex compatibility Can be used at the apex, subject to your provider’s normal rules A standard CNAME cannot be used at the apex
Other records at the same name Can coexist with other record types where DNS permits Cannot share its name with MX, TXT, A, AAAA, or other data records
Operational control Direct control over the address returned Delegates endpoint selection to the target hostname’s operator

An A record maps a name directly to an IPv4 address. A CNAME creates an alias: a resolver follows the alias and then looks up the target name. The choice is not a matter of which record is “faster”; it is determined by the destination format and by whether the service expects you to use an alias.

#1 Best Overall
Elebase USB to USB C Adapter for iPhone 18 Pro Max,USBC Car Charger Adapter | 4Pack Type C Female to A Male Cable Converter for Apple Duo 17 16 15 14 Plus,iWatch Watch 12 11 10,iPad 9 8 Air,Airpods 5 4
  • Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
  • Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
  • Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
  • Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
  • 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.

Before adding anything, find the authoritative DNS provider

Changing records at your domain registrar will not help if another company hosts the domain’s authoritative zone. Look at the domain’s nameservers, then open the DNS dashboard belonging to the provider named there. That is where the record must be created.

You can inspect the delegation from a terminal with:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
dig NS example.com

The nameservers returned for the parent domain identify the authoritative service. Some registrars also offer DNS hosting, while others only sell the domain and point it to a separate DNS provider. If you edit the wrong dashboard, the record may appear to save successfully but never reach public resolvers.

How to add blog.example.com, step by step

  1. Get the provider’s required destination. Confirm whether the service supplied an IPv4 address, an IPv6 address, or a hostname. Copy the value exactly. For a CNAME, preserve the complete hostname as supplied.
  2. Open the authoritative DNS zone. Choose the domain that contains example.com, then select the dashboard action usually labelled Add record, Create record, or similar.
  3. Enter only the label in the Name field. For blog.example.com, many dashboards expect blog, not the complete domain. Some interfaces accept the full name and remove the zone automatically; follow the field’s displayed example so you do not accidentally create blog.example.com.example.com.
  4. Select the type. Choose A for IPv4, AAAA for IPv6, or CNAME for a hostname.
  5. Enter the value. Put the numeric address in an A or AAAA record. Put the provider’s DNS name in a CNAME record. Never put https://, a path such as /login, or a port number in a DNS value.
  6. Set TTL and any proxy option. Keep the provider’s recommended default unless you have a migration reason to change it. If the dashboard offers DNS-only and proxied modes, record which mode you selected because it affects the answer clients observe.
  7. Save the record. Check the resulting row for spelling, type, and value before leaving the page.
  8. Configure the web service. Add blog.example.com to the hosted application’s custom-domain, site, virtual-host, or domain settings. Request or enable a certificate for the hostname if the platform does not issue one automatically.
  9. Verify from DNS and HTTP. Query the authoritative server and a public resolver, then load the hostname over HTTPS and confirm that the expected site and certificate are returned.

Cloudflare’s documented procedure expresses the core entry similarly: choose A, use the subdomain (such as blog) as the record name, and enter the IPv4 address in the address field. Interfaces differ, but the DNS data does not.

Rank #2
Sale
Anker USB-C Hub, 5-in-1 USB Hub for Laptops, 4K HDMI Multiport Adapter | USB C Dongle with 90W Max Power Delivery, 3×5Gbps USB A Data Ports, for MacBook, Dell, and More (Charger Not Included)
  • 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
  • 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
  • Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
  • 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
  • What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.

DNS pointing and website configuration are separate

A successful DNS lookup does not prove that a website is ready. The web server must recognize the Host name (or the HTTPS server-name indication), route it to the correct application, and present a certificate covering that hostname. If you add only the DNS record, visitors may see a provider’s default page, a 404 response, a connection error, or a certificate warning.

Complete both sides:

  • Add the subdomain to the hosting platform or web server’s list of accepted domains.
  • Issue, upload, or enable TLS for the exact hostname. A certificate for example.com alone does not automatically cover blog.example.com.
  • Set redirects and application URLs if the software treats the subdomain as a separate origin.
  • Check any email, API, cookie, or content-security settings that intentionally restrict allowed hostnames.

When a CNAME is the right choice

Hosted platforms and changing endpoints

Use a CNAME when a service instructs you to point a name such as blog.example.com to customer.provider.example. The target name is the provider’s stable interface; its operator can move traffic among addresses without asking every customer to edit DNS. This is the usual pattern for hosted sites, application platforms, and many content-delivery services.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Do not mix a CNAME with other data at the same name

DNS treats a CNAME as an alias for the entire name. Therefore, blog.example.com cannot simultaneously have a CNAME and an A, AAAA, MX, TXT, or other record at that exact name. Put mail-related records on a different hostname, and remove an old address record before creating the CNAME if the provider requires an exclusive alias.

Why the root domain cannot normally use a CNAME

The zone apex is the bare domain, example.com. It is also where the zone’s authoritative NS and SOA records live. The DNS protocol does not allow a conventional CNAME at that top node, a restriction documented by Amazon Web Services for Route 53. A name such as www.example.com or blog.example.com is below the apex and can normally use a CNAME.

Rank #3
Sale
Anker USB C Hub, 7in1 Multi-Port USB Adapter, 4K@60Hz USBC to HDMI Splitter | 85W Max PD, 2 USB 3.0 & 1 USBC Data Ports, SD/TF Card Reader, for Laptops/Mac and Other Type C Devices (Charger Not Included)
  • Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
  • Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
  • Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
  • Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
  • What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.

If a service asks you to point the apex to a hostname, use the feature your DNS provider supplies for that purpose:

  • Route 53 alias records can point the apex to selected AWS resources.
  • Google Cloud DNS ALIAS provides CNAME-like apex behavior in that provider’s implementation.
  • Other providers may call the feature ALIAS, ANAME, or CNAME flattening.

These are provider features, not interchangeable new DNS record types available everywhere. If your provider has none of them, use an A/AAAA address supplied for the apex or place the CNAME on www and redirect the bare domain through a supported web service.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Using AAAA for IPv6

An AAAA record is the IPv6 counterpart to an A record. If your host supplies both address families, you may publish both at the same hostname. Clients that support IPv6 can use the AAAA answer, while others use A. Do not place an IPv6 address in an A record; the record type must match the address family.

Ask the provider whether the IPv6 address is dedicated and stable. If it is temporary or dynamically assigned, follow the provider’s hostname-based method instead of hard-coding it.

Rank #4
Sale
UGREEN USB to USB C Adapter Combo 4-Pack, 10Gbps USB C Converter Space Gray | Data transfer & Fast charging for MacBook, iPhone 17/16/15, iPad, Samsung Galaxy, Apple Watch
  • Dual Converters, Infinite Potential:Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
  • Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
  • Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
  • Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
  • Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft

Keeping records in the parent zone or delegating the subdomain

Most organizations keep blog.example.com as an ordinary record in the example.com hosted zone. That is simplest when one team manages the whole domain.

For operational separation, create a separate hosted zone for sub.example.com. Add NS records for that child zone in the parent zone. From then on, the delegated nameservers manage every name below sub.example.com. AWS documents both models: records can stay in the parent hosted zone, or a separately hosted child zone can be delegated with NS records.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Delegation is useful when another team, business unit, or DNS provider must control many records under the subdomain. It also creates an additional failure point: the parent NS delegation and the child zone’s own records must both be correct.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

TTL, caching, and proxy modes

TTL is the time recursive resolvers may cache an answer. A lower TTL helps during a planned migration because resolvers are allowed to refresh sooner, but it causes more DNS lookups. A higher TTL reduces repeated queries and can improve cache efficiency, but old answers may remain visible longer after a change.

Best Value
Sale
Anker USB C Hub, 5-in-1 USBC to HDMI Splitter with 4K Display | 85W Max PD, 1 Powered USB-C 5Gbps & 2 Powered USB-A 3.0 5Gbps Data Ports, for MacBook Pro, MacBook Air, Dell and More (Black)
  • 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
  • Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
  • Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
  • HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
  • What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.

Lower the TTL before a migration, make the change, verify the new destination, and restore a normal value afterward if your operating policy calls for it. TTL is not a guarantee that every client changes at exactly that second: recursive resolvers, application caches, and provider behavior can affect observation time.

Some DNS providers offer a proxy mode in which traffic is routed through their network rather than answered as DNS-only. Proxying can change the address clients see and may apply a provider-controlled or default TTL. Document the selected mode, especially when troubleshooting or comparing an authoritative answer with a public lookup.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Verify the record instead of guessing

Check the authoritative response first, then ask a public resolver. Replace the example names with your own values:

dig blog.example.com A
dig blog.example.com AAAA
dig blog.example.com CNAME
dig @authoritative-nameserver.example blog.example.com
  • An A query should return the expected IPv4 address when an A record is configured.
  • An AAAA query should return the expected IPv6 address when one is configured.
  • A CNAME query should show the target hostname. A resolver may then return the target’s A or AAAA address in the final answer.
  • The authoritative query tells you whether the zone is correct; a normal query tells you what a recursive resolver currently has cached.

After DNS is correct, test the service itself:

curl -I https://blog.example.com

Confirm that the status, redirect chain, response headers, page content, and certificate belong to the intended application. A DNS answer that points somewhere else, or a certificate issued for a different name, indicates a hosting configuration problem rather than a missing DNS record.

Troubleshooting by symptom

“NXDOMAIN” or no answer

  • Check that you edited the authoritative provider, not only the registrar.
  • Confirm the label and zone. A dashboard that automatically appends the zone can turn a full name into a duplicated name.
  • Check whether the record was saved and whether the queried nameserver is authoritative for the domain.
  • Allow for the previous TTL while recursive caches expire.

“SERVFAIL”

  • Inspect the authoritative response for a delegation or DNSSEC problem.
  • For a CNAME, verify that the target hostname exists and is spelled exactly as supplied.
  • If you delegated a child zone, confirm that the parent NS records and child nameservers agree.

The lookup returns an address, but the wrong site loads

  • Check the web server’s virtual-host or custom-domain mapping.
  • Check whether a proxy is intentionally returning an intermediary address.
  • Remove conflicting A, AAAA, or CNAME data at the same name and wait for caches to refresh.

HTTPS shows a certificate warning

  • Ensure the certificate includes the exact subdomain, not just the parent domain.
  • Complete the hosting provider’s domain-verification step and wait for certificate issuance.
  • Check that the server selected the correct certificate for the hostname during TLS negotiation.

The provider rejects the record at the root domain

You are probably trying to create a conventional CNAME at the zone apex. Use the provider’s alias, ALIAS, ANAME, or CNAME-flattening feature, or follow the provider’s documented A/AAAA alternative. Do not work around the restriction by adding an invalid CNAME beside the apex’s required records.

A safe migration pattern

For a move from one host to another, first lower the existing record’s TTL while the old service is still working. Prepare the new site’s hostname and certificate, then change the A, AAAA, or CNAME value. Query the authoritative server, test through more than one public resolver, and verify the application over HTTPS. Keep the old service available until normal resolver caches have had time to expire and traffic confirms the cutover. Restore the normal TTL after the migration is stable.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Practical checklist

  • Identify the authoritative DNS provider.
  • Decide whether the destination is IPv4, IPv6, or a hostname.
  • Use A for IPv4, AAAA for IPv6, and CNAME for a hostname.
  • Use the subdomain label in the Name field as required by the dashboard.
  • Never put a URL, path, or port in a DNS value.
  • Do not combine a CNAME with other record types at the same name.
  • Use an alias-style provider feature for an apex hostname instead of a standard CNAME.
  • Configure the web host and TLS certificate separately.
  • Account for TTL and proxy behavior during changes.
  • Verify authoritative DNS, public DNS, HTTP response, and certificate.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
PC Slower Than It Used to Be?Free scan - under a minute
Crashes, No Sound, or Screen Glitches?Free driver scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.