How to set up a subdomain using DNS?

To set up a subdomain using DNS, log in to the provider that hosts your domain's DNS and add a record whose name is the subdomain label, such as blog for blog.example.com. Use an A record (and AAAA for IPv6) if you're pointing it at a server's IP address, or a CNAME record if a service has given you a hostname to point at. The subdomain usually resolves within a few minutes, and then you configure the server or service so it knows to answer for that name.

A subdomain doesn't need to be registered or paid for separately. Once you own example.com, you can create as many names under it as you like, simply by adding DNS records. This guide covers how to choose the right record type, how to add the record in a dashboard, a zone file, an API or Terraform, how to delegate a subdomain to a different DNS provider, how to set up the web server and HTTPS, and how to check it all works.

What a Subdomain Is

A domain name is read from right to left. In blog.example.com:

• com is the top-level domain.
• example is the domain you registered.
• blog is the subdomain label you add.

Technically, www is a subdomain too, and so are deeper names like api.v2.example.com. Each label can be up to 63 characters, using letters, digits and hyphens, and it can't start or end with a hyphen. DNS names aren't case-sensitive, so Blog.Example.com and blog.example.com are the same.

Subdomains are commonly used for:

• Separate apps or sites: app.example.com, shop.example.com, docs.example.com.
• Third-party services: a help desk at help.example.com or a status page at status.example.com.
• Environments: staging.example.com, dev.example.com.
• Infrastructure: vpn.example.com, mail.example.com.
• Regions or brands: uk.example.com, store.example.com.

Step 1: Find Where Your DNS Is Hosted

You add the record wherever your domain's DNS is managed, which may not be your registrar. Check your nameservers:

dig +short example.com NS

ada.ns.cloudflare.com.
bob.ns.cloudflare.com.

In this case, you'd add the subdomain in Cloudflare. If the nameservers belong to your registrar or web host, use their DNS editor.

Step 2: Choose the Right Record Type

The service you're connecting will usually tell you exactly what to create. If you're deciding yourself, use this table:

Situation	Record type	Example value
Pointing at your own server's IPv4 address	A	203.0.113.40
Pointing at your own server's IPv6 address	AAAA	2001:db8::40
Pointing at a hosted service that gave you a hostname	CNAME	customer123.helpdesk.example.net
Pointing at another name in your own domain	CNAME	example.com
Handing the whole subdomain to another DNS provider	NS	ns1.otherdns.example.net
Receiving email at the subdomain	MX	10 mx.mailprovider.example.net

A few points that help you decide:

• Prefer CNAME for third-party services: If a provider gives you a hostname, use it. They can then change their IP addresses without you having to update anything.
• Use A/AAAA for your own servers: When you control the server and its address is stable, an A record is simpler and saves a lookup.
• A CNAME must be alone: A name with a CNAME can't have any other records. If you need an MX or TXT on shop.example.com, you can't also make it a CNAME.

Step 3: Add the Record

In a DNS Dashboard

The form is nearly identical across providers:

1. Type: Choose A, AAAA or CNAME.
2. Name (sometimes Host): Enter only the subdomain label, such as blog. Most providers add .example.com for you. Entering blog.example.com in some dashboards creates blog.example.com.example.com by mistake.
3. Value (sometimes Points to, Target or Content): The IP address or hostname.
4. TTL: 3,600 seconds (one hour) is a sensible default. Use 300 if you expect to change it soon.
5. Save.

On Cloudflare, you also choose whether the record is proxied (orange cloud) or DNS only (grey cloud). Proxied records hide your server's IP and route traffic through Cloudflare, which is fine for websites but not for services such as SSH, mail servers or game servers.

In a Zone File

If you run your own authoritative server, add the records to the zone file and increase the SOA serial number:

$ORIGIN example.com.
$TTL 3600

blog        IN  A      203.0.113.40
blog        IN  AAAA   2001:db8::40
help        IN  CNAME  customer123.helpdesk.example.net.
staging     IN  CNAME  www.example.com.

Note the trailing dot on hostnames. Without it, customer123.helpdesk.example.net would be treated as relative to $ORIGIN and become customer123.helpdesk.example.net.example.com..

Validate and reload with BIND:

named-checkzone example.com /etc/bind/zones/db.example.com
sudo rndc reload example.com

With an API

Most DNS providers have an API. Here's how you'd add blog with the Cloudflare API:

curl -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records" \
  -H "Authorization: Bearer $CF_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"type":"A","name":"blog","content":"203.0.113.40","ttl":3600,"proxied":false}'

Cloudflare accepts either the short label or the full name in the name field.

With Terraform

Using the AWS provider for Route 53:

data "aws_route53_zone" "main" {
  name = "example.com"
}

resource "aws_route53_record" "blog" {
  zone_id = data.aws_route53_zone.main.zone_id
  name    = "blog.example.com"
  type    = "A"
  ttl     = 3600
  records = ["203.0.113.40"]
}

resource "aws_route53_record" "help" {
  zone_id = data.aws_route53_zone.main.zone_id
  name    = "help.example.com"
  type    = "CNAME"
  ttl     = 3600
  records = ["customer123.helpdesk.example.net"]
}

Step 4: Check That the Subdomain Resolves

Query your authoritative nameserver first. It shows the new record immediately, without any caching:

dig @ada.ns.cloudflare.com blog.example.com A +short

203.0.113.40

Then check from a public resolver:

dig blog.example.com A

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33019
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; ANSWER SECTION:
blog.example.com.   3600    IN  A   203.0.113.40

For a CNAME, dig shows the alias and the final address:

dig help.example.com +noall +answer

help.example.com.                 3600  IN  CNAME  customer123.helpdesk.example.net.
customer123.helpdesk.example.net.  300  IN  A      198.51.100.77

On Windows, use Resolve-DnsName blog.example.com or nslookup blog.example.com.

If You Get NXDOMAIN

If you looked up the subdomain before creating the record, your resolver may have cached the "doesn't exist" answer. That negative answer is cached for the time in your zone's SOA record (the last field, often one hour or less). Query the authoritative server directly to confirm the record exists, then either wait or flush your local cache.

Step 5: Configure the Server or Service

DNS only sends visitors to an address. The server at that address has to know what to do with requests for the new name.

For a Hosted Service

Add the subdomain in the service's settings. Platforms such as help desks, website builders and hosting platforms usually have a Custom domain section. Many will check the DNS record and then issue an HTTPS certificate automatically.

For Your Own Nginx Server

Create a server block for the subdomain:

server {
    listen 80;
    listen [::]:80;
    server_name blog.example.com;

    root /var/www/blog;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

Save it as /etc/nginx/sites-available/blog.example.com, enable it, and reload:

sudo ln -s /etc/nginx/sites-available/blog.example.com /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

For Apache

<VirtualHost *:80>
    ServerName blog.example.com
    DocumentRoot /var/www/blog
</VirtualHost>

sudo a2ensite blog.example.com.conf
sudo apachectl configtest
sudo systemctl reload apache2

Step 6: Add HTTPS

Once DNS resolves to your server and port 80 is reachable, you can issue a free certificate with Certbot:

sudo certbot --nginx -d blog.example.com

Or for Apache:

sudo certbot --apache -d blog.example.com

Certbot uses the HTTP-01 challenge here, so DNS must already point at this server. If you have a CAA record on your root domain, it also applies to subdomains unless the subdomain has its own, so make sure it allows your certificate authority:

dig +short example.com CAA

Test the result:

curl -sI https://blog.example.com/

Delegating a Subdomain to Another DNS Provider

Sometimes you want a different team or provider to manage everything under a subdomain. For example, your main zone is on Cloudflare, but aws.example.com should be managed in Route 53. You do this with NS records in the parent zone:

aws.example.com.    3600  IN  NS  ns-101.awsdns-12.com.
aws.example.com.    3600  IN  NS  ns-602.awsdns-11.net.
aws.example.com.    3600  IN  NS  ns-1201.awsdns-21.org.
aws.example.com.    3600  IN  NS  ns-1802.awsdns-31.co.uk.

The steps are:

1. Create a zone for aws.example.com at the second provider. It will give you its nameserver names.
2. Add those as NS records for aws in the parent zone.
3. Create records like app.aws.example.com in the new zone, not the parent.

Check the delegation with:

dig aws.example.com NS +short
dig app.aws.example.com A +trace

Once delegated, the parent's other records at or below aws are ignored, so don't add an A record for aws.example.com in the parent alongside the NS records. Put it in the child zone instead.

Common Subdomain Mistakes

1. Typing the full name in the Name field: Creates blog.example.com.example.com. Check with dig if the subdomain doesn't resolve.
2. Missing trailing dot in zone files: Turns absolute hostnames into relative ones.
3. CNAME alongside other records: Most providers reject this, but some allow it and produce unpredictable results.
4. Forgetting the server side: DNS resolves, but the server shows a default page or the wrong site because it hasn't been told about the new name.
5. Proxying non-web traffic: On Cloudflare, an orange-cloud record for an SSH or mail host stops those services working.
6. Leaving old subdomains in place: A CNAME pointing at a service you've cancelled can sometimes be claimed by someone else. Remove records when the service goes away.

---

FAQ: Setting Up Subdomains

---

Conclusion

Setting up a subdomain is a matter of adding one DNS record at the provider that hosts your zone: an A or AAAA record for your own server, or a CNAME for a service that gives you a hostname. Enter only the label in the name field, check the result against your authoritative nameserver, and it will usually resolve within minutes.

The rest of the job happens on the other end: telling the server or service about the new name and issuing an HTTPS certificate for it. When a whole subdomain needs to be managed elsewhere, delegate it with NS records instead. And when a subdomain is no longer needed, delete its records so nothing is left pointing at a service you no longer control.