diff --git a/changelog/unreleased/kong/remove_cname_from_dns_order_default_value.yml b/changelog/unreleased/kong/remove_cname_from_dns_order_default_value.yml
new file mode 100644
index 000000000000..1ead48d795ba
--- /dev/null
+++ b/changelog/unreleased/kong/remove_cname_from_dns_order_default_value.yml
@@ -0,0 +1,3 @@
+message: Removed `CNAME` from default `dns_order` option
+type: breaking_change
+scope: Configuration
diff --git a/kong.conf.default b/kong.conf.default
index 74a1cf33deff..dc03eb89b439 100644
--- a/kong.conf.default
+++ b/kong.conf.default
@@ -1496,8 +1496,7 @@
 # overridden by the environment variables `LOCALDOMAIN` and `RES_OPTIONS` if
 # they have been set.
 #
-# Kong will resolve hostnames as either `SRV` or `A` records (in that order, and
-# `CNAME` records will be dereferenced in the process).
+# Kong will resolve hostnames as either `SRV` or `A` records.
 # In case a name was resolved as an `SRV` record it will also override any given
 # port number by the `port` field contents received from the DNS server.
 #
@@ -1523,7 +1522,7 @@
                                  # To read the file again after modifying it,
                                  # Kong must be reloaded.
 
-#dns_order = LAST,SRV,A,CNAME    # The order in which to resolve different
+#dns_order = LAST,SRV,A          # The order in which to resolve different
                                  # record types. The `LAST` type means the
                                  # type of the last successful lookup (for the
                                  # specified name). The format is a (case
diff --git a/kong/templates/kong_defaults.lua b/kong/templates/kong_defaults.lua
index ce532fd4b7ca..ca260d5661f4 100644
--- a/kong/templates/kong_defaults.lua
+++ b/kong/templates/kong_defaults.lua
@@ -161,7 +161,7 @@ db_cache_warmup_entities = services
 
 dns_resolver = NONE
 dns_hostsfile = /etc/hosts
-dns_order = LAST,SRV,A,CNAME
+dns_order = LAST,SRV,A
 dns_valid_ttl = NONE
 dns_stale_ttl = 3600
 dns_cache_size = 10000
diff --git a/spec/01-unit/03-conf_loader_spec.lua b/spec/01-unit/03-conf_loader_spec.lua
index 10e0403d254e..c83e25055f0a 100644
--- a/spec/01-unit/03-conf_loader_spec.lua
+++ b/spec/01-unit/03-conf_loader_spec.lua
@@ -641,7 +641,7 @@ describe("Configuration loader", function()
     it("infer arrays (comma-separated strings)", function()
       local conf = assert(conf_loader())
       assert.same({"bundled"}, conf.plugins)
-      assert.same({"LAST", "SRV", "A", "CNAME"}, conf.dns_order)
+      assert.same({"LAST", "SRV", "A"}, conf.dns_order)
       assert.is_nil(getmetatable(conf.plugins))
       assert.is_nil(getmetatable(conf.dns_order))
     end)
diff --git a/spec/02-integration/05-proxy/05-dns_spec.lua b/spec/02-integration/05-proxy/05-dns_spec.lua
index 9607352a26ce..3e2c9475723c 100644
--- a/spec/02-integration/05-proxy/05-dns_spec.lua
+++ b/spec/02-integration/05-proxy/05-dns_spec.lua
@@ -108,7 +108,7 @@ for _, strategy in helpers.each_strategy() do
 
         local service = bp.services:insert {
           name     = "tests-retries",
-          host     = "nowthisdoesnotexistatall",
+          host     = "nowthisdoesnotexistatall.test",
           path     = "/exist",
           port     = 80,
           protocol = "http"
diff --git a/spec/02-integration/14-tracing/01-instrumentations_spec.lua b/spec/02-integration/14-tracing/01-instrumentations_spec.lua
index 781c85cd8fb2..0d9af1927995 100644
--- a/spec/02-integration/14-tracing/01-instrumentations_spec.lua
+++ b/spec/02-integration/14-tracing/01-instrumentations_spec.lua
@@ -524,7 +524,7 @@ for _, strategy in helpers.each_strategy() do
             -- intentionally trigger a DNS query error
             local service = bp.services:insert({
               name = "inexist-host-service",
-              host = "really-inexist-host",
+              host = "really-inexist-host.test",
               port = 80,
             })
 
@@ -558,7 +558,7 @@ for _, strategy in helpers.each_strategy() do
           local dns_spans = assert_has_spans("kong.dns", spans)
           local upstream_dns
           for _, dns_span in ipairs(dns_spans) do
-            if dns_span.attributes["dns.record.domain"] == "really-inexist-host" then
+            if dns_span.attributes["dns.record.domain"] == "really-inexist-host.test" then
               upstream_dns = dns_span
               break
             end