CNAME for a Root Domain in Cloudflare: CNAME Flattening

Updated: 22 October 2026 · Applies to: Cloudflare DNS on all plans (steps and behaviour according to Cloudflare); dig 9.20 on Debian 13 for the checks

Yes, you can use a CNAME for your root domain in Cloudflare. Open your domain's DNS Records page, remove any A and AAAA records on the root, then add a record with Type CNAME, Name @ and the host name you were given as the Target. Cloudflare turns it into normal IP answers with CNAME flattening, which according to Cloudflare "occurs by default for all plans when your domain uses a CNAME record for its zone apex".

Why a root domain normally cannot have a CNAME

The root of a domain (example.com, also called the zone apex) always holds the domain's NS and SOA records. The DNS rules say "A CNAME record is not allowed to coexist with any other data" (RFC 1912), so a plain CNAME on the root breaks the standard, and many DNS hosts refuse it. Subdomains such as www or shop can use a CNAME without any trick.

Cloudflare works around this on its own name servers. According to Cloudflare, "With CNAME flattening, Cloudflare returns an IP address instead of the target hostname that a CNAME record points to." Visitors and resolvers only ever see A and AAAA answers for example.com, so the zone stays valid. If your previous DNS host used an ALIAS or ANAME record for the root, Cloudflare says you can recreate it as a CNAME.

Add a CNAME on the root domain in Cloudflare

1. Log in to the Cloudflare dashboard and select your domain.
2. Go to the DNS Records page.
3. Look for existing records with the Name of your root domain. According to Cloudflare, a CNAME cannot share its name with an A, AAAA or another CNAME record, so delete the root A and AAAA records first. MX and TXT records on the root are not affected and stay as they are. Do steps 3 and 4 in one sitting, so the root is without an address for as short a time as possible.
4. Select Add record and fill in:
   • Type: CNAME
   • Name: @ (Cloudflare uses @ for the zone apex)
   • Target: the host name of your server or service, for example server1.example.net
   • Proxy status: Proxied (orange cloud) or DNS only (grey cloud), see below
   • TTL: Auto
5. Select Save.
6. Point www at the root as well: Type CNAME, Name www, Target example.com. This is a normal CNAME and needs no flattening.

Proxied or DNS only

• Proxied: according to Cloudflare, proxied records are always flattened, answer with Cloudflare's own anycast IPs and use a TTL of 300 seconds. Your server needs a valid certificate for the domain; set Cloudflare's SSL/TLS mode to Full (strict).
• DNS only: Cloudflare looks up the target and answers with the target's real IP addresses. According to Cloudflare, the TTL is the lower of the target record's TTL and your CNAME's TTL.

Check that it works

From any Linux or macOS machine, ask for the root domain's addresses:

dig +short example.com A

You should get one or more IP addresses, not a host name. Ask for a CNAME on the root:

dig +short example.com CNAME

This prints nothing, because the CNAME is flattened. For www you see the CNAME followed by the addresses:

dig +short www.example.com

New records can take a few minutes to show at your own resolver. To ask Cloudflare directly, add @ and one of the two Cloudflare name servers assigned to your domain (shown in the dashboard). Replace NAME with the name server's first part:

dig +short example.com A @NAME.ns.cloudflare.com

Email on the same domain

• Keep your MX record on the root. It must point to a host name with an A record, for example mail.example.com, set to DNS only. According to Cloudflare, it "does not proxy email traffic on port 25 (SMTP)".
• Keep SPF, DKIM and DMARC TXT records as your mail provider gives them. If cPanel sends your mail, see How to Add cPanel SPF and DKIM Records When Your DNS Is at Cloudflare or Your Registrar.

Common problems

• Error 1014 "CNAME Cross-User Banned": according to Cloudflare, this appears when a CNAME points to a domain in a different Cloudflare account. Cloudflare allows this only when the owner of the target uses Cloudflare for SaaS; otherwise point the root at an IP address with an A record.
• Empty answer for the root: if the target has no A or AAAA record, Cloudflare returns no addresses (NODATA). Check that the target itself answers with an address (see the command after this list).
• A third-party service cannot verify your domain: verification by CNAME needs the CNAME itself in the answer. Use it on a subdomain, and on paid plans leave "CNAME flattening for all CNAME records" (DNS Settings page) turned off, since according to Cloudflare it can break such checks.

To check that the CNAME target has an IPv4 address (use your own target name):

dig +short server1.example.net A

Do you need a CNAME at all?

A CNAME on the root only helps when the service gives you a host name and its IP addresses may change, for example a hosted website platform or a load balancer. A VPS or dedicated server has a fixed IP address, so a plain A record (and an AAAA record for IPv6) on @ is simpler and saves a lookup. To move your domain's DNS to Cloudflare first, see How to Enable Cloudflare on your Website. If your DNS stays in cPanel, a CNAME for a subdomain is added as shown in How to Add a CNAME Record Using cPanel DNS Zone Editor.

Official documentation: Cloudflare CNAME flattening and Create a zone apex record.