CNAME Chain Tracer

Trace a hostname through every CNAME alias to the address at the end. Catch dangling CNAMEs, alias loops, apex CNAMEs, and chains long enough to slow every page load.

Why the path matters, not just the answer

A resolver hands you the final address and throws the route away. That's fine until the route is the problem. A CNAME is an alias, aliases can point at other aliases, and every hop is a full extra lookup the browser waits on before it can even ask for the first byte.

This tool walks the chain one hop at a time and shows you the whole path, the address at the end, and what's wrong with it.

What it catches

• Dangling CNAME — the chain ends at a name with no A or AAAA record. The alias exists, so the DNS console looks healthy, but the hostname resolves to nothing.
• CNAME loops — the chain returns to a name it already visited. Resolution can never complete.
• Over-long chains — each hop adds latency, and any single hop breaking takes the hostname down.
• CNAME at the apex — invalid per RFC 1034, and usually a sign your provider is quietly flattening it.
• Third-party dependencies — where the chain leaves your control and enters a CDN or SaaS provider.

Dangling CNAMEs and subdomain takeover

A dangling CNAME isn't only a broken hostname — it's the exact shape attackers look for. If blog.example.com still points at a hosting provider's name that nobody owns any more, whoever claims that name next controls content served from your subdomain. Cookies scoped to the parent domain, certificate issuance, and user trust all follow the hostname, not the provider.

The fix is unglamorous: when you stop using a service, delete the CNAME before you release the resource on their side.

Why the apex can't be a CNAME

RFC 1034 says a CNAME cannot coexist with any other record for the same name. A zone apex always carries SOA and NS records, so by definition it can't also be a CNAME. Providers work around this with ALIAS or ANAME records, which look like a CNAME in the control panel but are flattened to A records when served. Convenient, but not portable — the behaviour lives in your provider, not in the protocol.

FAQ

How many CNAME hops is too many?

One is normal. Two is common with a CDN in front. Beyond that you're paying real latency for indirection you probably don't need, and every hop is another thing that can break. Resolvers also enforce their own limits, so a very long chain may resolve for some users and not others.

Why does my hostname have a CNAME I didn't create?

CDN and platform providers commonly insert their own aliases between your record and their edge, so the middle of the chain is theirs to change. That's normal — it's how they steer traffic — but it does mean part of your resolution path is outside your control.

Does a CNAME slow down my site?

A little, and it's front-loaded onto the very first request. Each hop is a lookup that must finish before the connection can open. Usually milliseconds from a warm cache, but it's paid on the cold path where it hurts most — the first visit.

Can a CNAME point to an IP address?

No. A CNAME's target is always another name. If you need an address, the record you want is an A or AAAA record.

Background reading

See the CNAME record lookup for the per-resolver propagation view, plus the DNS Records Explained guide and the DNS glossary.