What Is an Apex Domain?
An apex domain is the highest level of your domain name — the version without any subdomain prefix. It is the "root" of your domain in the DNS hierarchy.
For example, if your website is www.example.com, then the apex domain is simply example.com. There is no www, no blog, no shop — just the domain name and its top-level domain (TLD).
Here are a few more examples to make it clear:
| Full URL | Apex Domain | Subdomain |
|---|---|---|
www.example.com | example.com | www |
blog.mysite.org | mysite.org | blog |
shop.store.co.uk | store.co.uk | shop |
example.com | example.com | none |
Other Names for Apex Domain
The apex domain goes by several names. You will encounter all of these terms in documentation, forums, and DNS provider dashboards — they all mean exactly the same thing:
- Root domain — emphasizes that it sits at the root of the DNS zone
- Bare domain — "bare" because there is no subdomain attached
- Naked domain — same idea as bare, with nothing in front of it
- Zone apex — the technical DNS term, referring to the top of the DNS zone file
Whether someone says "naked domain," "bare domain," or "zone apex," they are all talking about example.com without any prefix.
How the DNS Hierarchy Works
To understand why apex domains matter, it helps to know how the Domain Name System (DNS) is structured. DNS is organized as a tree, read from right to left:
Level 1 — TLD: .com, .org, .net, .io
Level 2 — Apex domain: example.com
Level 3 — Subdomain: www.example.com, blog.example.com
When you register a domain like example.com, you are registering the apex domain. The TLD (.com) is managed by a registry (Verisign, in this case). Everything below your apex domain — like www, mail, or api — are subdomains that you control through your DNS records.
This hierarchy is important because of a critical technical limitation that affects the apex domain specifically.
Why Apex Domains Have DNS Limitations
Here is the core problem: according to RFC 1034 (the specification that defines how DNS works), you cannot place a CNAME record at the apex of a DNS zone.
A CNAME record is an alias that points one domain name to another. For example, you might point www.example.com to myapp.herokuapp.com using a CNAME. This works perfectly for subdomains.
But at the apex (example.com), the DNS specification requires that other essential records — like SOA (Start of Authority) and NS (Name Server) records — also exist. A CNAME record cannot coexist with any other record type at the same name. If you placed a CNAME at the apex, it would conflict with these mandatory records and break DNS resolution entirely.
This means that if your hosting provider gives you a hostname (like myapp.netlify.app or your-site.vercel.app) instead of an IP address, you cannot point your apex domain to it using a standard CNAME record.
The ALIAS and ANAME Workaround
Some DNS providers offer proprietary record types that work around the CNAME-at-apex restriction:
- ALIAS records (used by DNSimple, AWS Route 53, and others)
- ANAME records (used by some other providers)
- CNAME flattening (Cloudflare's approach)
These work by resolving the target hostname to an IP address at query time and returning an A record to the client. The client never sees a CNAME — it just gets an IP address, which satisfies the DNS specification.
However, these solutions have drawbacks. Not all DNS providers support them. They are non-standard, so behavior can vary. And some hosting platforms may not work correctly with ALIAS records because the resolved IP address can change without notice, potentially causing downtime if caching is involved.
When Does the Apex Domain Problem Actually Matter?
The apex domain limitation becomes a real issue when you are hosting your website on a platform that requires a CNAME record instead of providing a static IP address. This includes many popular services:
- GitHub Pages — provides a
.github.iohostname - Netlify — assigns a
.netlify.apphostname - Vercel — uses
.vercel.apphostnames - Heroku — provides
.herokuapp.comhostnames - AWS Elastic Load Balancer — gives you a long
.elb.amazonaws.comhostname
If you want visitors who type example.com into their browser to reach your site on one of these platforms, you have a problem. You cannot create a CNAME at the apex, and you may not have access to ALIAS records.
How to Solve the Problem: Redirect Apex to WWW
The simplest and most reliable solution is to redirect your apex domain to the www subdomain. This approach works with every DNS provider and every hosting platform, because:
- You point your apex domain (
example.com) to a redirect server using standard A records (IP addresses) - The redirect server sends a 301 permanent redirect to
www.example.com - You point
www.example.comto your hosting platform using a CNAME record (which is perfectly allowed on subdomains)
This is exactly what ApexToWWW does. It is a free service that provides the redirect server for you. All you need to do is add two DNS records and your apex domain will automatically redirect to the www version of your site.
Set it up in under a minute
Add two A records to your DNS, and ApexToWWW handles the rest — automatic SSL, IPv6 support, and HTTP/3 included. No account required.
Get Started FreeThe redirect approach is preferred by many large organizations because it is standards-compliant, works everywhere, and avoids the complexity of non-standard DNS record types. Visitors who type example.com are seamlessly forwarded to www.example.com, and search engines consolidate both versions under a single canonical URL.
Summary
An apex domain (also called a root domain, bare domain, naked domain, or zone apex) is your domain name without any subdomain prefix — for example, example.com. Due to the DNS specification (RFC 1034), you cannot place a CNAME record at the apex, which creates problems when hosting on platforms that require CNAME-based configuration.
The most reliable fix is to redirect your apex domain to www using a service like ApexToWWW. It takes less than a minute to set up, requires no account, and works with any DNS provider and any hosting platform.