CUSTOM DOMAIN
Glossary
Apex domain vs CNAME
An apex domain is the root of a name with nothing in front of it, like acme.com, while a subdomain adds a label in front, like app.acme.com. The difference matters because the DNS record you use to point a name at a platform depends on whether the name is an apex or a subdomain, and the apex has a technical restriction that the subdomain does not.
What is an apex domain?
The apex is the bare registered name, sometimes called the root or the naked domain. For acme.com the apex is acme.com itself. Anything with a label in front of it, such as app.acme.com, www.acme.com, or api.acme.com, is a subdomain of that apex. When your end customer brings their own domain onto your product, they usually want either a subdomain like app.acme.com or the bare apex acme.com, and each of those is set up differently.
Why can a subdomain use a CNAME but the apex cannot?
A CNAME record says this whole name is an alias for another name. It is the normal way to point a subdomain at a platform, because a CNAME lets the platform manage the underlying addresses on your customer's behalf. The problem is that the DNS standard does not allow a CNAME at the apex of a zone. The apex already carries other required records, such as the ones that route email and the ones that define the zone itself, and a CNAME cannot coexist with those records. So app.acme.com points cleanly with a CNAME, but the same record is rejected at acme.com.
How do providers work around the apex?
Because the apex problem is so common, DNS hosts invented their own answers, and they do not agree. Some offer an ALIAS record. Some call the same idea an ANAME record. Some do CNAME flattening, where you enter what looks like a CNAME at the apex and the provider quietly resolves it to addresses behind the scenes. A few still expect you to enter raw A and AAAA address records by hand, which breaks the moment the platform changes those addresses. The name of the feature, whether it exists at all, and how it behaves all vary by your customer's DNS host, which is why apex setup is the part that most often goes wrong.
Apex vs www
Many teams sidestep the apex by using www.acme.com as the real home and pointing the bare acme.com at it with a redirect. That works, but it is a workaround, and it means the apex still needs a record of some kind to perform the redirect. Your customers expect the bare name to work, so covering the apex directly is the cleaner outcome.
How Custom Domain covers apex, www, and wildcards
Custom Domain detects your customer's DNS host, then writes the correct kind of record for that host automatically. At the apex it uses the flattening or ALIAS style record the provider supports, at www it uses a standard alias, and for wildcards it covers every subdomain under the name in one step. It verifies ownership and issues HTTPS at the edge, so your customer never has to know whether their host calls the feature ALIAS, ANAME, or flattening. The apex, www, and wildcard cases are handled the same way from your side.
Frequently asked questions
Can I use a CNAME at the root domain? No. The DNS standard does not allow a CNAME at the apex because it would conflict with the other required records the apex carries. Providers offer ALIAS, ANAME, or CNAME flattening as substitutes, and Custom Domain picks the right one for your customer's host automatically.
What is the difference between an A record and a CNAME at the apex? An A record points the apex directly at a fixed address, which breaks if the platform ever changes that address. A CNAME style alias follows the platform, but a plain CNAME is not permitted at the apex, so providers use ALIAS, ANAME, or flattening to get the same following behavior.
Do ALIAS, ANAME, and CNAME flattening do the same thing? Broadly yes. They all let the apex behave like an alias that follows the platform. They are named differently by different DNS hosts and can behave slightly differently, which is why apex setup is error prone when done by hand.
Does Custom Domain handle wildcard subdomains? Yes. Custom Domain can cover the apex, www, and a wildcard for every subdomain under the name, verifying ownership and issuing HTTPS at the edge for each.
Do my end customers need to know which record type to use? No. Custom Domain detects their DNS host and writes the correct record for the apex or subdomain automatically, so they never touch a DNS panel or choose between ALIAS, ANAME, and flattening.