A technical note for network administrators

A CNAME at the
apex. Finally.

Route 53 will not let a CNAME live at your root domain. This tool resolves the target's real addresses and keeps the apex A records in step — automatically, on a schedule, with a preview before it writes.

Figure 1 — the flattening cycle, every run

The apex example.com wants a CNAME · Route 53 forbids it

writes A records

apex-flattener resolve → diff → upsert Python · boto3 · idempotent

resolves target

The target app.cdn-vendor.net CNAME · addresses drift over time

Result — apex A record set, kept current

example.com. A 203.0.113.7
example.com. A 203.0.113.9
example.com. A 198.51.100.22

Cloudflare's partial (CNAME) setup, a load balancer, a CDN edge — the modern web hands you a hostname and asks you to point at it. At any subdomain that is a one-line CNAME. At the apex — the bare example.com — the DNS specification forbids a CNAME alongside the zone's SOA and NS records, and Route 53 enforces it.

The honest workaround is to publish the target's current IP addresses as ordinary A records at the apex, and to refresh them whenever the target moves. Done by hand it is tedious and goes stale. This tool does exactly that, correctly: it resolves the target, compares it with the live record set, and upserts only what changed. Run it on a timer and the apex tracks the target for you.