Apex domain

It is the point where the parent zone delegates authority. The NS records there name the zone's own nameservers, and the SOA record holds its serial number and timing parameters.

Those records cannot be removed without destroying the zone, so the apex always has records other than whatever you publish for the website.

Everything below it — `www`, `shop`, `api` — is an ordinary name inside the zone with no such obligation, which is why those can be CNAMEs freely.

Mail for a domain is normally addressed at the apex too, so the apex typically carries MX and SPF records alongside its web records.

Hosted platforms and CDNs want you to point at a hostname they control, because it lets them change addresses. A CNAME expresses that, and the apex cannot hold one.

Redirect the apex to `www` over HTTP and put the CNAME on `www`. Standards-compliant, costs one redirect, and makes `www` the canonical host.

Use a provider's apex alias — ALIAS, ANAME or CNAME flattening — where the DNS server resolves the target and serves the result as an A record. Convenient, provider-specific, and worth understanding the refresh behaviour of.

Publish A records at the apex with addresses the provider supplies, accepting the maintenance burden when they change.

Both work, and search engines have no preference between them. What matters is that one is chosen and the other redirects to it consistently.

Serving the site at both without redirecting produces two addresses for every page, which splits signals and duplicates everything unless canonical tags resolve it.

The apex reads shorter and is what people type. `www` is easier to host behind a CDN and lets cookies be scoped away from the apex, which matters when subdomains should not receive them.

Whichever is chosen, links, canonical tags, the sitemap and the redirect rules must all agree. Disagreement among them is the actual defect, not the choice itself.

`curl -sSIL https://example.com | grep -iE "^(HTTP|location)"` shows whether the apex redirects and to where.

Run the same against `https://www.example.com`, and against the `http://` form of both. Four combinations, one canonical destination, no loops.

Check that the canonical tag in the HTML names the same host the redirects converge on.

Check the certificate covers both names. An apex certificate that omits `www` breaks the redirect for anyone who types it.