netbirdio/netbird · error

invalid CNAME target format

Error message

invalid CNAME target format

What it means

For Type == CNAME, Validate() requires Content to pass domain.IsValidDomainNoWildcard. That means an ASCII (or punycode) domain with no "*." prefix, no trailing dot, labels of at most 63 chars starting/ending alphanumeric; the empty string also fails because IsValidDomainNoWildcard returns false for "".

Source

Thrown at management/internals/modules/zones/records/record.go:85

		return errors.New("invalid record name format")
	}

	if r.Type == "" {
		return errors.New("record type is required")
	}

	switch r.Type {
	case RecordTypeA:
		if err := validateIPv4(r.Content); err != nil {
			return err
		}
	case RecordTypeAAAA:
		if err := validateIPv6(r.Content); err != nil {
			return err
		}
	case RecordTypeCNAME:
		if !domain.IsValidDomainNoWildcard(r.Content) {
			return errors.New("invalid CNAME target format")
		}
	default:
		return errors.New("invalid record type, must be A, AAAA, or CNAME")
	}

	if r.TTL < 0 {
		return errors.New("TTL cannot be negative")
	}

	return nil
}

func (r *Record) EventMeta(zoneID, zoneName string) map[string]any {
	return map[string]any{
		"name":      r.Name,
		"type":      string(r.Type),
		"content":   r.Content,
		"ttl":       r.TTL,

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Use an explicit target domain without the wildcard prefix, e.g. "target.example.com".
2. Remove any trailing dot and punycode-convert unicode targets before submitting.
3. If you intended a wildcard record name, put the "*." on Name (IsValidDomain allows it), not on the CNAME content.

Example fix

// before
{"name": "www", "type": "CNAME", "content": "*.example.com"}
// after
{"name": "www", "type": "CNAME", "content": "example.com"}

if api.DNSRecordType(req.Type) == api.DNSRecordTypeCNAME && !domain.IsValidDomainNoWildcard(req.Content) {
    return fmt.Errorf("CNAME target %q must be a plain domain without wildcard", req.Content)
}

func isValidCNAMETarget(content string) bool {
    return domain.IsValidDomainNoWildcard(strings.TrimSuffix(content, "."))
}

if err := rec.Validate(); err != nil {
    return respondBadRequest(err)
}

When it happens

Trigger: A CNAME record whose content is "*.example.com", "target..com", "example.com.", "café.example.com" (unicode), "", or a label over 63 chars.

Common situations: Copying a wildcard alias from another DNS provider that permits wildcard CNAME targets; pasting an FQDN with trailing dot; expecting the record-name wildcard tolerance to also apply to CNAME content (it does not).

Related errors

• record name is required
• invalid record name format
• record type is required
• invalid record type, must be A, AAAA, or CNAME
• TTL cannot be negative

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/dd5711fcbb3e8041. Report an issue: GitHub.