Overview

CNAME records, or Canonical Name records, are a fundamental part of DNS that allow one domain name to serve as an alias for another. They’re commonly used to simplify domain management, support third-party services, and route traffic through content delivery networks (CDNs). Whether you’re pointing www.example.com to a root domain or connecting a custom subdomain to a SaaS platform, CNAMEs offer a flexible and efficient way to manage DNS configurations.  

In ACME implementations, the dns-01 validation method requires placing a specific TXT record under a challenge-specific subdomain. By creating a CNAME record that delegates the ACME challenge to a separate domain you control, you can still complete validation – even if the original domain's DNS is partially or fully managed by a third-party provider. This method gives you flexibility and control over certificate issuance without requiring access to restricted DNS settings. 

Important Notes about CNAMEs 

CNAME records behave a bit differently from other DNS records and come with a few important rules. When a DNS resolver encounters a CNAME while trying to look up another type of record – such as an A or MX record – it follows the alias and restarts the query using the new target name. However, if the resolver is specifically querying for a CNAME record, it simply returns the CNAME itself without restarting the lookup.  

The destination of a CNAME can point to any valid domain, whether it’s within the same DNS zone or on a completely different server. That said, there are a couple key limitations to keep in mind 

• A domain with a CNAME record cannot have any other record types (such as A, MX, or TXT). 

• CNAMEs cannot be used at the root of a domain (also known as the zone apex), since that level requires records like NS, which must exist independently. 

Create CNAME Record 

Start by manually creating a CNAME record for the domain you want to secure with a certificate. This record delegates the dns-01 challenge to another domain where the actual TXT record will be hosted. The name of the CNAME record must begin with the “_acme-challenge" prefix.  

The target domain in the CNAME record (where the TXT record will be hosted) may begin with an underscore, but it’s not required. 

For example, if you’re issuing a certificate for example.com but want to host the TXT record at example.net, you would create one of the following CNAME records: 

_acme-challenge.example.com      CNAME      _acme-challenge.example.net 
_acme-challenge.example.com      CNAME      example.net 

This tells the ACME client and resolvers that the TXT validation token for example.com can be found at example.net. 

Request the Certificate Using ACME 

Use your ACME client to request a certificate for the original domain (example.com). During the dns-01 validation process, the ACME client will detect the CNAME at _acme-challenge.example.com and follow it to the target domain (e.g. _acme-challenge.example.net). It will then place the required TXT record at that target domain, allowing the challenge to be satisfied without needing to create or update TXT records directly in the DNS zone of the original domain. 

Complete the Validation 

Once the TXT record is in place at the target domain (example.net), the ACME client will notify the GlobalSign ACME server to complete the domain validation. The GlobalSign ACME server will query the original _acme-challenge.example.com record, follow the CNAME to the target, check for the correct TXT value, and issue the certificate for example.com. 

Technical Reminders 

• The prefix must be “_acme-challenge" You cannot use any other prefix for CNAMES with the GlobalSign ACME service. 

• The TXT record that is generated during the domain challenge process is case sensitive. In most cases this shouldn’t cause any issues, but if you have a process that moves the TXT record outside of the automated ACME workflow, be sure to preserve the case of the TXT record, otherwise you will receive an error during the certificate request process.