Quiz! Which of the following is an apex domain?
Did you pick
But, it is not necessarily just
example.com. The domain
www.example.com could be an apex domain too. It all depends on which DNS zone contains the DNS records.
We define DNS records in a DNS zone. A zone is simply a conceptual term to denote a folder for the records that it holds.
A zone has a start of authority (SOA) record. In the zone, we create DNS records for the apex domain. Here, we shall name our zone as “Zone 1”:
; Zone 1 ; 'SOA' record for this zone example.com SOA ... ; 'A' record for apex domain example.com A ... ; 'A' record for www subdomain www.example.com A ...
In this zone,
example.com is an apex domain because it has an SOA with the same name.
www.example.com is not an apex domain, well, because it doesn’t have an SOA to itself.
Now, what if
www.example.com has its zone? In “Zone 1”, we shall delegate domain name lookup for
www.example.com to another DNS zone. We will call this zone “Zone 2”:
; Zone 1 (updated) example.com SOA ... example.com A ... ; Delegate resolution for www subdomain to Zone 2 www.example.com NS ...
; Zone 2 www.example.com SOA ... www.example.com A ...
In Zone 1,
example.com is still an apex domain because of its SOA record.
But thanks to Zone 2,
www.example.com is also an apex domain now, in this particular zone. Notice it now has an SOA. Although back in Zone 1, we will still not consider
www.example.com as an apex domain, owing to the differing SOA.
So there you have it. A DNS zone determines whether a domain or a subdomain is an apex domain.
But why does apex or non-apex domain matter? Because of the CNAME record. An apex domain cannot have a CNAME record for it.
I had a similar setup in subdomain delegation on Amazon Route53. In Zone 2, I tried to CNAME
www.example.com, which I wasn’t aware was an apex domain, to an Application Load Balancer’s DNS name. Naturally, Route53 refused to create the CNAME record, but fortunately, I could configure a Route53 alias record for it.
From another perspective, recall that in the zone
example.com is not an apex domain but a subdomain of
.com. However, when
example.com is in your dedicated zone, it becomes an apex domain.