www follows. The apex has to be told.
One of these records is a pointer. The other is a transcription, and transcriptions go stale in silence.
Two records. They look like a matched pair, and they are nothing of the sort.
@ 300 IN A 75.2.60.5
www 300 IN CNAME jwogrady.netlify.app.
The first says the bare domain lives at this number. The second says www is
another name for jwogrady.netlify.app, go ask about that instead.
One of them is a pointer. The other is a copy of a number that belongs to somebody else, and I can’t change which is which — that isn’t a style choice, it’s the shape of DNS.
Why the apex can’t point
A domain’s apex — the bare jwogrady.com, no www — has to carry the records
that say who’s authoritative for the zone. It cannot also be an alias,
because an alias means “I have no data of my own, go look over there,” and the
apex demonstrably has data of its own.
So www gets to be a pointer and the apex doesn’t. The apex has to hold an
address, literally, as digits.
That address isn’t mine. It’s Netlify’s apex load balancer, published in their documentation, typed into my zone by me:
Add an A record. Depending on your provider, leave the host field empty or enter
@. Point the record to Netlify’s load balancer IP address:75.2.60.5.
Read that again as an operations problem rather than a setup step. A number
under somebody else’s control is now sitting in my zone file as a constant.
If they move that load balancer, www follows them without anyone doing
anything — it’s a name, they own the name, they repoint it. The apex sits
there pointing at the old number until a human notices and edits a file.
The zone already braces for this. Both routing records carry a 300-second TTL against a zone default of 3600, and the comment says why: Netlify can move a site between addresses, and five minutes is what a move costs if one happens.
Five minutes is the cost of the move. It is not the cost of noticing.
Then I went and looked at what each name actually returns
I expected the apex and www to be two doors into the same room. Here’s the apex:
$ resolvectl query jwogrady.com
jwogrady.com: 75.2.60.5
One address. Here’s www:
$ resolvectl query www.jwogrady.com
www.jwogrady.com: 2600:1f18:16e:df01::259
2600:1f18:16e:df01::258
18.208.88.157
98.84.224.111
(jwogrady.netlify.app)
Four addresses. Two of them IPv6.
So I asked the obvious next question, and the answer is the best thing I learned today:
$ resolvectl query -t AAAA jwogrady.com
jwogrady.com: resolve call failed: Name 'jwogrady.com' does not have any
RR of the requested type
The bare domain has no IPv6 at all. Not a missing record I forgot to add — there is no address published for me to add. Netlify documents an A record for the apex and no AAAA, and when you’re on external DNS they don’t offer one.
I’d assumed that gap was an oversight nobody had got round to. It isn’t. It’s structural, it’s documented, and Netlify say out loud what follows from it:
In both cases, the apex domain eventually resolves to our load balancer IP address. This means the apex domain can’t take advantage of direct DNS routing on a global CDN like Netlify’s. Because of this, we recommend using a subdomain for your primary domain when using external DNS.
That sentence is doing a lot of work. The apex isn’t just missing IPv6 — it also can’t be routed by the CDN the way a name can, because a number can only ever point at one place, and the entire trick of a content delivery network is handing different visitors different answers.
One of these records is a pointer. The other is a transcription, and transcriptions go stale in silence.
What this is really about
I’ve been calling this a DNS entry in my head and it keeps refusing to stay one.
Every system you run has both kinds of reference in it, and almost nobody sorts them. A pointer names a thing and re-asks every time. A transcription copied the answer once, on a day when it was true.
- The price in the signed PDF versus the price in the price list.
- The bank details typed into a supplier record versus the ones on their invoice.
- The mobile number printed on ten thousand flyers versus the one your forwarding service rings.
- The opening hours on the van, the door, the Google listing and the website.
Transcriptions aren’t wrong to make. Sometimes you have no choice — DNS gave me none at the apex, and a printed flyer can’t be a pointer. What’s wrong is losing track of which ones they are, because a transcription has a failure mode a pointer doesn’t: it keeps working, confidently, after it stops being true.
What to carry out
Go through the things your business depends on and mark each one pointer or copy.
Then, for every copy: write down what it was copied from, and what would make it wrong. Not a monitoring system, not a process — one line next to the value, the way my zone file now carries a paragraph about a load balancer I don’t own.
You will not remember. The person who inherits it never knew. The note is the only part of this that survives either of you.