What is the difference between an A record and a CNAME record, and why can't you put a CNAME on the apex example.com?

An A record maps a name to an IP address. A CNAME maps a name to another name. You can't put a CNAME on the apex, because a CNAME can't share a name with other records, and the apex must have other records.

A record: maps a name directly to an IPv4 address. An AAAA record does the same for IPv6.

CNAME: says this name is an alias (another name) for a different name. For example: www.example.com CNAME myapp.herokuapp.com. The resolver then looks up the target name. CNAMEs are useful when a provider's IPs can change. You point at the provider's hostname instead of its IPs.

The rule: a name that has a CNAME can't have any other records. The only exception is DNSSEC records. The zone apex is the bare domain, like example.com. It must have SOA and NS records, and it usually has MX and TXT records too. So a CNAME there would conflict with them.

Workarounds to point the apex at a hostname:

• ALIAS or ANAME records. These are non-standard and offered by some DNS providers.
• CNAME flattening at Cloudflare.
• Redirect the apex to www.
• Use fixed IPs.

With ALIAS, ANAME or CNAME flattening, the provider looks up the target itself. Then it serves the result as ordinary A and AAAA records.