fren
Log In

Understanding DNS records

2 min read07 November 2026

Each DNS record type answers a specific question. Choosing the wrong type, or placing a record in the wrong spot, causes a silent outage: the domain exists, but the service does not answer.

The essential types

Type Purpose Example value Common trap
A name to IPv4 192.0.2.10 stale address after a migration
AAAA name to IPv6 2001:db8::10 AAAA added but port closed
CNAME alias to another name www to your-domain.com. not allowed at the apex
MX mail server 10 mail.your-domain.com. priority omitted
TXT free text SPF, DKIM, DMARC, verification conflicting SPF records
SRV service, host and port _sip._tcp target without an A record
CAA allowed certificate authorities 0 issue "letsencrypt.org" blocks issuance
NS zone delegation ns1.provider.com. editing the zone at the wrong provider

Example addresses come from documentation ranges and must not be copied as-is.

Zone example

Text
your-domain.com.           3600 IN A     192.0.2.10
your-domain.com.           3600 IN AAAA  2001:db8::10
www.your-domain.com.       3600 IN CNAME your-domain.com.
your-domain.com.           3600 IN MX    10 mail.your-domain.com.
your-domain.com.           3600 IN TXT   "v=spf1 mx -all"
_dmarc.your-domain.com.    3600 IN TXT   "v=DMARC1; p=quarantine"
_sip._tcp.your-domain.com. 3600 IN SRV   10 5 5060 sip.your-domain.com.
your-domain.com.           3600 IN CAA   0 issue "letsencrypt.org"

The trailing dot marks an absolute name. Without it, some tools append the current domain and produce your-domain.com.your-domain.com.

Rules to remember

  • A CNAME cannot coexist with another record on the same name. At the apex, use A and AAAA, or an ALIAS/ANAME type if your provider offers one.
  • An MX points to a hostname, not an IP address, and that hostname needs an A or AAAA. The lowest priority is tried first.
  • One SPF record per domain. Two v=spf1 records cause validation to fail.
  • For DKIM, the key goes under a name such as selector._domainkey. Do not edit it by hand without reason.
  • For DMARC, start with p=none for observation, then tighten.
  • A misplaced CAA blocks certificate issuance: check it before blaming the host.

TTL and changes

A TTL of 3600 is a good balance in steady state. During a migration, drop to 300 the day before, make the change, then raise it gradually. A permanently low TTL increases query volume with no real benefit.

Verify

Bash
dig A your-domain.com +short
dig AAAA your-domain.com +short
dig MX your-domain.com +short
dig TXT your-domain.com +short
dig CAA your-domain.com +short

Also query a public resolver with @1.1.1.1 to separate a zone error from a local cache. After a change, check the actual service: a correct A record does not prove the port is open or that the certificate matches the name.

Advertisement

Was this article helpful?

Read next