DNS turns a name into an address, and a handful of record types cover almost everything you will ever set. This guide explains each one and how to verify it.
A and AAAA: name to address
A points a name at an IPv4 address. AAAA points the same name at an IPv6 address. They work together, not instead of each other.
example.com A 203.0.113.10 example.com AAAA 2001:db8:1:2::1
Set both. A visitor on an IPv6-only network cannot reach a server that has only an A record, and you will never see them in your logs to know it happened.
$ dig example.com A +short $ dig example.com AAAA +short
CNAME: name to another name
CNAME makes one name an alias of another. Use it when a service tells you to point at their hostname instead of an IP address. That way they can change addresses without telling you.
www.example.com CNAME example.com
Two rules that cause most CNAME problems:
- A name with a
CNAMEcannot have any other record. So the root of your domain (example.comwith no prefix) usually cannot be aCNAME, because it needsMXand other records. - A
CNAMEpointing at aCNAMEpointing at another works, but each hop costs a lookup. Keep chains short.
MX: where mail goes
MX says which server accepts mail for your domain. The number is the priority, and lower wins.
example.com MX 10 mail.example.com example.com MX 20 backup.example.com
MX must point at a hostname, never at an IP address. That hostname needs its own A and AAAA records.
TXT: notes that machines read
TXT holds free text, and mail security uses it for three things:
- SPF lists which servers may send mail as your domain.
- DKIM holds the public key that signs your outgoing mail.
- DMARC tells receiving servers what to do when SPF or DKIM fails.
example.com TXT "v=spf1 mx -all" _dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:[email protected]"
That SPF record means "the servers in my MX records may send my mail, reject everything else." Start DMARC at p=none, which only reports, and tighten it once the reports look clean.
PTR: address back to name
PTR is the reverse of A and AAAA: it maps an IP address back to a hostname. You cannot set it at your DNS provider, because it belongs to whoever owns the IP address. On a VPS, that is your host, and it is usually a setting in the control panel.
PTR matters for one thing above all: sending mail. Receiving servers check that your IP resolves to a hostname, and that the hostname resolves back to the same IP. Our reverse DNS guide covers setting it.
$ dig -x 203.0.113.10 +shortNS and SOA: who is in charge
NS records name the servers that answer for your domain, and SOA holds administrative details about the zone. Your DNS provider manages both. You will rarely touch them, except when moving a domain to a new provider.
TTL: how long answers are cached
Every record has a TTL in seconds. A TTL of 3600 means resolvers keep the answer for an hour, so a change you make now may take an hour to reach everyone.
Lower the TTL to 300 a day before you plan to change a record, then raise it afterwards. That is the difference between a five minute switch and an all day one.
"It is not working" is usually cache
After changing a record, your own computer, your router, and your provider's resolver may all hold the old answer. Check with dig @1.1.1.1 example.com +short to query a public resolver directly and bypass your local cache.
Quick reference
| Record | Points to | Common use |
|---|---|---|
| A | IPv4 address | Your website |
| AAAA | IPv6 address | Your website, on IPv6 |
| CNAME | Another name | Aliases, third party services |
| MX | Mail server hostname | Receiving mail |
| TXT | Text | SPF, DKIM, DMARC |
| PTR | Hostname | Reverse lookup, sending mail |
Where to go next
Set both A and AAAA for every name you use. If you plan to send mail, do PTR and SPF before your first send, because a fresh IP with neither is treated as spam by default.