sveltemail

← All guides

DNS record types explained

A, AAAA, CNAME, MX, TXT, NS, CAA, SOA and SRV: what each DNS record is for, with examples you can look up yourself.

A DNS zone is a list of records, and every record answers one narrow question about a name. What address is this? Where does its mail go? Who is allowed to issue a certificate for it? Once you know which type answers which question, a zone file stops looking like noise.

The examples below are written the way a zone file and most lookup tools show them: name, TTL in seconds, class (always IN), type, then the data. To compare them with a real domain, run one through the DNS lookup tool, which asks for eight of these types at once.

Records that point a name at a server

A and AAAA

An A record maps a name to an IPv4 address. An AAAA record does the same for IPv6. These are the records a browser ultimately needs before it can connect to anything.

example.com.      3600  IN  A     192.0.2.10
example.com.      3600  IN  AAAA  2001:db8::10

A name can have several of each. Clients pick among them, which is the simplest form of load balancing. If you publish an AAAA record, make sure the server really answers over IPv6. Clients that prefer IPv6 will try it first, and a dead address shows up as a slow or failing site for some visitors only.

CNAME

A CNAME says “this name is an alias for that name”. The resolver restarts the lookup at the target and returns whatever it finds there.

www.example.com.  3600  IN  CNAME  example.com.

It is the right record when someone else controls the address: a hosting platform or CDN gives you a hostname, you alias your name to it, and they can change the IP behind it without asking you. A CNAME always points at a name, never at an IP address, and it carries two rules that are covered further down.

Records for mail

MX

MX records name the servers that accept mail for a domain. Each has a preference number. Senders try the lowest number first and fall back to higher ones if it is unreachable.

example.com.      3600  IN  MX  10 mail1.example.com.
example.com.      3600  IN  MX  20 mail2.example.com.
mail1.example.com. 3600 IN  A   192.0.2.25
mail2.example.com. 3600 IN  A   192.0.2.26

The numbers only matter relative to each other. Two records with the same preference share the load.

TXT

A TXT record holds free-form text. Nothing in DNS interprets it. Other systems do, by agreeing on what the text should look like. Its main jobs today are email authentication and proving to a service that you control a domain.

example.com.         3600  IN  TXT  "v=spf1 mx -all"
_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"

The first line is an SPF policy that says only the domain's MX hosts may send its mail. The second is a DMARC policy, which always lives at the _dmarc label. The guide to SPF, DKIM and DMARC explains how to read both.

A single string inside a TXT record is limited to 255 characters. Longer values, such as large DKIM keys, are split into several quoted strings in one record, and the reader joins them back together with nothing in between.

Records that describe the zone itself

NS

NS records list the nameservers that are authoritative for the zone: the servers that hold the real copy of its records.

example.com.      86400  IN  NS  ns1.example.net.
example.com.      86400  IN  NS  ns2.example.net.

They exist in two places. The parent zone (for example.com, the .com registry) holds a copy so resolvers know where to go, and the zone holds its own copy. The two should match. The parent's copy is the one you change at your registrar when you move DNS providers.

SOA

Every zone has exactly one SOA (start of authority) record at its top. It is housekeeping data.

example.com.  3600  IN  SOA  ns1.example.net. hostmaster.example.com. (
                  2026111101  ; serial
                  7200        ; refresh
                  3600        ; retry
                  1209600     ; expire
                  3600 )      ; negative-caching TTL

The first name is the primary nameserver. The second is a contact mailbox with the @ written as a dot, so this one means [email protected]. The serial is a version number that goes up when the zone changes. Refresh, retry and expire tell secondary nameservers how often to check for updates. The last value controls how long resolvers remember that a name does not exist, which matters more than it sounds when you are waiting for a new record to appear. The guide on why DNS changes take time covers that.

CAA

A CAA record names the certificate authorities that are allowed to issue certificates for the domain.

example.com.  3600  IN  CAA  0 issue "ca.example.net"
example.com.  3600  IN  CAA  0 issuewild ";"
example.com.  3600  IN  CAA  0 iodef "mailto:[email protected]"

Here one authority may issue ordinary certificates, nobody may issue wildcards, and violations should be reported to the mailbox. Certificate authorities check CAA before they issue. Browsers do not check it when you visit a site. With no CAA record anywhere between the name and the top of the domain, any authority may issue.

SRV: a service, a host and a port

Most records assume a well-known port. SRV is for protocols that want DNS to say where the service runs, port included. The name encodes the service and the transport.

_sip._tcp.example.com.  3600  IN  SRV  10 60 5060 sip.example.com.

The four values are priority, weight, port and target. Priority works like MX preference: lowest first. Weight splits traffic among targets with the same priority. Because SRV records live under underscore-prefixed names like this one, a lookup of the bare domain usually returns none.

The rules people trip over

  • A CNAME cannot share a name with other records. If www.example.com is a CNAME, it cannot also have an A, MX or TXT record. The alias means “everything about this name is over there”, so anything else at the same name is a contradiction. The usual casualty is mail: put a CNAME on a name and its MX records stop being valid.
  • No CNAME at the apex. The top of the zone, example.com itself, always has SOA and NS records, so by the previous rule it cannot be a CNAME. When a host tells you to point your bare domain at a hostname, use the feature your DNS provider offers for it, usually called ALIAS, ANAME or CNAME flattening. The provider resolves the target itself and answers with plain A and AAAA records.
  • MX and NS must point at hostnames. Writing an IP address as an MX target is invalid, even though some control panels accept it. The target should be a name with its own A or AAAA record, and it should not be a CNAME.
  • The trailing dot matters in zone files. A name ending in a dot is complete. A name without one has the zone name appended, so mail.example.com without the dot can silently become mail.example.com.example.com. Web control panels differ on this, so check the result with a lookup after saving.
  • One SPF record per name. A domain can have many TXT records, but only one that starts with v=spf1. Two SPF records make the policy an error, not a merge. Combine them into one.

Reading a real lookup

A few things to expect when you look up your own domain. The lookup tool does not ask for CNAME on its own. When a name is an alias, the resolver follows it, and the CNAME shows up inside the A or AAAA results along with the addresses at the end of the chain. Types with no records are left out, so a subdomain often shows only an address.

The TTL column will rarely match what you configured. The answer comes from a caching resolver, so the number is the time left on its cached copy, and it counts down between lookups. If you have just changed a record and still see the old value, that countdown is how long this resolver will keep serving it.