web dev//DNS//apex

The apex is the domain with nothing in front of it: `example.com`, as opposed to the subdomain `www.example.com`; it is also called the **naked domain**. In a zone it is written `@`. The two behave differently because of one rule of the DNS standard: a CNAME is not allowed at the apex. The apex already carries records that are mandatory for the domain to exist (the SOA and NS records of the zone), and a CNAME cannot share a name with any other record.

The apex is the domain with nothing in front of it: example.com, as opposed to the subdomain www.example.com; it is also called the naked domain. In a zone it is written @. The two behave differently because of one rule of the DNS standard: a CNAME is not allowed at the apex. The apex already carries records that are mandatory for the domain to exist (the SOA and NS records of the zone), and a CNAME cannot share a name with any other record.

A subdomain can therefore be pointed at a hosting platform with a CNAME from any DNS provider, while the apex cannot. Cloudflare gets around the rule with a technique of its own, CNAME flattening, which resolves the alias internally and answers with addresses; it can only do that inside its own DNS. The rule also costs the apex its proof of ownership: on a subdomain the CNAME itself is the gesture that shows control of the name, and the apex has no such gesture, so Cloudflare demands that the zone and the Pages project sit in the same account.

Serving a site on the bare domain from Pages is what forces the nameservers to move to Cloudflare. With www alone, a CNAME at the old DNS provider would have been enough.