Delimiter.live
18 entries

DNS Record Types

A DNS record maps a name to a value. A and AAAA point at IP addresses, CNAME makes one name an alias for another, MX routes mail, TXT carries verification and policy data such as SPF and DKIM, NS delegates a zone, and SOA holds the zone metadata. Each record has a TTL controlling how long resolvers may cache it.

Most DNS problems come down to using the wrong record type, or to a TTL that is longer than you remembered. The record types themselves are stable and few — the list below covers essentially everything a working developer meets.

The one rule worth internalising: a CNAME cannot coexist with any other record at the same name. That is why you cannot put a CNAME at a zone apex, because the apex must already carry SOA and NS records.

Address and alias records

4 entries

Where a name points.

Type Purpose Value Notes
A Maps a name to an IPv4 address 203.0.113.10 The most common record type. Multiple A records for one name give simple round-robin load spreading.
AAAA Maps a name to an IPv6 address 2001:db8::1 Named for being four times the size of an A record. Serve both A and AAAA for a dual-stack site.
CNAME Makes a name an alias for another name target.example.com. Cannot coexist with other records at the same name, so it cannot be used at a zone apex. Resolvers then look up the target.
ALIAS / ANAME Apex-safe alias target.example.com. Not a standard record type. A provider-specific feature that resolves the target and serves the result as an A record.

Mail records

4 entries

Where mail for a domain goes, and which senders are authorised.

Type Purpose Value Notes
MX Routes mail for the domain 10 mail.example.com. Carries a priority; lower is preferred. Equal priorities share load. The target must be a name, never an IP address.
TXT (SPF) Lists authorised sending hosts v=spf1 include:_spf.example.com -all There is no dedicated SPF record type — the old one was deprecated. Only one SPF TXT record per domain is permitted.
TXT (DKIM) Publishes a signing public key v=DKIM1; k=rsa; p=MIGfMA0… Published at selector._domainkey.example.com. The selector lets you rotate keys.
TXT (DMARC) Policy for SPF and DKIM failures v=DMARC1; p=quarantine; rua=mailto:… Published at _dmarc.example.com. Start with p=none to collect reports before enforcing.

Zone and service records

10 entries

Delegation, metadata and everything else.

Type Purpose Value Notes
NS Delegates a zone to nameservers ns1.example.com. Must be present at the zone apex. Changing these at the registrar is what moves DNS hosting.
SOA Zone metadata ns1.example.com. admin.example.com. 2026080701 … One per zone. Holds the serial number, refresh and retry timers, and the negative-caching TTL.
TXT Arbitrary text google-site-verification=… Also used for domain ownership verification by most platforms. A single record is limited to 255 characters per string.
SRV Locates a service 10 5 5060 sip.example.com. Priority, weight, port and target. Used by SIP, XMPP, Minecraft and Active Directory rather than the web.
CAA Restricts which CAs may issue certificates 0 issue "letsencrypt.org" A cheap, under-used control. Without it, any public CA may issue for your domain.
PTR Maps an IP address back to a name mail.example.com. Reverse DNS, published by whoever controls the IP block rather than by you. Mail servers check it.
HTTPS / SVCB Advertises connection parameters 1 . alpn="h3,h2" Lets a client learn about HTTP/3 support and the real endpoint before connecting, saving a round trip. Increasingly used for apex aliasing.
DS Delegation signer, for DNSSEC 12345 13 2 A1B2C3… Published in the parent zone to link it to your signed zone. Getting this wrong takes the whole domain offline for validating resolvers.
DNSKEY Public key for DNSSEC 257 3 13 mdsswUyr… Published in your own zone. Resolvers use it to verify the zone signatures.
TLSA Pins a certificate via DANE 3 1 1 A1B2C3… Requires DNSSEC to be meaningful. Used mainly for SMTP transport security rather than the web.

Notes

  • A trailing dot makes a name fully qualified. Without it, most zone file formats append the zone name — which is how you end up with mail.example.com.example.com.
  • The TTL is how long a resolver may cache an answer, in seconds. Lower it well before a planned migration, not on the day.
  • Negative answers are cached too, using the minimum field from the SOA record. That is why a newly created record can appear missing for a while after you first queried it too early.

Frequently asked questions

Why can I not use a CNAME at my domain apex?
Because a CNAME may not coexist with any other record at the same name, and the apex must carry SOA and NS records. Providers work around this with ALIAS or ANAME records, which are non-standard features that resolve the target and serve an A record instead.
How long until a DNS change takes effect?
Up to the TTL of the record you replaced, because resolvers may serve the cached answer until it expires. A record with a TTL of 86400 can serve the old value for a full day, no matter how correct the new one is.
Which record type holds SPF?
TXT. A dedicated SPF record type existed briefly and was deprecated in 2014 because adoption was poor. SPF, DKIM and DMARC all live in TXT records now.
Do I need both A and AAAA records?
Only if you want the site reachable over IPv6, which is increasingly worth having — some mobile networks are IPv6-only with a translation layer. Serving both is the normal dual-stack arrangement.

Related tools

All tools →
All references →

Last reviewed .