Dangling CNAMEs
What it can report
- ✗ critical a CNAME target's registered domain is free to register: its ICANN suffix is delegated, the domain has no NS (NXDOMAIN) and the registry's RDAP answers 404 (an RDAP failure, no RDAP service, or a held or redeeming domain is plain nxdomain instead) How to fix it
- ✗ high a CNAME to a deprovisioned hosted service (GitHub Pages, Heroku apps, Azure, ...; not S3, CloudFront or Fastly, whose names cannot be claimed after an NXDOMAIN) How to fix it
- ! medium a CNAME to a private-use name (.local, .internal, .corp, .lan, .home.arpa, a TLD that is not delegated): an internal host name published in public DNS; nobody can register it How to fix it
- ! medium a CNAME whose target does not exist How to fix it
- ✗ critical a wildcard CNAME whose target does not exist (severity as for a single name) How to fix it
How it counts
The score is computed by fixed rules from the checks that ran, and this check has a weight of 3 within DNS. A check that errors or is skipped is shown as "could not check" and left out of the score, never counted as a pass. Fixes and the AI summary are written after scoring and never change it.
Related checks
Scan your own domain and see this check run.