How to Read DNS Records: A Practical Guide

DNS records are the address book of the internet — they tell systems where to find your website, where to send your email, and how to verify your identity. Each record type has a specific purpose and a predictable format.

The Anatomy of a DNS Record

Every DNS record has five components:

NAME          TTL    CLASS   TYPE    RDATA
example.com.  3600   IN      A       93.184.216.34

• NAME: The hostname this record applies to
• TTL: Time to Live — how long (in seconds) resolvers cache this record
• CLASS: Always IN (Internet) for modern DNS
• TYPE: What kind of record (A, MX, CNAME, TXT, etc.)
• RDATA: The record’s actual value — varies by type

Use DomainScan’s DNS Query tool to retrieve all record types for any domain at once.

A Record (Address)

Maps a hostname to an IPv4 address.

example.com.   3600   IN   A   93.184.216.34

This tells browsers and other clients: “to reach example.com, connect to 93.184.216.34.”

What to look for when troubleshooting:

• Missing A record → “domain not found” errors in browsers
• A record pointing to wrong IP → site loads wrong server’s content
• Multiple A records → round-robin load balancing (expected) or accidental duplication (check if all IPs are intentional)
• TTL too high (86400+) → DNS changes take up to 24h to propagate; lower to 300 before making changes

AAAA Record (IPv6 Address)

Maps a hostname to an IPv6 address.

example.com.   3600   IN   AAAA   2606:2800:220:1:248:1893:25c8:1946

Functions exactly like an A record but for IPv6. Most modern sites should have both A and AAAA records. IPv6-only clients (rare but growing) can’t reach hosts with only A records.

CNAME Record (Canonical Name)

Creates an alias — maps one hostname to another.

www.example.com.   3600   IN   CNAME   example.com.
blog.example.com.  3600   IN   CNAME   myblog.wpengine.com.

Important rules:

• A CNAME cannot coexist with other records for the same name (except DNSSEC records)
• A CNAME cannot be used at the zone apex (the root domain example.com itself) — use an A record or check if your DNS provider supports ALIAS/ANAME records
• CNAMEs can chain (A → B → C) but each hop adds lookup latency

Common uses: CDN hostnames, third-party service verification, www redirects to apex.

MX Record (Mail Exchange)

Specifies which servers accept incoming email for the domain.

example.com.   3600   IN   MX   10   mail1.example.com.
example.com.   3600   IN   MX   20   mail2.example.com.

The number after MX is the priority — lower numbers are tried first. 10 is tried before 20. If mail1 fails, sending servers try mail2.

What to look for:

• MX pointing to an IP address → invalid, must point to a hostname
• No MX record → domain cannot receive email (but may still send)
• MX pointing to a CNAME → technically invalid per RFC, may work but can cause issues
• Priority 0 with no backup → single point of failure for incoming mail

Check MX records alongside SPF and DMARC with DomainScan’s email authentication checker.

TXT Record (Text)

Stores arbitrary text data — used for dozens of verification and authentication purposes.

example.com.   3600   IN   TXT   "v=spf1 include:_spf.google.com ~all"
example.com.   3600   IN   TXT   "google-site-verification=abc123xyz"
_dmarc.example.com.   3600   IN   TXT   "v=DMARC1; p=reject; rua=mailto:[email protected]"

Common TXT record purposes:

A domain can have multiple TXT records. Each serves a different purpose, identified by its prefix.

NS Record (Name Server)

Delegates the domain to authoritative DNS servers.

example.com.   86400   IN   NS   ns1.cloudflare.com.
example.com.   86400   IN   NS   ns2.cloudflare.com.

NS records at the domain level tell the internet which servers hold the authoritative DNS records for the domain. Changes to NS records (like moving to a new DNS provider) propagate slowly (24–48h) because registries and parent zones cache them with high TTLs.

What to look for:

• NS records not matching your DNS provider → misconfiguration or old records
• Only one NS record → single point of failure (most registrars require at least 2)
• NS changes → allow 24–48h for full propagation

SOA Record (Start of Authority)

Contains administrative metadata about the DNS zone.

example.com.   3600   IN   SOA   ns1.example.com. admin.example.com. (
    2026082101   ; Serial number (often YYYYMMDDNN)
    3600         ; Refresh interval
    900          ; Retry interval
    604800       ; Expire time
    300          ; Minimum TTL
)

The SOA is automatically managed by your DNS provider. You rarely need to edit it manually. The serial number increments with each zone change — if it’s not updating after you make changes, your DNS provider may have a caching issue.

CAA Record (Certification Authority Authorization)

Restricts which Certificate Authorities can issue SSL certificates for your domain.

example.com.   3600   IN   CAA   0   issue   "letsencrypt.org"
example.com.   3600   IN   CAA   0   issuewild   "sectigo.com"

CAA records are a security control — they prevent unauthorized CAs from issuing certificates for your domain even if an attacker controls a domain verification process.

If you have CAA records and SSL issuance fails: add the CA your provider uses to your CAA records, or remove the restriction temporarily during issuance.

SRV Record (Service)

Specifies the location of a service by protocol and port.

_sip._tcp.example.com.   3600   IN   SRV   10 20 5060 sipserver.example.com.

Format: priority weight port target

Used by VOIP, XMPP, Microsoft Teams/Exchange, and other services that need to advertise their endpoint location via DNS. Most web developers won’t touch these — they’re set by the service provider.

Quick Troubleshooting Reference

Run a full DNS query with DomainScan’s DNS tool to see all record types at once, then use the propagation checker to confirm changes have spread globally.