A subdomain is any domain name that sits one or more levels below another domain in the Domain Name System hierarchy, formed by adding labels to the left of the parent name, as in shop.example.com or api.eu.example.com. In the field of domain names, the word usually refers to names created under a registered second-level domain by its owner, who can add them freely without paying a registrar or contacting the registry.
Strictly speaking, every name in the DNS except the root is a subdomain of something: example.com is a subdomain of com, and com is a subdomain of the root. In everyday Internet practice, however, the term describes the organizational layer that a domain owner controls, used to separate websites, services, regions, environments and customers under one brand.
How a subdomain fits into the DNS hierarchy
Domain names are read from right to left, from the most general label to the most specific. Each dot separates a label, and each label to the left creates a deeper level of the tree. The owner of example.com holds authority over everything that ends in .example.com, whatever its depth.
| Level | Label in mail.eu.example.com | Who controls it |
|---|---|---|
| Root | (empty, trailing dot) | IANA and root server operators |
| Top-level domain | com | Registry operator |
| Second-level domain | example | Registrant through a registrar |
| Third-level subdomain | eu | Domain owner |
| Fourth-level subdomain | Domain owner or delegate |
The DNS imposes hard length limits: each label may contain at most 63 characters, and the complete name may not exceed 253 characters in its usual text form. Within these limits, a domain may hold up to 127 levels in theory, although practical names rarely exceed four or five.
The most familiar subdomain is www, which began as a convention for naming the web server host. Today, www.example.com and the bare apex domain example.com are usually configured to serve the same site, with one redirecting to the other. The apex cannot hold a CNAME record, which is why many sites keep www as the canonical host when they use a CDN or hosted platform.
Creating and delegating subdomains
A subdomain comes into existence the moment a record is published for it in the parent zone. Adding an A, AAAA or CNAME record for blog inside the example.com zone is enough; no separate registration exists. The subdomain then shares the parent zone, its name servers and its administration.
Alternatively, the owner can delegate a subdomain to other name servers by publishing NS records for it in the parent zone. The subdomain then becomes a separate zone with its own SOA record, which allows a different team, a cloud provider or a customer to manage it independently.
| Method | Records in parent zone | Typical use |
|---|---|---|
| Host record | A or AAAA | Server run by the domain owner |
| Alias | CNAME | Hosted platform or CDN endpoint |
| Delegation | NS, plus DS when DNSSEC is used | Independent team or provider |
| Wildcard | Record for *.example.com | Catch-all for many tenant names |
Delegation needs care with DNSSEC: if the parent is signed, the delegated subdomain must publish its keys and the parent must hold a matching DS record, otherwise validating resolvers reject the whole subdomain.
Subdomain compared with related domain concepts
Several neighboring concepts are easily confused with a subdomain because they also appear in a web address. The table below sets out the differences.
| Concept | Example | Part of DNS | Requires registration |
|---|---|---|---|
| Subdomain | shop.example.com | Yes | No |
| Second-level domain | example.com | Yes | Yes, through a registrar |
| Subdirectory | example.com/shop | No, part of the URL path | No |
| Public suffix name | example.co.uk | Yes | Yes, under a registry suffix |
The last row matters because names such as co.uk are technically subdomains of uk yet act as registry-level suffixes. Browsers use the Public Suffix List to know that a.co.uk and b.co.uk belong to different owners, which affects cookie scoping and certificate validation.
Choosing between a subdomain and a subdirectory
The decision between blog.example.com and example.com/blog is mainly technical and organizational, not a question of naming taste. A subdomain can point to a completely different server or provider, while a subdirectory must be served by the same front end or proxied through it.
| Situation | Recommended choice | Reason |
|---|---|---|
| Third-party platform hosts the service | Subdomain | Only a CNAME is needed |
| Separate security boundary required | Subdomain | Separate browser origin |
| Content tightly linked to the main site | Subdirectory | Shared navigation and authority signals |
| Per-customer tenant addresses | Subdomain with wildcard | Scales without manual records |
Each subdomain is a distinct browser origin, so scripts on one subdomain cannot read data from another by default. Cookies, however, can be set for the parent domain and are then shared across all subdomains, which is convenient for single sign-on but risky when untrusted content is hosted on a sibling subdomain.
Security risks and certificate considerations
The most serious subdomain risk is subdomain takeover. It happens when a CNAME still points to a cloud resource, such as a storage bucket or hosted page, that has been deleted. An attacker who claims the same resource name then serves content on the victim’s subdomain, often with a valid certificate.
- Remove dangling DNS records whenever the target service is decommissioned.
- Inventory all subdomains regularly, because Certificate Transparency logs reveal them publicly.
- Scope cookies narrowly and avoid setting sensitive cookies on the parent domain.
- Plan certificates: a wildcard certificate covers only one level, so
*.example.comdoes not covera.b.example.com.
Wildcard DNS records and wildcard certificates simplify operations but widen the attack surface, since every possible name resolves. They work best when the application rejects unknown host names explicitly.
The simple explanation
Think of a domain name as a street address for a company. Subdomains are then the departments inside the building. The company buys the address once. After that, it can label as many departments as it likes, such as shop, support or mail. It does not need to ask anyone.
Each department can even sit in a different building. A subdomain can point to any server in the world. Visitors still see the familiar company name at the end. Everything stays recognizable while the work is spread out behind the scenes.
How it is used in practice
A mid-sized online retailer owns retail-example.com. Its main store runs on its own servers, but the help center uses a hosted support platform, the newsletter uses an email service and developers need a test environment. The team creates help.retail-example.com as a CNAME to the support platform, news.retail-example.com for the mail service and staging.retail-example.com pointing to an internal server restricted by IP.
Two years later, the company switches support providers but forgets the old CNAME. A security review finds that the former platform name can be claimed by anyone, which would allow a takeover of the help subdomain. The team deletes the record within hours, adds subdomain inventory to its offboarding checklist and keeps the store, support and staging environments cleanly separated under one brand.