What each DNS record does, why you cannot put a CNAME on your bare domain, why DNS changes seem to take hours, and how to stop the domain itself becoming your single point of failure. With Route 53 prices and the January 2025 switch from WHOIS to RDAP.
Three different companies can be involved in your domain, and mixing them up causes most DNS trouble. The registrar is where you bought the name and renew it. The DNS host answers queries for it, chosen by the NS records set at the registrar. The hosting provider runs your app. They can be one company or three.
A name with a CNAME cannot have any other records (RFC 1034, clarified in RFC 2181). The bare domain, or apex, must have NS and SOA records, so a CNAME there is invalid. Platforms that tell you to CNAME to their hostname are describing www, not example.com.
Use your DNS host's alias feature: Route 53 alias records, Cloudflare CNAME flattening, or ALIAS/ANAME elsewhere.
Or point the apex at the platform's published IP addresses, and accept updating them if they change.
Or redirect example.com to www.example.com and CNAME www. The most portable option, at the cost of one redirect on the first visit.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Nothing is pushed around the internet when you change a record. Resolvers that looked it up recently keep the old answer until its TTL (time to live) expires. A record with a TTL of 86,400 seconds can be served stale for a day after you change it.
At least one old TTL before a planned change, lower the TTL on the records involved to 300 seconds.
Wait for the old TTL to pass, so every cache holds the short one.
Make the change, check it, and keep the old target running until traffic has moved.
Raise the TTL again afterwards. Longer TTLs mean fewer queries and more tolerance of a bad day at your DNS host.
Turn on auto-renew and keep a valid card on the registrar account. An expired domain takes down the app, email and every sign-in link at once.
Turn on registrar (transfer) lock so the domain cannot move without you.
Protect the registrar login with strong MFA. Whoever controls DNS controls your email, and therefore every password reset.
Keep the account in the company's name with a shared admin mailbox, not a founder's personal email.
Since January 28, 2025, ICANN has made RDAP the definitive source of registration data for generic top-level domains, replacing the WHOIS protocol. Lookup tools look much the same; expect contact details to be redacted for privacy either way.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Your App Has Users Now: The Internet Underneath It, on One Page
Building fast skips the parts of the internet that only matter once people depend on you: DNS, certificates, email authentication, caching, timeouts, backups and abuse. What happens between someone typing your domain and your database answering, what breaks at each step, and the order we would fix things in.
Read
Why Your App's Emails Go to Spam: SPF, DKIM, DMARC and the Rules Now Enforced
Gmail moved to rejecting non-compliant mail in November 2025, Outlook.com has sent non-compliant bulk mail to junk since May 2025, and DMARC became an IETF Proposed Standard in 2026 (RFC 9989). What the three records do, what each mailbox provider requires, and how to keep marketing from sinking your password resets.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.