DNS records are the instructions that turn a domain name into an address, a mail route, or a security policy. This guide covers the seven record types you will actually touch day to day — A, AAAA, CNAME, MX, TXT, NS and CAA — with a copy-pasteable example and the RFC behind each. If you only remember one thing: a CNAME can never share a name with another record, which is why you cannot put one at the zone apex.
Every record shares the same anatomy: an owner name, a TTL, a class (almost always IN for Internet), a type, and type-specific data. TTL (time to live) is a 32-bit value in seconds, per RFC 1035, that tells resolvers how long to cache the answer. Set it low (300s) before a migration and higher (3600s+) once things are stable.
You can inspect any of these live with our free DNS lookup tool before and after a change.
Quick reference table
| Type | Code | Purpose | Standard |
|---|---|---|---|
| A | 1 | Hostname → IPv4 | RFC 1035 |
| AAAA | 28 | Hostname → IPv6 | RFC 3596 |
| CNAME | 5 | Alias → canonical name | RFC 1034/2181 |
| MX | 15 | Mail routing | RFC 1035/5321 |
| TXT | 16 | Arbitrary text (SPF/DKIM/DMARC) | RFC 1035 |
| NS | 2 | Zone delegation | RFC 1034 |
| CAA | 257 | Which CAs may issue certs | RFC 8659 |
A record: name to IPv4
An A record maps a hostname to a single 32-bit IPv4 address. It is the most common record on the internet and the one most people mean when they say "point the domain at the server."
example.com. 3600 IN A 203.0.113.10
www.example.com. 3600 IN A 203.0.113.10
You can add multiple A records for the same name to spread traffic across several IPs (basic DNS round-robin). DNS does not health-check those IPs, so round-robin is load spreading, not failover.
AAAA record: name to IPv6
AAAA ("quad-A") is the IPv6 equivalent of an A record, defined in RFC 3596. It maps a hostname to a 128-bit IPv6 address. Publish both A and AAAA for a dual-stack host — clients pick the protocol they prefer.
example.com. 3600 IN AAAA 2001:db8::10
CNAME record: alias to a canonical name
A CNAME points one name at another (the canonical name), and the resolver then looks up records on the target. It is ideal for pointing www or a CDN subdomain at a hostname you do not control the IP of.
www.example.com. 3600 IN CNAME example.com.
cdn.example.com. 3600 IN CNAME d1234.cloudfront.net.
Two rules trip people up constantly:
- A CNAME cannot coexist with any other record for the same name (RFC 1034 §3.6.2, RFC 2181 §10.1). Because the zone apex must carry SOA and NS records, you cannot put a CNAME at the apex (
example.comitself). - NS and MX targets should not point at a CNAME (RFC 2181 §10.3). Point them at real A/AAAA hostnames.
To get apex-alias behaviour, providers offer non-standard features — Cloudflare's CNAME flattening, Route 53 Alias records, and ANAME/ALIAS at some registrars. These resolve the target and serve the resulting IP at the apex. Check your provider's docs for the exact behaviour.
MX record: routing mail
MX (mail exchange) records tell sending servers where to deliver mail, per RFC 5321. Each MX has a 16-bit preference value and a mail-server hostname. Lower preference wins — it is the highest-priority server.
example.com. 3600 IN MX 10 mail1.example.com.
example.com. 3600 IN MX 20 mail2.example.com.
The exchange must be a hostname that resolves to A/AAAA, never a raw IP, and should not be a CNAME. If a domain sends and receives no mail, publish a null MX (RFC 7505): a single record with preference 0 and target .:
example.com. 3600 IN MX 0 .
Check what's live with our free MX lookup tool.
TXT record: SPF, DKIM, DMARC and verification
TXT records hold free-form text. Each string is capped at 255 octets, but a single record can carry multiple concatenated strings, so long policies get split into 255-octet chunks. TXT is the workhorse for email authentication and domain verification.
example.com. 3600 IN TXT "v=spf1 include:_spf.google.com -all"
default._domainkey... 3600 IN TXT "v=DKIM1; k=rsa; p=MIGfMA0..."
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=reject; rua=mailto:[email protected]"
Note that SPF (RFC 7208) uses a TXT record — the dedicated SPF record type (99) is deprecated. Build valid records with our SPF generator and DMARC generator.
NS record: delegating a zone
NS (name server) records list the authoritative servers for a zone and are required at the apex. They exist both in the parent zone (the delegation) and in your own zone. RFC 2182 recommends at least two topologically diverse authoritative servers.
example.com. 86400 IN NS ns1.example-dns.net.
example.com. 86400 IN NS ns2.example-dns.net.
When the nameserver lives inside the zone it serves (in-bailiwick), the parent must publish glue records — A/AAAA records for the nameserver hostnames — to avoid a lookup loop.
CAA record: controlling certificate issuance
CAA (Certification Authority Authorization), defined in RFC 8659, lets you specify which Certificate Authorities may issue TLS certificates for your domain. CAs are required by the CA/Browser Forum Baseline Requirements to check CAA at issuance time and walk up the DNS tree if no record exists at the exact name.
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
example.com. 3600 IN CAA 0 issuewild ";"
example.com. 3600 IN CAA 0 iodef "mailto:[email protected]"
The three property tags are issue (allowed CA for standard certs), issuewild (wildcards), and iodef (a URL for reporting policy violations). RFC 8657 adds accounturi and validationmethods parameters to pin issuance to a specific ACME account. A value of ; means "issue nothing" for that tag.
After changing CAA, verify your certificate chain still validates with our free SSL check.
Managing these record types across several registrars gets messy fast — our DNS management keeps every zone in one place with a consistent editor.
Frequently asked questions
- Why can't I create a CNAME at my domain's apex?
- A CNAME cannot coexist with any other record for the same name (RFC 1034/2181), and the zone apex must already carry SOA and NS records. To get apex-alias behaviour, use a provider feature like CNAME flattening, Route 53 Alias, or ANAME/ALIAS.
- What TTL should I set on a DNS record?
- Use a low TTL such as 300 seconds before a planned change so caches expire quickly, then raise it to 3600 seconds or more once the record is stable to reduce lookup load. TTL is a 32-bit value in seconds under RFC 1035.
- Do I still need a separate SPF record type?
- No. The dedicated SPF DNS record type (code 99) is deprecated. Publish SPF as a TXT record per RFC 7208, and do the same for DKIM and DMARC.
- What does a null MX record do?
- A null MX (RFC 7505) is a single MX record with preference 0 and the target '.', signalling that the domain accepts no email. It lets sending servers fail fast instead of retrying delivery.
