diff --git a/CHANGELOG.md b/CHANGELOG.md
index 52a16ea..902c337 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -24,6 +24,7 @@ Web:
 * The nginx server no longer reports its version and OS for better privacy.
 * The HTTP->HTTPS redirect is now more efficient.
 * When serving a 'www.' domain, reuse the SSL certificate for the parent domain if it covers the 'www' subdomain too
+* If a custom DNS CNAME record is set on a domain, don't offer to put a website on that domain. (Same logic already applies to custom A/AAAA records.)
 
 Control panel:
 
diff --git a/management/web_update.py b/management/web_update.py
index 98fa8ab..b088c55 100644
--- a/management/web_update.py
+++ b/management/web_update.py
@@ -27,6 +27,7 @@ def get_web_domains(env):
 	for domain, value in dns.items():
 		if domain not in domains: continue
 		if (isinstance(value, str) and (value != "local")) \
+		  or (isinstance(value, dict) and ("CNAME" in value)) \
 		  or (isinstance(value, dict) and ("A" in value) and (value["A"] != "local")) \
 		  or (isinstance(value, dict) and ("AAAA" in value) and (value["AAAA"] != "local")):
 			domains.remove(domain)