The DNS panel at your registrar or hosting provider often looks like a table of cryptic rows. Each row is a record, and each record type answers a different question: where the site lives, who receives the mail, who is allowed to issue certificates. Understanding the main types lets you edit a zone without breaking anything.
The structure of a record
Every record has four elements:
- name: the domain or subdomain it refers to (
@often stands for the main domain); - type: A, CNAME, MX and so on;
- TTL: how many seconds it may stay cached;
- value: the content, which depends on the type.
In standard text format, a line looks like this:
www.example.com. 3600 IN A 203.0.113.10
Records for reaching a service
A and AAAA
An A record maps a name to an IPv4 address, an AAAA record to an IPv6 address. A name can have several records of the same type: the resolver returns all of them and the client picks one, a basic form of load distribution.
CNAME
A CNAME says that one name is an alias for another. For example shop.example.com can point to store.platform.com: the resolver follows the alias and looks up the address of the final name. It is handy when the external service changes its addresses without notice.
Two rules to remember:
- a name that has a CNAME cannot have any other records of any type;
- for this reason the apex domain (
example.com) cannot be a CNAME, because it must have at least SOA and NS records.
Many DNS providers offer proprietary workarounds for the second limit, with names like ALIAS, ANAME or "CNAME flattening": the server resolves the alias internally and returns a normal A record.
SRV
An SRV record specifies the host and port of a particular service, with priority and weight. It is used by protocols such as SIP for telephony, XMPP and some corporate directory services.
Records for email
The MX record lists which servers receive mail for the domain, each with a numeric priority: the lowest value is preferred. An MX must point to a name that has A or AAAA records, not to a bare IP address or a CNAME.
Several TXT records also matter for mail, publishing the domain's authentication policies (SPF, DKIM and DMARC). Without them, messages sent from the domain are likely to end up in spam.
TXT: the container for everything else
A TXT record holds free text. Besides mail policies, it is used to:
- prove domain ownership to external services (search engines, cloud platforms, certificates);
- publish keys and configuration information.
Multiple TXT records can coexist on the same name. SPF is the exception: a domain must have only one SPF record, otherwise validation fails.
Records that define the zone
- NS lists the domain's authoritative servers. The NS records at the TLD registry (the delegation) must match those inside the zone.
- SOA (Start of Authority) contains the zone parameters: primary server, administrator contact, serial number and refresh timers, including the negative caching time.
If you change DNS provider, the actual switch happens when you update the NS servers at the registrar. Before doing so, recreate every record in the new zone: otherwise website and email stop working as soon as the delegation changes.
CAA: who may issue certificates
A CAA record states which certificate authorities are allowed to issue TLS certificates for the domain. Authorities are required to check it before issuing. Example:
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
It is a simple, effective protection against certificates being issued by authorities you do not use.
A typical zone at a glance
| Name | Type | Value | Purpose |
|---|---|---|---|
| @ | A | 203.0.113.10 | Main website |
| @ | AAAA | 2001:db8::10 | Website over IPv6 |
| www | CNAME | example.com. | Website alias |
| @ | MX | 10 mx1.example.com. | Incoming mail |
| @ | TXT | v=spf1 ... | SPF policy |
| @ | CAA | 0 issue "letsencrypt.org" | Authorised certificates |
Frequent mistakes
- Forgetting the trailing dot in fully qualified names, in panels that require it:
mx1.example.comcan turn intomx1.example.com.example.com. - Creating a CNAME on a name that already has other records.
- Leaving records that point to retired services: a subdomain pointing to a deleted cloud resource can be claimed by someone else (so-called subdomain takeover). Clean up regularly.
- Duplicating the SPF record.
In short
- A and AAAA link a name to an address; CNAME creates an alias and cannot coexist with other records.
- MX points to mail servers; TXT hosts verifications and policies such as SPF.
- NS and SOA define the zone and its delegation: change them only after recreating the records.
- CAA restricts which authorities can issue certificates for the domain.
- Remove orphaned records so forgotten subdomains cannot be abused.
