How this check works
A CNAME record says that one name is an alias for another. The resolver follows it, and if the target is also a CNAME, follows that too, until it reaches a name with A or AAAA records. The check queries each step separately through a public resolver and shows every link in the chain with its TTL, then the final addresses. It stops after 10 steps and flags a loop if a name repeats.
How to read the results
- Each link's TTL is cached separately. When you change one, the old value can persist for that link's TTL, even if others are short.
- Long chains add a lookup per step. Two or three links, such as your name pointing to a CDN hostname, are normal; much longer chains slow first visits and multiply the ways resolution can fail.
- A dangling CNAME points to a name that no longer exists, such as a deleted cloud resource. Besides breaking the site, it can let someone else claim that resource and serve content on your name (subdomain takeover). Remove CNAMEs when you retire the service they point to.
- A loop means two names point to each other. Resolvers give up with SERVFAIL.
Rules that catch people out
- A name with a CNAME can't have any other record type (RFC 1034). That's why a zone apex, which must have SOA and NS records, can't be a CNAME. Providers offer ALIAS, ANAME or "CNAME flattening" for the apex instead.
- An MX or NS record must not point to a CNAME. See MX records explained.
Updated 26 October 2026