DNS Record Types Explained

DNS records are instructions that tell the internet how to handle requests for your domain. Each record type serves a specific purpose. This reference applies wherever your domain's DNS is hosted. For how to add records, see How DNS Records Work.

Quick Reference

A Record (Address)

Purpose: Maps a domain or subdomain to an IPv4 address.

When to use: Pointing your domain to a web server, API server, or any IPv4 address.

Common examples:

# Root domain to server
@       A    76.76.21.21         (Vercel)
@       A    75.2.60.5           (Netlify)
@       A    185.199.108.153     (GitHub Pages)

# Subdomains
www     A    192.0.2.1
api     A    192.0.2.50
mail    A    192.0.2.25

Notes:

• Use @ for the root domain (e.g., example.com)
• You can have multiple A records for load balancing
• Lower TTL (300) for records you change frequently

AAAA Record (IPv6 Address)

Purpose: Maps a domain to an IPv6 address.

When to use: When your server supports IPv6 and you want to enable IPv6 access.

Common examples:

# Cloudflare IPv6
@       AAAA    2606:4700:3030::ac43:8cd8

# GitHub Pages IPv6
@       AAAA    2606:50c0:8000::153
@       AAAA    2606:50c0:8001::153
@       AAAA    2606:50c0:8002::153
@       AAAA    2606:50c0:8003::153

Notes:

• IPv6 addresses use colons, not dots
• Many hosting providers give you IPv6 addresses alongside IPv4
• Good practice to add both A and AAAA records for dual-stack support

CNAME Record (Canonical Name)

Purpose: Creates an alias pointing to another domain name (not an IP).

When to use: Subdomains that should follow another domain's DNS, or when using hosting platforms.

Common examples:

# WWW to root domain
www         CNAME    example.com

# Platform hosting
blog        CNAME    example.ghost.io
docs        CNAME    example.gitbook.io
status      CNAME    example.statuspage.io

# Vercel / Netlify
www         CNAME    cname.vercel-dns.com
www         CNAME    example.netlify.app

Notes:

• CNAME cannot be used on the root domain (@) — use A record instead
• CNAME points to a domain name, never an IP address
• When the target's IP changes, your CNAME automatically follows

MX Record (Mail Exchange)

Purpose: Specifies which mail servers receive email for your domain.

When to use: Setting up email with Google Workspace, Microsoft 365, or any email provider.

Common email providers:

# Google Workspace
@    MX    1     aspmx.l.google.com
@    MX    5     alt1.aspmx.l.google.com
@    MX    5     alt2.aspmx.l.google.com
@    MX    10    alt3.aspmx.l.google.com
@    MX    10    alt4.aspmx.l.google.com

# Microsoft 365
@    MX    0     example-com.mail.protection.outlook.com

# Zoho Mail
@    MX    10    mx.zoho.com
@    MX    20    mx2.zoho.com
@    MX    50    mx3.zoho.com

# ProtonMail
@    MX    10    mail.protonmail.ch
@    MX    20    mailsec.protonmail.ch

Notes:

• Lower priority number = higher preference (mail tries 1 before 5)
• Always add multiple MX records for redundancy
• MX records must point to domain names, not IP addresses

TXT Record (Text)

Purpose: Stores text data for various verification and security purposes.

When to use: Domain verification, email authentication (SPF, DKIM, DMARC), or site verification.

SPF (Sender Policy Framework)

Tells email servers which IPs can send email on your behalf:

# Google Workspace only
@    TXT    "v=spf1 include:_spf.google.com ~all"

# Google + Mailchimp
@    TXT    "v=spf1 include:_spf.google.com include:servers.mcsv.net ~all"

# Multiple services
@    TXT    "v=spf1 include:_spf.google.com include:sendgrid.net include:mailgun.org ~all"

DKIM (DomainKeys Identified Mail)

Cryptographic signature to verify email authenticity:

# Google Workspace DKIM (selector: google)
google._domainkey    TXT    "v=DKIM1; k=rsa; p=MIGfMA0GCS..."

DMARC (Domain-based Message Authentication)

Policy for handling email that fails SPF/DKIM:

# Monitor only (recommended to start)
_dmarc    TXT    "v=DMARC1; p=none; rua=mailto:[email protected]"

# Quarantine failures
_dmarc    TXT    "v=DMARC1; p=quarantine; rua=mailto:[email protected]"

# Reject failures (strict)
_dmarc    TXT    "v=DMARC1; p=reject; rua=mailto:[email protected]"

Domain Verification

# Google Search Console
@    TXT    "google-site-verification=abc123xyz..."

# Facebook domain verification
@    TXT    "facebook-domain-verification=abc123..."

# Stripe domain verification
@    TXT    "stripe-verification=abc123..."

# Let's Encrypt (DNS-01 challenge)
_acme-challenge    TXT    "gfj9Xq...random-string..."

NS Record (Nameserver)

Purpose: Delegates DNS authority to specific nameservers.

When to use: Changing where your DNS is managed, or delegating subdomains.

Common nameservers:

# Cloudflare
@    NS    ada.ns.cloudflare.com
@    NS    bob.ns.cloudflare.com

# AWS Route 53
@    NS    ns-123.awsdns-45.com
@    NS    ns-678.awsdns-90.net
@    NS    ns-111.awsdns-22.org
@    NS    ns-333.awsdns-44.co.uk

# Subdomain delegation
staging    NS    ns1.dev-provider.com
staging    NS    ns2.dev-provider.com

Notes:

• NS records for the domain itself are set at your registrar, not in the zone: see Understanding Nameservers
• NS changes can take 24-48 hours to propagate fully
• Always set at least 2 nameservers for redundancy
• Changing NS means managing DNS at the new provider
• You can delegate subdomains to different nameservers

CAA Record (Certificate Authority Authorization)

Purpose: Specifies which Certificate Authorities can issue SSL certificates for your domain.

When to use: Restricting who can issue certificates (security best practice).

Common configurations:

# Let's Encrypt only
@    CAA    0 issue "letsencrypt.org"
@    CAA    0 issuewild "letsencrypt.org"

# No wildcard certificates allowed
@    CAA    0 issue "letsencrypt.org"
@    CAA    0 issuewild ";"

# Report violations
@    CAA    0 iodef "mailto:[email protected]"

Tags explained:

• issue — Authorizes CA to issue standard certificates
• issuewild — Authorizes CA to issue wildcard certificates
• iodef — Email/URL for violation reports

Notes:

• If no CAA records exist, any CA can issue certificates
• Semicolon (;) as value means "no CA allowed"
• Most CAs check CAA before issuing certificates

Less Common Record Types

SRV Record (Service)

Specifies location of services (used by some apps like Microsoft Teams, Minecraft servers):

# Microsoft Teams / Skype for Business
_sip._tls           SRV    100 1 443 sipdir.online.lync.com
_sipfederationtls._tcp    SRV    100 1 5061 sipfed.online.lync.com

# Minecraft server
_minecraft._tcp     SRV    0 5 25565 mc.example.com

PTR Record (Pointer)

Reverse DNS — maps IP address to domain name. Usually managed by your hosting provider.

SOA Record (Start of Authority)

Contains administrative info about your DNS zone. Automatically managed by your DNS provider.

TTL Guidelines

TTL (Time To Live) is how long DNS resolvers cache a record (in seconds):

Rule of thumb:

• Lower TTL = faster propagation, more DNS queries
• Higher TTL = slower propagation, less DNS load
• Before making changes, lower TTL first, wait for old TTL to expire, then change

Troubleshooting

"Record already exists" You may need to edit the existing record instead of creating a new one. List the current records first.

"Invalid record format" Check your value matches the expected format for that record type (IP for A, domain for CNAME, etc.)

"CNAME at root domain" CNAME cannot be used on @. Use an A record, or some providers offer ALIAS/ANAME as alternatives.

"SPF record not working" Only one SPF record allowed per domain. Combine multiple services into one record.

Changes not propagating? Check whatsmydns.net — propagation can take minutes to 48 hours depending on TTL.