CNAME at the domain apex
Check id: dns.apex_cname · fix effort: medium
What it means
Your root domain is set up as an alias, which DNS doesn't actually allow. It can break email and other records in unpredictable ways.
The technical detail
CNAME at the apex violates RFC 1034 3.6.2. Resolver behavior becomes undefined and MX/TXT lookups can break.
How to fix it
- Replace the apex CNAME with your provider's ALIAS/ANAME/flattened-CNAME feature, or plain A/AAAA records.
Does your domain have this problem?
Run a free scan, takes about ten seconds.