document CNAME hack for cases where one can not directly update the zone