--- title: Working with CNAME records and your DNS provider summary: null url: >- https://www.fastly.com/documentation/guides/getting-started/domains/working-with-domains/working-with-cname-records-and-your-dns-provider --- Once you're ready to route traffic to a [Fastly service](https://www.fastly.com/documentation/guides/getting-started/services/about-services) using your domain name, you must associate the [domain](https://www.fastly.com/documentation/guides/getting-started/domains/working-with-domains/working-with-domains) with your Fastly service and then update your DNS records to point to Fastly by setting up a CNAME record for the domain. While the steps you follow when setting up a CNAME record for your domain will vary depending on your DNS provider, in general you'll need to input a specific value from Fastly that communicates to your DNS provider where and how to route through Fastly’s network. This guide helps you find the information you'll need from Fastly to [set up a CNAME record](https://www.fastly.com/documentation/guides/getting-started/domains/working-with-domains/working-with-cname-records-and-your-dns-provider#setting-up-the-cname-record-with-your-dns-provider) with your DNS provider including how to [choose the right hostname value for the record](https://www.fastly.com/documentation/guides/getting-started/domains/working-with-domains/working-with-cname-records-and-your-dns-provider#choosing-the-right-fastly-hostname-value-for-your-cname-record). It also includes an [example](https://www.fastly.com/documentation/guides/getting-started/domains/working-with-domains/working-with-cname-records-and-your-dns-provider#example-pointing-wwwexamplecom-to-fastly-with-tls) and a list of [common mistakes](https://www.fastly.com/documentation/guides/getting-started/domains/working-with-domains/working-with-cname-records-and-your-dns-provider#common-mistakes) to help you avoid and troubleshoot problems. > **IMPORTANT:** Fastly is not a DNS provider. The steps you follow when setting up a CNAME record for your domain will vary depending on your DNS provider. You must have access privileges to modify DNS records for your domain. ## Before you begin Keep in mind the following CNAME configuration limitations. Specifically: - **Shared TLS domain incompatibility.** You can't add a CNAME record for a [shared TLS domain](https://docs.fastly.com/products/legacy-shared-tls). - **Apex domain incompatibility.** You can't use a CNAME record if you plan to use Fastly on your apex domain (e.g., `example.com` rather than `www.example.com`). Check out our guide to [using Fastly with apex domains](https://www.fastly.com/documentation/guides/full-site-delivery/domains-and-origins/using-fastly-with-apex-domains) for more details. ## Choosing the right Fastly hostname value for your CNAME record When you set up your CNAME record, you'll need to enter a hostname value. This value is used to communicate to your DNS provider where and how to route through Fastly’s network. The value you choose will differ based on: - the standard HTTPS (TLS) support requirements for your domain, including whether or not HTTP/2 is enabled. - any [custom TLS options](https://docs.fastly.com/products/tls-service-options) purchased for your domain. - whether or not you choose to [limit your traffic](https://www.fastly.com/documentation/guides/getting-started/concepts/using-fastlys-global-pop-network#limiting-traffic-to-a-subset-of-pops) to the North American and EU network or use [Fastly's global network](https://www.fastly.com/documentation/guides/getting-started/concepts/using-fastlys-global-pop-network). In the next sections you can find recommendations based on the most common criteria. ### Non-TLS hostnames and limiting traffic If you don't require TLS support and only need to accept HTTP (Port 80) connections, use one of the following values for the CNAME record: | Location to route traffic | CNAME record value | | ------------------------------- | ------------------------------------ | | Fastly's entire global network | `dualstack.nonssl.global.fastly.net` | | North American and EU POPs only | `dualstack.nonssl.us-eu.fastly.net` | > **HINT:** Fastly's non-TLS hostnames refuse HTTPS connections (port 443) to prevent TLS certificate mismatch errors. ### TLS-enabled hostnames If using [Fastly TLS](https://docs.fastly.com/products/tls-service-options#fastly-tls), you must use the assigned CNAME record value provided in the Fastly web interface. Using an incorrect value may cause HTTPS (port 443) visitors to receive a TLS certificate mismatch error. > **HINT:** This section only applies to Fastly-shared hostnames before `v.sni` alphabetically. Fastly-shared hostnames from `v.sni` onwards have IPv6 enabled by default. The format for the CNAME record value is `.sni.global.fastly.net`. Hostnames from `v.sni` onwards alphabetically have IPv6 enabled by default. For hostnames before `v.sni` alphabetically, prefix the value with `dualstack` to enable both IPv4 and IPv6 connections. | TLS type | CNAME record value | | ---------------------------- | ------------------------------------------ | | Fastly TLS | `.sni.global.fastly.net` | | Fastly TLS with IPv6 support | `dualstack..sni.global.fastly.net` | To locate the CNAME record value: 1. Log in to the [Fastly control panel](https://manage.fastly.com). 2. Go to [**Domains**](https://manage.fastly.com/domains). 3. Locate the domain you would like to route to Fastly. 4. Click **View/edit** next to the appropriate certificate to view DNS details. 5. Locate the CNAME record value under the **DNS details** section. > **HINT:** If you want to limit traffic to a certain region while using a TLS-enabled hostname, contact [support](https://support.fastly.com). ## Setting up the CNAME record with your DNS provider Once you've determined the appropriate Fastly hostname for your domain, the next step is to set up a CNAME record for your domain. Refer to your DNS provider's documentation for exact instructions on how to create or update a CNAME record. If you run your own DNS server or are familiar with the format of BIND zone files, the CNAME record would look similar to this: ```text www.example.com. 3600 IN CNAME nonssl.global.fastly.net. ``` In the above example, the domain set up on Fastly is `www.example.com.`, with a time-to-live (TTL) of `3600` seconds (1 hour), the Record Type is `CNAME`, and the Fastly hostname value is `nonssl.global.fastly.net.` because TLS support isn't required and traffic will be routed through Fastly's entire global network. ### Best practices when updating a DNS CNAME record - Be sure you've [added all domains](https://www.fastly.com/documentation/guides/getting-started/domains/working-with-domains/working-with-domains) you want served by Fastly to the appropriate service. If you don't and you point your domain to Fastly, an `unknown domain` error will occur. - Make sure your service is properly configured. You can test a Fastly service on your local machine [by using curl](https://www.fastly.com/documentation/guides/full-site-delivery/caching/checking-cache) and [testing setup before changing domains](https://www.fastly.com/documentation/guides/getting-started/domains/working-with-domains/working-with-domains). - If you have multiple hostnames on the same domain (e.g., `api.example.com`, `www.example.com`, `app.example.com`), you can use a DNS wildcard record (`*.example.com`) at your DNS provider so only a single CNAME record is created and maintained. You should also add either a matching `*.example.com` domain or the individual domains to your Fastly service. - Before configuring a CNAME record to point to Fastly, change your service configuration to lower the CNAME's TTL to a small number (we suggest 60 seconds) and wait for the old TTL to expire. Creating a DNS CNAME record for your domain after the TTL expiration ensures you have an easy way to roll back changes if you encounter an issue. Once you confirm everything is working properly using Fastly, you can increase the TTL to its original value. ### Checking your CNAME record To check your CNAME record, run the following command in a terminal window: ```term copy $ dig www.example.com +short ``` Your output should appear similar to the following: ```term nolinenums nonssl.global.fastly.net. 151.101.117.57 ``` In most cases, the hostname displayed first will be your current Fastly hostname (in this case, `nonssl.global.fastly.net.`). If you don't see a Fastly hostname in the output or if you see an incorrect Fastly hostname, then either your CNAME isn't properly set at your DNS provider or an older CNAME record is still cached by your local DNS resolver. You can use various online DNS query tools like [OpenDNS Cache Check](https://cachecheck.opendns.com/) or [whatsmydns.net](https://www.whatsmydns.net) to test the current DNS responses from the different DNS resolvers worldwide. ## Example: Pointing [www.example.com](http://www.example.com) to Fastly with TLS In this scenario, you own `example.com` and want `www.example.com` served by Fastly over HTTPS using Fastly TLS. The example uses the `www` subdomain because you can't use a CNAME record with an apex domain (`example.com`). For more information, check out [using Fastly with apex domains](https://www.fastly.com/documentation/guides/full-site-delivery/domains-and-origins/using-fastly-with-apex-domains). 1. **Add the domain to your service.** Add `www.example.com` to your Fastly service and activate the new service version. If you skip this step and point your DNS at Fastly, visitors will receive an `unknown domain` error. 2. **Find your CNAME record value.** In the [Fastly control panel](https://manage.fastly.com/domains), go to **Domains**, locate `www.example.com`, click **View/edit** next to the appropriate certificate, and copy the CNAME record value under **DNS details**. In this example, the value is `p.sni.global.fastly.net`. Because `p` comes before `v.sni` alphabetically, you can add the `dualstack.` prefix to enable both IPv4 and IPv6 connections, which gives you `dualstack.p.sni.global.fastly.net`. 3. **Lower the TTL.** Before changing anything, lower the TTL on the existing record for `www.example.com` to 60 seconds and wait for the old TTL to expire. This gives you a quick way to roll back if you encounter an issue. 4. **Create the CNAME record at your DNS provider.** The exact steps vary by provider, but the record contains the following values: | Field | Value | | --------------- | ----------------------------------- | | Type | `CNAME` | | Name or host | `www` | | Value or target | `dualstack.p.sni.global.fastly.net` | | TTL | `60` | In BIND zone file format, the record looks like this: ```text www.example.com. 60 IN CNAME dualstack.p.sni.global.fastly.net. ``` 5. **Check the record.** Run the following command in a terminal window: ```term copy $ dig www.example.com +short ``` Your output should appear similar to the following: ```term nolinenums dualstack.p.sni.global.fastly.net. 151.101.117.57 ``` If you don't see a Fastly hostname, either the CNAME isn't properly set at your DNS provider or an older record is still cached by your local DNS resolver. Use a tool like [whatsmydns.net](https://www.whatsmydns.net) to check the responses from DNS resolvers worldwide. 6. **Restore the TTL.** Once you confirm everything is working properly, increase the TTL to its original value. ## Common mistakes Here are some common problems people encounter when setting up CNAME records for Fastly. ### Pointing DNS at Fastly before adding the domain to your service - **Symptom:** Visitors see an `unknown domain` error. - **Cause:** The domain isn't associated with a Fastly service, so Fastly doesn't know how to handle the request. - **Fix:** [Add the domain](https://www.fastly.com/documentation/guides/getting-started/domains/working-with-domains/working-with-domains) to your service and activate the new version before you change your DNS records. ### Using the wrong hostname for TLS - **Symptom:** HTTPS visitors receive a TLS certificate mismatch error. - **Cause:** The CNAME record value doesn't match the value assigned to your domain. - **Fix:** Copy the CNAME record value from **Domains** > **View/edit** > **DNS details** in the Fastly web interface. ### Using a non-TLS hostname for an HTTPS site - **Symptom:** HTTPS (port 443) requests fail or are refused. - **Cause:** Fastly's non-TLS hostnames refuse HTTPS connections to prevent TLS certificate mismatch errors. - **Fix:** Replace the non-TLS hostname with the TLS-enabled CNAME record value from the Fastly web interface. ### Using a CNAME record with a shared TLS domain - **Symptom:** The CNAME setup doesn't work regardless of which hostname you use. - **Cause:** You can't add a CNAME record for a [shared TLS domain](https://docs.fastly.com/products/legacy-shared-tls). - **Fix:** Use a different [TLS option](https://docs.fastly.com/products/tls-service-options) for your domain. ### Skipping the TTL change - **Symptom:** You encounter a problem after switching DNS records, and rolling back takes hours. - **Cause:** The previous record's long TTL means resolvers continue to use the cached value until it expires. - **Fix:** Before making the change, lower the TTL to a small number (we suggest 60 seconds) and wait for the old TTL to expire. ### Assuming the change failed because the DNS record changes haven't propagated - **Symptom:** You're not seeing the changes in your web browser, and `dig` doesn't show a Fastly hostname after you update the record. - **Cause:** Either the CNAME isn't properly set at your DNS provider, or an older record is still cached by your local DNS resolver. - **Fix:** Confirm the record at your DNS provider, then use a tool like [whatsmydns.net](https://www.whatsmydns.net) to check responses from resolvers worldwide. ## Removing CNAME records If you [deactivate a service](https://www.fastly.com/documentation/guides/getting-started/services/working-with-cdn-services#deactivating-a-service), [delete a service](https://www.fastly.com/documentation/guides/getting-started/services/working-with-cdn-services#deleting-a-service), or [cancel your account](https://www.fastly.com/documentation/guides/organizations-and-accounts/billing/canceling-your-account), we strongly recommend modifying or deleting any CNAME records pointing to Fastly. Follow the instructions on your DNS provider's website. Doing so will minimize the risk of unauthorized use of your domains. ## Related content - [Enabling dualstack connections](https://www.fastly.com/documentation/guides/full-site-delivery/domains-and-origins/enabling-dualstack-connections) - [Limiting traffic to a subset of POPs](https://www.fastly.com/documentation/guides/getting-started/concepts/using-fastlys-global-pop-network#limiting-traffic-to-a-subset-of-pops) - [Using Fastly with apex domains](https://www.fastly.com/documentation/guides/full-site-delivery/domains-and-origins/using-fastly-with-apex-domains) - [Working with domains](https://www.fastly.com/documentation/guides/getting-started/domains/working-with-domains/working-with-domains) - [Domain API documentation](https://www.fastly.com/documentation/reference/api/services/domain/)