---
title: Apex domain redirect
slug: cms-13/docs/apex-domain-redirect
docTags: 
createdAt: 2026-07-30T20:22:07.530Z
---

When you register a hostname that begins with `www.` in Optimizely Digital Experience Platform (DXP), the service automatically configures an apex domain redirect for the matching root domain. The redirect sends visitors who enter the bare domain (for example, `example.com`) to your site at the canonical `www` hostname (`https://www.example.com`).

## How it works

1. Add a `www.` hostname (for example, `www.example.com`) to your site in the Optimizely DXP portal.
2. The portal registers the hostname so the redirect service can serve the apex domain (`example.com`).
3. Point the apex domain at the shared redirect service IP address that DXP provides. See [Configure DNS](docId\:DurRV0VoB5JZt5WBrFINA) for the address.
4. The redirect service answers any request to the apex domain and redirects it to the `www` hostname over HTTPS.

The redirect preserves the request path and query string. For example, `http://example.com/products?id=42` becomes `https://www.example.com/products?id=42`.

:::hint{type="info"}
**Note**
The redirect IP address is shared infrastructure used by all Optimizely DXP customers who enable the apex redirect. It is not allocated to your domain individually. The redirect service identifies your site from the `Host` header of the incoming request, not from the destination IP. Sharing the address has no functional impact on your traffic.
:::

## Redirect behavior

The redirect service is simple and predictable:

- **Always redirects to HTTPS** – The destination URL is always `https://www.YOUR_DOMAIN/...`, whether the original request arrived over HTTP or HTTPS. This avoids the common redirect chain of `http://example.com` to `http://www.example.com` to `https://www.example.com`. A single hop keeps the search engine optimization (SEO) impact minimal and reduces latency for end users.
- **Returns a** `301` **(Moved Permanently) response** – A `301` tells search engines to consolidate link equity on the `www` hostname, which is better for SEO than a temporary redirect.
- **Does not preserve the HTTP method** – Unlike a `307` or `308` response, a `301` lets clients switch the request method to `GET` when following the redirect. The redirect service handles browsing traffic (`GET` requests). Target the `www` hostname directly for API calls or form submissions (`POST`, `PUT`, `DELETE`, and similar methods).

## Configure DNS

To activate the redirect, configure DNS for your apex domain:

1. Configure all validation records provided by the Optimizely DXP portal.
2. Configure the `www` hostname using the instructions from the Optimizely DXP portal.
3. Configure the apex domain (for example, `example.com`) with an `A` record that points to the redirect IP address `217.114.94.2`.

After DNS propagates, the redirect service responds to requests for the apex domain and directs end users to `https://www.YOUR_DOMAIN` in a single hop.

### Validate the redirect

Validate the redirect by entering your apex domain in a browser (for example, `http://example.com`) and confirming that you land on your site (`https://www.example.com`).

### When Optimizely manages your full DNS zone

If you delegate the entire DNS zone to Optimizely (full zone delegation, where Optimizely is the authoritative nameserver for your domain), you do not need to add the apex `A` record yourself. Optimizely manages the apex records for you when it provisions the redirect, and automatically creates the records after the `www.` hostname is registered in the DXP portal. The manual DNS steps in this section apply only when you operate the DNS zone yourself with an external provider.

### Why the redirect uses an A record instead of a CNAME

The DNS standard does not allow `CNAME` records at the apex (root) of a zone. The apex must also hold records such as `SOA` and `NS`, and a `CNAME` cannot coexist with other record types on the same name. To remain compliant and work with all DNS providers, the redirect service uses a fixed `A` record that points to `217.114.94.2`. This includes providers that do not offer non-standard workarounds such as `ALIAS` or `ANAME` records. A fixed `A` record keeps your DNS configuration portable and predictable.

## TLS certificates

Transport Layer Security (TLS) secures traffic to both your DXP site and the redirect. Certificate handling differs between them:

- **Your DXP site (**`www.YOUR_DOMAIN`**)** – Bring your own certificate or use the automatically managed option.
- **The redirect (**`YOUR_DOMAIN`**)** – Optimizely automatically generates and manages the certificate. You cannot upload your own certificate for the redirect, and none is needed.

Optimizely issues and installs the redirect certificate after your DNS update propagates and the hostname is fully provisioned. After that, `https://YOUR_DOMAIN` automatically redirects to `https://www.YOUR_DOMAIN`.

## Limitations

The apex domain redirect has the following limitations:

- **Not a general-purpose URL rewriter** – The destination always replaces the apex host with `www.APEX_HOST`. The path and query string pass through unchanged.
- **Does not terminate application traffic** – Your DXP site serves all subsequent requests at the `www` hostname.
- **Not intended for non-**`GET` **traffic** – Clients that must issue `POST`, `PUT`, or `DELETE` requests should target the `www` hostname directly.