title: “Route 53 — Alias vs CNAME (and the Apex Rule)” created: 2026-10-28 updated: 2026-10-28 type: knowledge tags:

aws
certification
networking
route53
dns

Route 53 — Alias vs CNAME (and the Apex Rule)

What It Is

Two ways to point a DNS name at another target, plus the rule that decides which one you must use at the apex (root) of a domain.

Apex / zone apex / naked domain: the domain with nothing in front (example.com), as opposed to www.example.com. It always carries mandatory NS and SOA records.
CNAME: standard DNS record aliasing one name to another name.
Alias: Route 53 proprietary record that behaves like an A record but points to an AWS resource.

Why It Matters

Pointing a custom domain at CloudFront / ALB / S3 is a recurring exam scenario. The trap: candidates put a CNAME at the apex, which is invalid.

The apex rule: a CNAME cannot coexist with any other record on the same name (RFC 1034). The apex already has NS + SOA, so a CNAME at the apex is illegal. This is a DNS rule, not an AWS limitation.

The Route 53 fix: the Alias record looks like an A record (legal at the apex) but resolves an AWS target server-side. It gives CNAME-like behaviour at the apex.

How It Works

	CNAME	Alias
Type	Standard DNS	Route 53 proprietary
At apex (`example.com`)	❌ Invalid	✅ Valid
At sub-domain (`www.`)	✅ Valid	✅ Valid
Target	Any DNS name	AWS resources + Route 53 records
Query cost	Billed	Free (AWS targets)

Decision shortcut:

Need to point the APEX at an AWS resource?      → Alias (CNAME not allowed)
Need to point a SUB-DOMAIN at an AWS resource?  → Alias (preferred) or CNAME
Need to point at an EXTERNAL (non-AWS) name?    → CNAME (sub-domain only)

Examples

example.com        A (Alias)    → CloudFront        # apex, CNAME impossible
example.com        AAAA (Alias) → CloudFront        # IPv6
www.example.com    CNAME        → d123.cloudfront.net

Gotchas

CNAME at the apex is a guaranteed wrong answer on the exam.
Alias only targets specific AWS resources (CloudFront, ALB/ELB, S3 website, API Gateway, another Route 53 record) — not arbitrary external hosts.
Alias to an AWS resource is free; CNAME resolution is a billable query.
For CloudFront, remember the paired requirement: the ACM certificate must be in us-east-1.

AWS Certification Notes