How to check a CNAME chain with dig

One hostname can cross several aliases before DNS reaches the address a client uses. During a CDN or hosted-service cutover, the first CNAME may point to the expected provider while a later hop lands on an unexpected platform or never reaches the required address record.

Query the client-facing hostname for the same record type the client needs. An A or AAAA question lets a recursive resolver follow visible CNAME hops toward the terminal address, while a CNAME question normally returns only the first alias because that record type already answers the original question.

A named public resolver keeps every lookup in one DNS view while the chain is inspected. Alias targets, addresses, and cache TTL values can differ by resolver, location, or query time, so follow the names returned by the first lookup instead of expecting the sample values to remain fixed.

Steps to check a CNAME chain with dig:

Query the client-facing hostname for its IPv4 address through Cloudflare DNS.
```
$ dig @1.1.1.1 www.microsoft.com A +noall +answer
www.microsoft.com. 3584 IN CNAME www.microsoft.com-c-3.edgekey.net.
www.microsoft.com-c-3.edgekey.net. 884 IN CNAME e13678.dscb.akamaiedge.net.
e13678.dscb.akamaiedge.net. 4 IN A 23.193.226.97
```
Each CNAME row maps its owner name to the next target. The final A row is the terminal IPv4 answer. Resolver-cache TTL values count down, and a CDN may return different targets or addresses from another location.
Query the original hostname for CNAME to isolate its first alias.
```
$ dig @1.1.1.1 www.microsoft.com CNAME +noall +answer
www.microsoft.com. 2315 IN CNAME www.microsoft.com-c-3.edgekey.net.
```
A CNAME question is already answered by the first alias record, so it does not display the later hop or terminal address returned by the A question.
Query the last CNAME target from the first answer for the same A record.
```
$ dig @1.1.1.1 e13678.dscb.akamaiedge.net A +noall +answer
e13678.dscb.akamaiedge.net. 7 IN A 23.193.226.97
```
The target in this command is the final CNAME name from the first lookup. A matching terminal address confirms that the chain settles on the address returned for the client-facing hostname.

Author: Mohd Shakir Zakaria
Mohd Shakir Zakaria is a cloud architect with deep roots in software development and open-source advocacy. Certified in AWS, Red Hat, VMware, ITIL, and Linux, he specializes in designing and managing robust cloud and on-premises infrastructures.