Looking into redirect rules in dns

  • tags:
  • domain
  • redirect
  • dns
  • tls

How HTTPS Redirects Work Across Different Domains

You have probably seen URL shorteners and domain redirects like this:

https://old-domain.com
        ↓
https://new-domain.com

One notable example was:

perplexity.in → gemini.google.com

How can one domain securely redirect to a completely different domain without controlling the destination’s DNS, server, or TLS certificate?

The answer is simple: the browser makes two separate connections.

Redirects involve three separate systems

A redirect uses:

  1. DNS — directs the browser to the source server.
  2. TLS — secures the connection to the source domain.
  3. HTTP — tells the browser to visit another URL.

DNS itself does not redirect visitors. It only helps the browser find the server that will issue the redirect.

What happens when you open the URL?

Suppose you visit:

https://old-domain.com/page?id=10

1. DNS resolves the source domain

The browser asks DNS where old-domain.com is hosted.

DNS returns the address of a server, CDN, or edge provider such as Cloudflare.

2. HTTPS is established

The browser connects to the server, which presents a valid TLS certificate for:

old-domain.com

The server does not need a certificate for the destination domain.

3. The server sends a redirect

Instead of returning a webpage, the server responds:

HTTP/1.1 301 Moved Permanently
Location: https://new-domain.com/page?id=10

4. The browser opens the new URL

The browser now makes a completely new connection to new-domain.com.

That domain presents its own TLS certificate.

Browser ──HTTPS──> old-domain.com
Browser <──301 redirect── old-domain.com

Browser ──HTTPS──> new-domain.com
Browser <──200 OK── new-domain.com

This is why the source domain does not need control over the destination.

Does the destination need to approve the redirect?

No.

Redirecting to a public URL is similar to linking to it. The destination does not need to add the source domain to its DNS or server configuration.

The destination simply receives a normal request:

GET /page?id=10 HTTP/1.1
Host: new-domain.com

It may not even know that the visitor arrived through a redirect.

However, the destination must support the requested path, method and parameters. A redirect cannot force an unrelated server to accept an unsupported request.

Which redirect status should you use?

The most useful redirect codes are:

  • 301 — permanent redirect
  • 302 — temporary redirect
  • 303 — redirect to another page using GET
  • 307 — temporary redirect that preserves the request method
  • 308 — permanent redirect that preserves the request method

The important distinction is method preservation.

With 301 and 302, a browser may change a POST request into a GET. Use 307 or 308 when the original method and body must remain unchanged. 1

For example:

POST /api/order

After a 308 redirect, the browser or API client sends:

POST /api/order

to the new domain.

Still, redirects are not transparent proxies. Authentication, cookies, CORS rules and API compatibility can prevent a redirected request from working correctly.

Other 3xx status codes

Not every 3xx response is a URL redirect:

  • 304 Not Modified — tells the browser to use its cached copy
  • 305 Use Proxy — deprecated
  • 306 — unused

Therefore, the commonly useful redirect codes are 301, 302, 303, 307 and 308. 2

How Cloudflare handles redirects

Cloudflare can perform a redirect without requiring a real origin server.

You can create proxied records such as:

A    @      192.0.2.1    Proxied
A    www    192.0.2.1    Proxied

192.0.2.1 is not the actual redirect server. It is a placeholder address that allows requests to enter Cloudflare’s network, where a Redirect Rule or Worker returns the redirect response. 3

The process is:

Visitor
   ↓
Cloudflare DNS
   ↓
Cloudflare edge server
   ↓
TLS certificate for the source domain
   ↓
301/302/307/308 redirect
   ↓
Destination domain

Cloudflare can automatically issue and renew a trusted TLS certificate for activated domains, which is why HTTPS works without browser warnings. 45

Can you redirect an apex domain?

Yes.

It is true that a traditional CNAME record normally cannot be placed at the zone apex. But a CNAME is not required for redirection.

You can redirect an apex domain using:

  • An A or AAAA record
  • A proxied placeholder record
  • CNAME flattening
  • An ALIAS or ANAME record
  • Registrar-level forwarding
  • A server or edge function

For example, Cloudflare supports redirecting both:

example.com
www.example.com

using proxied A records. 3

How search engines handle redirects

Search engines generally interpret:

  • 301 or 308 as a permanent move
  • 302 or 307 as a temporary move

A permanent redirect tells Google that the destination should eventually replace the source URL in search results. A temporary redirect usually tells Google to keep the source URL indexed. 6

However, a redirect is only a signal. Search engines may also examine:

  • Whether the destination contains similar content
  • Whether paths are mapped correctly
  • Canonical tags
  • Internal links and sitemaps
  • Redirect chains
  • Spam or abuse signals

For SEO, map each old page to its closest replacement:

old.example/docs/install
        ↓
new.example/docs/install

Avoid redirecting every old page to an unrelated homepage.

Final takeaway

A secure cross-domain redirect works because:

  • DNS sends traffic to the redirect provider.
  • TLS secures the source domain.
  • HTTP tells the browser where to go next.
  • The destination handles its own DNS and TLS separately.

The source domain never serves the destination’s certificate. It simply returns a response such as:

HTTP/1.1 301 Moved Permanently
Location: https://destination.example

The browser then starts a new, independent HTTPS connection to the destination.

That is the basic mechanism behind URL shorteners, branded links, domain forwarding and website migrations.

Subscribe on GitHub