Why can't I create a CNAME at the apex (root) of my domain?

RFC 1034 forbids a CNAME at the apex coexisting with the SOA and NS records that must live there. Many DNS providers offer a synthetic 'ALIAS' or 'flattened CNAME' record at the apex, but DigitalOcean Domains does not. Workarounds: use an A record pointing at the load balancer's IP (and accept the IP may change), or point the apex at a reserved IP that fronts your service.

How long does a DNS change take to propagate?

Your DNS change takes effect at DigitalOcean's authoritative nameservers within seconds. Propagation to clients depends on the TTL of the previous record — clients holding a cached value for 3600 seconds will keep using it until that TTL expires. For planned changes, lower the TTL to 60-300 seconds a day in advance so the cutover propagates quickly.

DO Domain & DNS Builder

ServerlessDigitalOcean

Build DigitalOcean domain and DNS record configurations with A, CNAME, MX, TXT, and more.

Last verified: May 2026

DigitalOcean DNS Configuration

Domain

Record 1

Type

Name

Data

TTL

Output Format

Domain is required
Record 1: Data is required

Generated DNS Records JSON

Output will appear here...

About This Tool

DigitalOcean Domains provides DNS hosting tied to your DO account, with a UI and API that match the rest of the platform. The DO Domain & DNS Builder generates DNS zone configurations including A, AAAA, CNAME, MX, TXT, SRV, and CAA records, validates record-type-specific constraints (apex CNAMEs aren't allowed; MX records need a priority), and outputs Terraform `digitalocean_domain` and `digitalocean_record` resources ready to apply.

Real-World Scenario

Email deliverability for your transactional notifications has been getting worse — 30% of welcome emails are landing in Gmail spam. You generate a proper email DNS suite through the builder: SPF authorizing your sending provider, DKIM with the provider's signing key, and a DMARC record set to `p=quarantine` with reporting. Within 48 hours, deliverability climbs back above 95% and you get the first DMARC aggregate reports showing exactly which IPs are sending mail in your name.

When to Use This Tool

•Setting up DNS records for a new domain pointed at DigitalOcean infrastructure — A records to Droplets, CNAMEs to App Platform endpoints, MX records for email.
•Generating SPF, DKIM, and DMARC TXT records as part of email deliverability hardening alongside the MX configuration.
•Migrating DNS from a previous provider by generating equivalent record sets in Terraform-managed form.
•Adding a CAA record to restrict which CAs may issue certificates for the domain — a small but effective hardening step.

Pro Tips

TIP

Always set a CAA record. Without it, any public CA can issue a certificate for your domain to anyone who can prove DNS control. With a CAA record listing your chosen CA (Let's Encrypt, DigiCert, etc.), other CAs refuse to issue. Two lines of configuration to close a real attack vector.

TIP

Use distinct TXT records for SPF, DKIM, and DMARC rather than concatenating them into one. The maximum TXT string length is 255 characters, and multiple TXT records for the same name are allowed and standard practice.

How It Works Under the Hood

The builder collects the domain name and a list of records with their type, name (subdomain), value, TTL, and type-specific fields (priority for MX/SRV, flags for CAA). Each record is validated against its RFC-defined constraints — for example, apex CNAMEs are rejected, MX records require a numeric priority. The output is a `digitalocean_domain` resource plus one `digitalocean_record` per record, with explicit dependencies on the domain.

Frequently Asked Questions

Why can't I create a CNAME at the apex (root) of my domain?: RFC 1034 forbids a CNAME at the apex coexisting with the SOA and NS records that must live there. Many DNS providers offer a synthetic 'ALIAS' or 'flattened CNAME' record at the apex, but DigitalOcean Domains does not. Workarounds: use an A record pointing at the load balancer's IP (and accept the IP may change), or point the apex at a reserved IP that fronts your service.
How long does a DNS change take to propagate?: Your DNS change takes effect at DigitalOcean's authoritative nameservers within seconds. Propagation to clients depends on the TTL of the previous record — clients holding a cached value for 3600 seconds will keep using it until that TTL expires. For planned changes, lower the TTL to 60-300 seconds a day in advance so the cutover propagates quickly.

Was this tool helpful?

Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.