Networking

What are the different DNS record types?

DNS supports many record types, each serving different purposes. Learn about A, AAAA, CNAME, MX, TXT, NS, SRV, and CAA records and when to use each.

By Inventive HQ Team

Understanding DNS Record Types

The DNS record types you actually use day to day are a small set: A and AAAA map a name to an IPv4 or IPv6 address, CNAME aliases one name to another, MX routes email, TXT holds verification and email-authentication data (SPF, DKIM, DMARC), NS delegates a zone to nameservers, SRV advertises where a service lives, and CAA restricts which Certificate Authorities may issue TLS certificates. Everything else — PTR, SOA, ALIAS/ANAME, TLSA — is either managed automatically by your provider or reserved for a specific job like reverse DNS or DANE.

That's the summary an AI Overview gives you. What it can't show is when to reach for each record, how they interact at the zone apex, or how a query actually travels the DNS hierarchy to return your answer. Below is a decision table you can scan in seconds, an animated diagram of the resolution path, and a copy-paste checklist for standing up a domain correctly the first time.

The DNS Record Cheat Sheet

Use this table to pick the right record without reading the whole page. The "reach for it when" column is the one that matters.

RecordMaps / holdsReach for it when…Zone apex?Gotcha
AName → IPv4You have an IPv4 address to point a name atYesMultiple A records = round-robin, not failover
AAAAName → IPv6The host is reachable over IPv6 (dual-stack)YesMissing AAAA silently drops IPv6-only clients
CNAMEName → another nameA name should follow a CDN/SaaS hostnameNoCannot coexist with any other record on the name
ALIAS/ANAMEApex → another nameYou need CNAME-like behavior on the bare domainYesNon-standard; provider-specific (Cloudflare, Route 53)
MXDomain → mail host + priorityYou accept email at the domainYesLowest priority number wins; points to a name, never an IP
TXTFree textSPF, DKIM, DMARC, or domain verificationYes255-char string limit per chunk; quote-concatenate longer values
NSZone → nameserversDelegating a domain or subdomainYesApex NS set at the registrar, not in the zone file
SRV_service._proto → host + portAdvertising LDAP, SIP, XMPP, Exchange autodiscovern/aNeeds priority, weight, port, and target — all four
CAADomain → allowed CAsLocking down who can issue TLS certsYesCAs check the apex; omit it and any CA may issue
PTRIP → name (reverse)Running a mail server that needs valid rDNSn/aSet by whoever controls the IP block (your ISP/cloud)
SOAZone metadataNever manually — one per zone, auto-managedYesSerial must increase on every zone change
How a DNS query resolves example.com through the hierarchy A resolver queries the root server, then the .com TLD server, then the authoritative nameserver, which returns the A record; the client then connects to the returned IP address. Resolving example.com — one A-record query, four hops Resolver your ISP / 1.1.1.1 Root ( . ) "ask .com" .com TLD "ask their NS" Authoritative nameserver A record 192.0.2.1

answer cached for the record's TTL

Primary DNS Record Types

A Record (Address Record)

Purpose: Maps domain name to IPv4 address

Example:

inventivehq.com.    3600    A    192.0.2.1

Use cases:

  • Pointing domains to web servers
  • Setting up subdomains
  • Load balancing with multiple IPs

Format:

  • Domain name
  • TTL (time to live)
  • Record type (A)
  • IPv4 address (4 octets)

Common scenarios:

example.com        A    192.0.2.1
www.example.com    A    192.0.2.2
api.example.com    A    192.0.2.3

AAAA Record (IPv6 Address)

Purpose: Maps domain name to IPv6 address

Example:

inventivehq.com.    3600    AAAA    2001:db8::1

Use cases:

  • IPv6 support (increasingly important)
  • Dual-stack environments (both IPv4 and IPv6)
  • Future-proofing infrastructure

Format:

  • Domain name
  • TTL
  • Record type (AAAA)
  • IPv6 address (128-bit)

Increasingly critical: As IPv4 addresses become scarce, IPv6 adoption is accelerating.

CNAME Record (Canonical Name)

Purpose: Creates alias for domain

Example:

www.example.com    CNAME    example.com.
blog.example.com   CNAME    platform.example.com.

Use cases:

  • Creating subdomains that point to other domains
  • Simplifying domain management
  • Migrating services without changing primary domain

Important: CNAME must point to fully qualified domain name (ending with dot)

Common patterns:

www.example.com     CNAME    example.com
blog.example.com    CNAME    blogservice.com
mail.example.com    CNAME    mail.office365.com

Limitation: Cannot have CNAME at zone apex (example.com itself)

MX Record (Mail Exchange)

Purpose: Directs email to mail servers

Example:

example.com    10    MX    mail.example.com.
example.com    20    MX    mail2.example.com.

Use cases:

  • Routing email to mail servers
  • Setting up backup mail servers
  • Delegating email to email services

Priority: Lower number = higher priority (10 before 20)

Format:

  • Domain name
  • TTL
  • Record type (MX)
  • Priority (lower = higher)
  • Mail server hostname

Email delivery process:

Sending mail server queries MX records
Tries mail.example.com (priority 10) first
If unavailable, tries mail2.example.com (priority 20)
Connects to available mail server
Delivers message
Advertisement

TXT Record (Text Record)

Purpose: Stores text data for various purposes

Examples:

example.com    TXT    "v=spf1 include:_spf.google.com ~all"
example.com    TXT    "google-site-verification=abcd1234"

Common uses:

  • SPF: Specifies which IPs can send email
  • DKIM: Stores public key for email authentication
  • DMARC: Email authentication policy
  • Domain verification: Proving domain ownership
  • BIMI: Brand Indicator for Message Identification

SPF example:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

DKIM example:

selector1._domainkey    TXT    "v=DKIM1; k=rsa; p=MIGfMA0GCS..."

Format: Text enclosed in quotes, multiple TXT records supported

NS Record (Nameserver)

Purpose: Designates authoritative nameservers for domain

Example:

example.com    NS    ns1.example.com.
example.com    NS    ns2.example.com.

Use cases:

  • Delegating domain to specific nameservers
  • Setting up subdomains with separate nameservers
  • Pointing to registrar or DNS provider

Usually managed by: DNS provider or registrar

Important: Changes at registrar level, not in zone file

SRV Record (Service)

Purpose: Specifies location of services

Example:

_ldap._tcp.example.com    SRV    10 60 389 ldap.example.com.
_sip._udp.example.com     SRV    10 60 5060 sip.example.com.

Use cases:

  • Locating LDAP servers
  • SIP/VoIP services
  • Microsoft Exchange Auto-Discover
  • Kubernetes internal service discovery

Format:

  • Service name (underscore prefix)
  • Protocol (underscore prefix)
  • Domain
  • Priority (lower = preferred)
  • Weight (distribution among same priority)
  • Port
  • Target hostname

CAA Record (Certification Authority Authorization)

Purpose: Specifies which Certificate Authorities can issue certificates

Example:

example.com    CAA    0 issue "letsencrypt.org"
example.com    CAA    0 issuewild "letsencrypt.org"
example.com    CAA    0 iodef "mailto:admin@example.com"

Use cases:

  • Controlling who can issue SSL/TLS certificates
  • Preventing unauthorized certificate issuance
  • Security best practice for HTTPS

Flags:

  • 0: Non-critical
  • 128: Critical (CA must understand it)

Tags:

  • issue: CAs that can issue certificates
  • issuewild: CAs that can issue wildcard certificates
  • iodef: Violation reporting endpoint

Specialized and Less Common Records

ALIAS Record (ANAME)

Purpose: Like CNAME but works at zone apex

Not standard DNS: Offered by some providers (Cloudflare, Route 53)

Example:

example.com    ALIAS    target.example.com.

Benefit: Allows alias at root domain level (CNAME limitation workaround)

PTR Record (Pointer)

Purpose: Reverse DNS lookup (IP to domain)

Example:

1.2.0.192.in-addr.arpa    PTR    mail.example.com.

Use cases:

  • Email server identification
  • Reverse DNS verification
  • IP-to-domain mapping

Usually managed by: IP address provider or ISP

SOA Record (Start of Authority)

Purpose: Contains authoritative information about zone

Typically only one per domain, managed automatically by DNS provider

Contains:

  • Primary nameserver
  • Responsible person email
  • Serial number (version)
  • Refresh interval
  • Retry interval
  • Expire time
  • Negative caching TTL

TLSA Record (Transport Layer Security)

Purpose: Specifies TLS certificate details for DANE

Example:

_443._tcp.example.com    TLSA    3 1 1 [certificate hash]

Use cases:

  • DANE (DNS-based Authentication of Named Entities)
  • Enhanced TLS security
  • Certificate pinning via DNS

DNS Record Hierarchy and Defaults

Zone Apex Records

example.com.    A       192.0.2.1

The domain itself has specific rules:

  • Can have A, AAAA, MX, TXT records
  • Cannot have CNAME (in standard DNS)
  • Must have NS records (at registrar level)

Subdomain Records

www.example.com.        A       192.0.2.2
api.example.com.        A       192.0.2.3
mail.example.com.       MX      192.0.2.4

Subdomains can have any record type.

Wildcard Records

*.example.com.    A    192.0.2.99

Matches any subdomain without explicit record:

  • blog.example.com → 192.0.2.99
  • api.example.com → 192.0.2.99
  • anything.example.com → 192.0.2.99

Explicit records override wildcards.

Record Sets and Multiple Records

Multiple Records of Same Type

example.com    A    192.0.2.1
example.com    A    192.0.2.2
example.com    A    192.0.2.3

All returned in response (round-robin or as configured).

Multiple Record Types

example.com    A            192.0.2.1
example.com    MX     10    mail.example.com
example.com    TXT    "v=spf1 ~all"

All returned when queried for ANY record type.

Understanding TTL (Time To Live)

TTL affects how long records are cached:

example.com    3600    A    192.0.2.1
  • 3600: Seconds (1 hour)
  • 300: Seconds (5 minutes)
  • 86400: Seconds (1 day)

Short TTL (300): Changes propagate quickly, more DNS queries Long TTL (86400): Less DNS traffic, slower changes

Best practices:

  • Long TTL for stable records
  • Lower TTL before planned changes
  • Very low TTL (60-300) during troubleshooting

Common DNS Record Combinations

Basic Website

example.com        A        192.0.2.1
www.example.com    CNAME    example.com

Website with Email

example.com        A        192.0.2.1
example.com        MX    10    mail.example.com
mail.example.com   A        192.0.2.2
example.com        TXT    "v=spf1 include:mail.example.com ~all"

Email with DKIM and DMARC

example.com                    MX    10    mail.example.com
example.com                    TXT    "v=spf1 include:mail.example.com ~all"
selector1._domainkey.example.com    TXT    "v=DKIM1; p=[public key]"
_dmarc.example.com            TXT    "v=DMARC1; p=reject; rua=mailto:admin@example.com"

CDN Setup

example.com        A            192.0.2.1
example.com        A            192.0.2.2
www.example.com    CNAME        cdn.cloudflare.com

Testing DNS Records

Command-Line Tools

# Query specific record type
dig example.com A
dig example.com MX
dig example.com TXT
dig example.com AAAA

# Query all records
dig example.com ANY

# Trace DNS path
dig +trace example.com

# Query specific nameserver
dig @ns1.example.com example.com

Online Tools

  • Inventive HQ DNS Lookup Tool
  • MXToolbox
  • DNSChecker
  • Google Public DNS (dns.google)

New-Domain Setup Checklist

Work top to bottom when standing up a domain. Each line is one record decision.

  • NS records at the registrar point to your DNS provider (set these first — nothing else resolves until delegation is correct).
  • A record for the apex (example.com → server IPv4), plus AAAA if the host is dual-stack.
  • CNAME or A for www (CNAME to the apex or to a CDN hostname).
  • MX records if you receive email — point them at a hostname, never an IP, lowest priority first.
  • SPF TXT record (v=spf1 …) listing every service that sends mail as your domain — exactly one per domain.
  • DKIM TXT record at the selector your mail provider gives you (selector._domainkey).
  • DMARC TXT record at _dmarc.example.com, starting at p=none to monitor before you move to p=reject.
  • CAA record at the apex naming the CA you use (e.g. letsencrypt.org) to block unauthorized certificate issuance.
  • Lower TTLs to 300s on records you're about to change; raise them back once the change is verified.
  • Verify with dig (or the DNS Lookup tool) from outside your network before calling it done.

Best Practices

  1. Plan records before setup: Know all services you'll need
  2. Use appropriate TTL: Short for frequently-changing, long for stable
  3. Implement DMARC/DKIM/SPF: Essential email security
  4. Use CAA records: Prevent unauthorized certificate issuance
  5. Monitor propagation: Verify global availability after changes
  6. Document all records: Keep inventory of what you have
  7. Backup configurations: Save DNS settings regularly

Conclusion

DNS record types are diverse and serve many purposes. Understanding these types enables you to:

  • Configure domain infrastructure correctly
  • Set up email delivery properly
  • Implement security best practices
  • Troubleshoot DNS issues
  • Optimize domain performance

Whether managing a simple website, complex enterprise infrastructure, or email services, proper DNS configuration using appropriate record types is foundational to reliable internet connectivity.

Frequently Asked Questions

What is the difference between an A record and a CNAME record?

An A record maps a hostname directly to an IPv4 address (for example example.com to 192.0.2.1). A CNAME record maps one hostname to another hostname (an alias), and the resolver then looks up the target's A record. Use an A record when you have an IP address to point at; use a CNAME when you want a name to follow another name, such as www pointing at a CDN hostname. You cannot place a CNAME at the zone apex (the bare domain).

Can I use a CNAME record on my root domain?

No. Standard DNS forbids a CNAME at the zone apex because the apex must also carry SOA and NS records, and a CNAME cannot coexist with other records on the same name. To alias the root domain, use a provider-specific ALIAS or ANAME record (offered by Cloudflare, Route 53, and others), which resolves the target at query time and returns an A/AAAA answer.

What does the priority number in an MX record mean?

MX priority (also called preference) tells sending mail servers which mail exchanger to try first. The lowest number has the highest priority, so an MX with priority 10 is tried before one with priority 20. Equal-priority MX records are load-balanced. The value is arbitrary within 0 to 65535 — only the relative ordering matters.

Which DNS records do I need for email authentication?

Email authentication uses three TXT records: SPF (v=spf1 ...) lists the IP addresses and hosts allowed to send for your domain, DKIM publishes a public key at a selector subdomain to verify message signatures, and DMARC (_dmarc.example.com, v=DMARC1 ...) sets a policy telling receivers what to do when SPF or DKIM fails. All three are TXT records; DKIM lives under selector._domainkey.

What is a TTL and what value should I use?

TTL (time to live) is how many seconds resolvers may cache a record before re-querying. Use a long TTL such as 3600 (1 hour) or 86400 (1 day) for stable records to cut DNS traffic, and lower it to 300 or 60 seconds a day before a planned migration so changes propagate quickly. Raise it again once the change is confirmed stable.

What is a CAA record and do I need one?

A CAA (Certification Authority Authorization) record lists which Certificate Authorities are permitted to issue TLS certificates for your domain, for example CAA 0 issue "letsencrypt.org". CAs are required to honor it, so it prevents unauthorized or mis-issued certificates. It is optional but a recommended security control for any domain serving HTTPS.

What is the difference between an A record and an AAAA record?

Both map a hostname to an IP address, but an A record holds a 32-bit IPv4 address (192.0.2.1) and an AAAA record holds a 128-bit IPv6 address (2001:db8::1). Dual-stack sites publish both so IPv4-only and IPv6-capable clients can each reach the server. AAAA is read "quad-A" because it is four times the size of an A record.

How do I check which DNS records a domain has?

Use dig on the command line — dig example.com A, dig example.com MX, dig example.com TXT — or nslookup on Windows. dig +trace example.com follows the delegation from the root servers down, which is useful for diagnosing resolution failures. Web tools like the InventiveHQ DNS Lookup, MXToolbox, and dns.google query from outside your network.

DNS recordsA recordsMX recordsDNS configurationdomain setup

Free tools you can use right now

Related articles

From the Inventive HQ family
OmniCanvas Notes
Visual thinking on an infinite canvas.

Notes, sketches and ideas laid out spatially instead of in a list. For people who think in diagrams and keep outgrowing linear note apps.

Take a look