How to add a CNAME record at your DNS host
What goes in the Type, Name and Value fields, why the same record looks different in every panel, and the two mistakes that quietly do nothing.
You can add a CNAME record in any DNS panel, and tell whether the one you just added is doing anything at all.
A CNAME record says that one name is an alias for another name. Adding one means filling in three fields in whatever panel holds the DNS records for your domain.
This guide describes the record. It does not describe your panel, and the next section says why that is deliberate.
Why this guide names no buttons
We do not have accounts at Tenten, Mắt Bão, P.A Việt Nam, or the other companies whose panels our customers use. We have not seen those screens, so we are not going to tell you what is on them.
Panels also get redesigned. A click path that no longer matches is worse than no click path at all: it sends you hunting for a button that is not there, and it makes you doubt the parts that were still correct.
What does not change is the record itself. A CNAME has a name and a target, and every panel asks you for both in some form. Learn the record and you can fill in a form you have never opened before.
When you set up a website with us, we read the nameservers on your domain, the records that say which company answers DNS questions about it, and we name that company on the setup page when we recognise it. Tenten, Mắt Bão and P.A Việt Nam are among the ones we recognise. That tells you whose panel to open. It still does not tell us what is inside it.
Step 1: the three fields, and their other names
Every add-record form asks the same three things. Only the labels move.
- Type is the kind of record. Here it is
CNAME. - Name is the name you are pointing, for example
shop.example.vn. Your panel may label this field Host, Hostname, or Subdomain. - Value is what that name points at. Your panel may label this field Points to, Target, or Destination.
For a website you are setting up with us, the value of the first record is our gateway, gw.onelineshield.com. It is the same for everyone, and your setup page shows it next to a copy button for each field.
_acme-challenge. in front of the same name, and it is what lets your certificate keep renewing itself. Its value starts with your own hostname, so copy it from your setup page rather than typing it, and never shorten it.Step 2: the Name field is where this goes wrong
Panels disagree about this field, and they disagree silently. Some want the full name, shop.example.vn. Others want only the part in front of your domain, shop, and add the rest for you.
Type the full name into a panel that adds the rest and you get shop.example.vn.example.vn, a name no visitor will ever ask for. Nothing errors. Your website keeps loading the old way, and the record you added sits there doing nothing.
The way to tell is to save the record and read back the list the panel shows afterwards. That list shows the name it actually stored. If your domain appears in it twice, you have your answer, and you can correct the record in place.
The same rule decides the second record: _acme-challenge.shop in a panel that adds your domain for you, _acme-challenge.shop.example.vn in one that does not.
Step 3: replace the old record, do not add beside it
A name can hold one CNAME and nothing else. If that name already has an A record pointing at your server, the CNAME is not a second option to put next to it.
Panels handle the clash differently. Some refuse the new record and say so. Some accept it and leave you with one name holding two different answers, which is the worse outcome because it looks like it worked. Either way, what you want is to edit the record that is already there, or delete it and add the CNAME in its place.
Step 4: save it, then give it time
DNS is not instant, and the delay is not a sign that something went wrong. The old value stays cached for as long as its TTL allows. A TTL of 300 means five minutes and a TTL of 3600 means an hour, and the record you just saved shows you which one you have.
So the wait is set by that number rather than by us, and we are not going to put an average on it. If you added the record for us, the setup page keeps checking every few seconds and turns itself on the moment Cloudflare confirms. There is nothing to refresh, and seeing no change in the first few minutes is normal rather than an error.
When the panel will not accept a CNAME at all
One case is real and not your fault: the bare domain, with nothing in front of it. Panels usually write that name as @. The root of a domain already carries records that a CNAME is not allowed to sit beside, so a correct panel refuses one there.
Some providers offer ALIAS, ANAME, or CNAME flattening for exactly that case. If yours does not say, that is the question to ask them: what they offer for the root of a domain.
The other case is quieter. The panel you can log into is not always the panel that answers for your domain. A domain registered at one company can have its DNS hosted at another, and the nameservers on the domain decide which one is live. Editing records in the wrong panel changes nothing anywhere, and nothing warns you.
What this record does and does not change
A CNAME on one name moves that one name. Your nameservers stay where they are, your server stays where it is, and every other record on the domain, mail included, is untouched.
Why the usual advice asks for the nameservers instead, and when following that advice is still the better answer, is the subject of why you do not need to change your nameservers.
For a website pointed at us, that one name now reaches Cloudflare first and your own server through it. Your visitors never reach our servers. The whole path is drawn out on the how it works page.
Six checks run on every website in your account, once every ten minutes, and report on your dashboard. Two of them stay quiet until Cloudflare has confirmed the name, and say that they are quiet instead of guessing. What we check lists all six, including the one that watches this record and tells you if it ever disappears.