Why can't I create a CNAME at the apex (root) of my domain?

RFC 1034 forbids a CNAME at the apex coexisting with the SOA and NS records that must live there. Many DNS providers offer a synthetic 'ALIAS' or 'flattened CNAME' record at the apex, but Linode Domains uses standards-compliant DNS. Workaround: use an A record pointing at the resource's IP (and update if the IP changes), or point at a reserved IP that fronts your service.

How long does a DNS change take?

Your DNS change appears on Linode's authoritative nameservers within minutes. Client-side propagation depends on the TTL of the previous record — clients caching a value with TTL=3600 will continue using it until that TTL expires. For planned changes, lower the TTL to 60-300 seconds 24-48 hours in advance so the cutover propagates quickly when you make it.

Linode Domain DNS Builder

ServerlessLinode

Build DNS zone configurations with A, AAAA, CNAME, MX, TXT, SRV, and CAA records.

Last verified: May 2026

Linode DNS Manager Configuration

Build DNS zone configurations with A, AAAA, CNAME, MX, TXT, SRV, and CAA records, SOA settings, and TTL management.

Required Fields

domaintypesoaEmail

{
  "domain": "example.com",
  "type": "master",
  "soaEmail": "admin@example.com",
  "ttlSec": 300,
  "refreshSec": 3600,
  "retrySec": 900,
  "expireSec": 1209600,
  "records": [
    {
      "type": "A",
      "name": "",
      "target": "192.0.2.1",
      "ttlSec": 300
    },
    {
      "type": "A",
      "name": "www",
      "target": "192.0.2.1",
      "ttlSec": 300
    },
    {
      "type": "AAAA",
      "name": "",
      "target": "2001:db8::1",
      "ttlSec": 300
    },
    {
      "type": "MX",
      "name": "",
      "target": "mail.example.com",
      "priority": 10,
      "ttlSec": 3600
    },
    {
      "type": "CNAME",
      "name": "blog",
      "target": "example.netlify.app",
      "ttlSec": 3600
    },
    {
      "type": "TXT",
      "name": "",
      "target": "v=spf1 include:_spf.google.com ~all",
      "ttlSec": 3600
    },
    {
      "type": "SRV",
      "name": "_sip._tcp",
      "target": "sip.example.com",
      "priority": 10,
      "weight": 60,
      "port": 5060,
      "ttlSec": 3600
    },
    {
      "type": "CAA",
      "name": "",
      "target": "letsencrypt.org",
      "tag": "issue",
      "ttlSec": 3600
    }
  ],
  "tags": ["production"]
}

Generated Output

Output will appear here...

About This Tool

Linode Domains provides DNS hosting tied to your Linode account. The Linode Domain DNS Builder generates DNS zone configurations including A, AAAA, CNAME, MX, TXT, SRV, and CAA records, validates record-type-specific constraints, and outputs API-ready definitions plus a zone file format suitable for cross-provider DNS migration.

Real-World Scenario

Your team is consolidating DNS hosting onto Linode for the four domains you operate. You export the zone files from the old provider, paste each into the builder to validate, and apply through Linode. After cutover (lowered TTLs the day before, switched authoritative nameservers, watched for resolution), everything is on Linode and the previous DNS bill is canceled. Saved: not much money, but one less account to maintain.

When to Use This Tool

•Setting up DNS records for a new domain pointed at Linode infrastructure — A records to Linodes or NodeBalancers, CNAMEs to managed services, MX records for email.
•Generating SPF, DKIM, and DMARC TXT records as part of email deliverability hardening alongside the MX configuration.
•Migrating DNS from another provider by generating equivalent Linode records from a zone file dump.
•Adding a CAA record to restrict which certificate authorities may issue certificates for the domain.

Pro Tips

TIP

Always set a CAA record. Without one, any public CA can issue a certificate for your domain to anyone who can prove DNS control. With CAA listing your chosen CA, other CAs refuse to issue. Two lines of config to close a real attack vector.

TIP

Use distinct TXT records for SPF, DKIM, and DMARC rather than concatenating them. The 255-char TXT string limit and the readability of having one record per concern both favor separate records.

How It Works Under the Hood

The builder collects the domain name and a list of records with type, name, value, TTL, and type-specific fields (priority for MX/SRV, flags for CAA). Each record is validated against its RFC-defined constraints. Output is JSON for the Linode Domains API plus a BIND-compatible zone file format suitable for testing or migration.

Frequently Asked Questions

Why can't I create a CNAME at the apex (root) of my domain?: RFC 1034 forbids a CNAME at the apex coexisting with the SOA and NS records that must live there. Many DNS providers offer a synthetic 'ALIAS' or 'flattened CNAME' record at the apex, but Linode Domains uses standards-compliant DNS. Workaround: use an A record pointing at the resource's IP (and update if the IP changes), or point at a reserved IP that fronts your service.
How long does a DNS change take?: Your DNS change appears on Linode's authoritative nameservers within minutes. Client-side propagation depends on the TTL of the previous record — clients caching a value with TTL=3600 will continue using it until that TTL expires. For planned changes, lower the TTL to 60-300 seconds 24-48 hours in advance so the cutover propagates quickly when you make it.

Was this tool helpful?

Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.