www, redirects, and what DNS doesn't do

Module 3: Records for your website · Reading time: 7 minutes

Learning objective: After this lesson, you'll know the difference between DNS (where the server is) and redirecting (which page you get), and you'll be able to set up www correctly.

Key terms: www, redirect (301/302), domain pointer or alias, https certificate, a path doesn't exist in DNS

What DNS does and doesn't know

DNS answers one kind of question: "where is this name located?" The answer is an address (A, AAAA) or another name (CNAME). After that, DNS is done. Everything that happens afterwards is handled by the web server at that address.

A web address consists of more than just a name:

https://www.example.com/contact?taal=nl
└─┬─┘   └──────┬───────┘└───┬──┘└──┬──┘
protocol     naam          pad   parameters

Only the middle part, the name, reaches DNS. The protocol (https), the path (/contact) and the parameters are never seen by DNS. This leads to a few things that surprise many people:

• DNS can't redirect to a page. A record like "example.com to othersite.example/actie" doesn't exist.
• DNS doesn't choose between http and https. Whether a visitor ends up on https is handled by the web server.
• DNS doesn't know which website is on a server. Hundreds of websites can run on a single IP address. The browser sends the name along in its request, and the web server uses that to choose the right site.

Redirecting happens on the web server

Do you want example.com to redirect visitors to www.example.com, or a second domain name to point to your main site? Then you need two steps:

1. DNS: have the name point to a web server that can handle the redirect. This is usually your own hosting, or a redirect service from your registrar.
2. Web server: set up a redirect there. The server then doesn't respond with a page, but with "go to this other address". The browser follows this automatically.

A redirect has a code:

A domain pointer or domain alias is something different: the same website shows itself under two names, without the address bar changing. This is also handled by the hosting panel, not DNS. The DNS of the second name only needs to point to the same server.

There's also frame forwarding: the address bar keeps showing your domain while you see another site. This often works poorly with modern websites (which refuse to load in a frame), and search engines don't like it either. It's best not to use it.

www: yes or no?

www is simply a subdomain. Whether you run your site on www.example.com or on example.com is a choice. The only important things are:

1. Both must work. People type one or the other. If a record for www is missing, they'll get an error message saying the site doesn't exist.
2. Choose one as the main address and have the other redirect to it with a 301. That way a search engine sees one site, not two copies.

In DNS, this usually comes down to:

example.com.       3600  IN  A      192.0.2.10
www.example.com.   3600  IN  CNAME  example.com.

or a separate A record for www with the same address. A wildcard (lesson 3.3) can also cover www. With an external service, such as an online store platform, www often points to the service with a CNAME and the bare name points with an A record to an address the service provides (lesson 3.2 explains why).

The certificate matters too

A browser only shows a padlock if the server has a certificate for exactly the name the visitor typed. A certificate for example.com doesn't automatically cover www.example.com. So make sure the certificate includes both names.

This has a consequence for redirecting: a visitor who opens https://example.com first gets a certificate check, and only afterwards the redirect. Without a valid certificate for the bare name, they'll see a warning, even though you redirect them properly afterwards. So even the name that only redirects needs a certificate.

Free certificates such as those from Let's Encrypt check whether the name really points to your server. If DNS still points to an old server, the request will fail. DNS first, then the certificate.

In practice: what it looks like in a panel

As an example, we'll use DirectAdmin. In cPanel, Plesk and other panels, this feature is often called "Redirects".

1. Open Site Redirects (redirecting).
2. Fill in the path that should be redirected, for example / for the entire site.
3. Choose the type: 301 for permanent.
4. Fill in the destination address, with https://.
5. Save.

The DNS of the name must point to your own hosting for this to work. If it points to another service, the visitor will never reach this redirect.

Summary

• DNS only gives the address of a name. DNS never sees the path, protocol or parameters.
• Redirecting (301, 302) and domain pointers are handled by the web server, not DNS.
• Make sure both the bare name and www have a record, and choose one as the main address.
• A certificate must cover every name a visitor can type, including the name that only redirects.
• Get DNS right first, then the certificate.

Quiz

Exercise

Exercise Z3.4: www: CNAME or A? How is www.sidn.nl set up in DNS? Look up which record exists for www.sidn.nl and fill in the type (A, AAAA or CNAME) and the value. Tip: ask for a CNAME first.

There's no practice zone exercise for this lesson: redirecting happens on a web server, not in DNS.

Further reading

These articles describe the steps in WebOké's panels; in other panels they work in a similar way.

• DirectAdmin guide 4.7: Site Redirects: forwarding a domain or page
• DirectAdmin guide 4.4: Domain pointers: a second domain name for the same site
• Creating a redirect to another domain (hosting account)
• Creating a domain forward/redirect (domain registration)
• DirectAdmin guide 6.3: Certificate for www, subdomains and wildcard