DNS is the internet’s phone book — it translates human-readable domain names into the IP addresses and server configurations that make services work. Each piece of information is stored in a specific record type. Understanding them means you can diagnose problems, configure services correctly, and reason about how traffic flows.
How DNS Works (Quick Recap)
When you navigate to example.com, your computer:
- Checks local cache and
/etc/hosts - Queries your DNS resolver (typically your ISP or 8.8.8.8)
- Resolver queries root DNS servers → TLD servers (.com) → authoritative nameservers
- Authoritative nameserver returns the record for
example.com - Response is cached for TTL seconds
The records stored at authoritative nameservers are what we configure.
A Record — IPv4 Address
Maps a hostname to an IPv4 address. The most fundamental DNS record.
; Format: hostname TTL class type value
example.com. 3600 IN A 93.184.216.34
www.example.com. 3600 IN A 93.184.216.34
mail.example.com. 3600 IN A 203.0.113.42Multiple A records = round-robin load balancing:
example.com. 300 IN A 10.0.0.1
example.com. 300 IN A 10.0.0.2
example.com. 300 IN A 10.0.0.3Resolvers return all three; clients typically use the first (randomized on each response).
AAAA Record — IPv6 Address
Same as A record, but for IPv6. Named “AAAA” because IPv6 addresses are 4× longer than IPv4.
example.com. 3600 IN AAAA 2606:2800:220:1:248:1893:25c8:1946Modern infrastructure should publish both A and AAAA records. Clients with IPv6 connectivity prefer AAAA; those without fall back to A automatically (Happy Eyeballs algorithm).
CNAME Record — Canonical Name (Alias)
Maps a hostname to another hostname. Used for aliases and pointing subdomains at external services.
www.example.com. 3600 IN CNAME example.com.
blog.example.com. 3600 IN CNAME example.ghost.io.
shop.example.com. 3600 IN CNAME stores.myshopify.com.Rules:
- The target (right side) must ultimately resolve to an A or AAAA record
- Cannot be used at the domain apex (
@/example.com) - Cannot coexist with other record types at the same name (no CNAME + MX at the same hostname)
# Lookup follows the chain:
dig www.example.com
# www.example.com → CNAME → example.com → A → 93.184.216.34MX Record — Mail Exchange
Directs email for your domain to the correct mail servers. Lower priority number = higher priority.
; Google Workspace
example.com. 3600 IN MX 1 aspmx.l.google.com.
example.com. 3600 IN MX 5 alt1.aspmx.l.google.com.
example.com. 3600 IN MX 5 alt2.aspmx.l.google.com.
example.com. 3600 IN MX 10 alt3.aspmx.l.google.com.
; Microsoft 365
example.com. 3600 IN MX 0 example-com.mail.protection.outlook.com.MX rules:
- MX records must point to hostnames (A/AAAA records), not IP addresses or CNAMEs
- Multiple MX records provide fallback: if priority 1 fails, try priority 5
- A domain with no MX record → email goes to the A record’s IP (if any)
- Parked domains should have no MX record
TXT Record — Text / Verification Data
Stores arbitrary text. Originally for human-readable notes, now primarily used for:
| Purpose | Content |
|---|---|
| SPF | v=spf1 include:_spf.google.com ~all |
| DKIM | v=DKIM1; k=rsa; p=<pubkey> |
| DMARC | v=DMARC1; p=reject; rua=mailto:... |
| Domain verification | google-site-verification=abc123 |
| BIMI | v=BIMI1; l=https://...logo.svg |
; Multiple TXT records at the same hostname — all coexist
example.com. TXT "v=spf1 include:_spf.google.com ~all"
example.com. TXT "google-site-verification=abc123xyz"
_dmarc.example.com. TXT "v=DMARC1; p=reject; rua=mailto:[email protected]"
google._domainkey.ex. TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqG..."TXT records can be up to 255 characters per string; multiple strings in one record are concatenated by resolvers.
NS Record — Name Server
Lists the authoritative DNS servers for the domain. Set by your domain registrar, not something you normally edit.
example.com. 172800 IN NS ns1.exampledns.com.
example.com. 172800 IN NS ns2.exampledns.com.You change NS records when migrating DNS providers. Changes take 24-48 hours to propagate through the global DNS system.
SOA Record — Start of Authority
One per zone, contains zone metadata. Your DNS provider manages this automatically.
example.com. 3600 IN SOA ns1.exampledns.com. hostmaster.example.com. (
2026082001 ; Serial (YYYYMMDDNN)
7200 ; Refresh — secondaries refresh every 2h
3600 ; Retry — retry failed refresh after 1h
1209600 ; Expire — discard zone data after 14d
300 ) ; Minimum TTL for negative cachingSRV Record — Service Location
Specifies hostname and port for specific services. Used by XMPP, SIP, Microsoft Teams, and others.
; _service._protocol.name TTL class SRV priority weight port target
_xmpp-server._tcp.example.com. 3600 IN SRV 5 0 5269 xmpp.example.com.
_sip._tls.example.com. 3600 IN SRV 10 20 5061 sipserver.example.com.Fields: priority (lower = preferred), weight (load distribution among equal priority), port, target hostname.
PTR Record — Reverse DNS
Maps an IP address back to a hostname. Used for email server reputation and logging.
; Reverse DNS is in the in-addr.arpa zone, IP octets reversed
42.113.0.203.in-addr.arpa. 3600 IN PTR mail.example.com.PTR records are managed by whoever owns the IP address block (your hosting provider or ISP), not by you at your domain registrar. Request PTR setup from your hosting provider’s control panel.
# Lookup PTR
dig -x 203.0.113.42 +short
# → mail.example.com.CAA Record — Certification Authority Authorization
Restricts which Certificate Authorities can issue SSL certificates for your domain. Reduces risk of misissuance.
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
example.com. 3600 IN CAA 0 issue "digicert.com"
example.com. 3600 IN CAA 0 issuewild "letsencrypt.org"
example.com. 3600 IN CAA 0 iodef "mailto:[email protected]"| Tag | Meaning |
|---|---|
issue | CAs allowed to issue DV/OV/EV certificates |
issuewild | CAs allowed to issue wildcard certificates |
iodef | Where to send violation reports |
If a CA checks your CAA record and isn’t listed, it must refuse to issue. Missing CAA record = any CA can issue.
Quick Reference Table
| Record | Maps | Use Case |
|---|---|---|
| A | Hostname → IPv4 | Web server, any service |
| AAAA | Hostname → IPv6 | IPv6 connectivity |
| CNAME | Hostname → Hostname | Aliases, CDNs, SaaS platforms |
| MX | Domain → Mail server | Email routing |
| TXT | Hostname → Text | SPF, DKIM, DMARC, verification |
| NS | Domain → Nameservers | DNS delegation |
| SOA | Zone → Metadata | Zone authority (auto-managed) |
| SRV | Service → Host:Port | XMPP, SIP, VoIP |
| PTR | IP → Hostname | Reverse DNS, email reputation |
| CAA | Domain → Allowed CAs | TLS certificate control |
Diagnosing DNS with dig
# Lookup specific record type
dig A example.com
dig MX example.com
dig TXT example.com
dig AAAA example.com
# Short output only
dig A example.com +short
# Query specific nameserver
dig A example.com @8.8.8.8
# Check all records (ANY — often blocked)
dig ANY example.com
# Trace resolution path
dig A example.com +trace
# Check TTL remaining
dig A example.com | grep -A2 "ANSWER SECTION"DNS problems are usually one of: wrong record type, missing record, wrong value, or TTL not yet expired after a change. Start with dig to see exactly what’s in DNS.
Common Questions
What is the difference between A and CNAME records?
An A record maps a hostname directly to an IPv4 address (e.g., example.com → 93.184.216.34). A CNAME record maps a hostname to another hostname (e.g., www.example.com → example.com), which is then resolved via its own A record. CNAMEs can't be used at the root/apex of a domain (@ / example.com) — only A, AAAA, MX, TXT, NS, and SOA are allowed there. Use CNAME for subdomains pointing to CDNs or SaaS platforms.
Can I have multiple A records for the same domain?
Yes. Multiple A records for the same hostname implement DNS-based load balancing and redundancy. When a resolver queries the domain, the DNS server returns all A records (usually shuffled), and the client typically uses the first one. This provides basic round-robin load distribution and fault tolerance if one IP goes down.
What is DNS TTL and how does it affect changes?
TTL (Time to Live) is the number of seconds resolvers and browsers cache a DNS record. A TTL of 3600 means your record is cached for 1 hour — changes won't propagate to all users until old caches expire. Before making DNS changes, lower TTL to 300 (5 minutes) 24 hours in advance. After the change is confirmed, raise TTL back to 3600 or higher.
Why can't I use a CNAME at my root domain?
The DNS standard (RFC 1034) prohibits CNAME records at the apex (root) because apex domains must have NS and SOA records, and a CNAME at the same name would conflict. Some DNS providers offer CNAME-like behavior at the apex through proprietary extensions: Cloudflare CNAME Flattening, AWS Route 53 ALIAS, DNSimple ALIAS. These are resolved server-side and behave like A records to clients.
What is the difference between NS and SOA records?
NS (Name Server) records list the authoritative DNS servers for a domain — the servers clients query for DNS answers. SOA (Start of Authority) records contain zone metadata: primary nameserver, administrator email, serial number, refresh/retry/expire intervals. Every DNS zone has exactly one SOA record and at least two NS records. You rarely configure these manually — your DNS provider sets them.