A DNS record maps a name to data of one type, and the type says what the data means: an address, a mail server, a text string, an alias. The common types are A and AAAA (addresses), CNAME (alias), MX (mail), NS (name servers), TXT (text, used for SPF, DKIM and DMARC), SOA (zone metadata), CAA (certificate authorities), SRV (services), PTR (reverse lookup) and DS/DNSKEY (DNSSEC). Look up any of them for a domain with the DNS lookup.
The table
| Type | Purpose | Example (documentation names and addresses) |
|---|---|---|
| A | IPv4 address of a name | www.example.com. 3600 IN A 192.0.2.10 |
| AAAA | IPv6 address of a name | www.example.com. 3600 IN AAAA 2001:db8::10 |
| CNAME | Alias to another name | blog.example.com. 3600 IN CNAME host.provider.example. |
| MX | Mail server for the domain, with preference | example.com. 3600 IN MX 10 mx1.provider.example. |
| NS | Authoritative name servers of a zone | example.com. 86400 IN NS ns1.dnshost.example. |
| TXT | Free text; carries SPF, DKIM keys, DMARC, site verification | example.com. 3600 IN TXT "v=spf1 -all" |
| SOA | Zone metadata: primary server, serial, refresh timers, negative-cache time | example.com. 3600 IN SOA ns1.dnshost.example. hostmaster.example.com. 2026102001 7200 3600 1209600 3600 |
| CAA | Which certificate authorities may issue certificates | example.com. 3600 IN CAA 0 issue "ca.example" |
| SRV | Host and port for a named service | _sip._tcp.example.com. 3600 IN SRV 10 60 5060 sip.example.com. |
| PTR | Name for an IP address, in a reverse zone | 10.2.0.192.in-addr.arpa. 3600 IN PTR www.example.com. |
| DS | Hash of a child zone’s key, held in the parent (DNSSEC) | example.com. 3600 IN DS 12345 13 2 <digest> |
| DNSKEY | Public key a zone signs with (DNSSEC) | example.com. 3600 IN DNSKEY 257 3 13 <key> |
Replace the example values with your own. The TTL (second column) controls how long resolvers cache the answer; see DNS propagation explained.
Addresses and aliases: A, AAAA, CNAME
A and AAAA are the records a browser needs. A CNAME says “this name is another name for that one”; resolvers then look up the target. A CNAME cannot share its name with other records. RFC 1034 §3.6.2 says “If a CNAME RR is present at a node, no other data should be present.”
That produces the apex restriction. The zone apex (example.com itself) must hold SOA and NS records, so a CNAME there conflicts with them, and it would also hide MX and TXT records. Use A/AAAA at the apex. Some DNS hosts offer an ALIAS or ANAME feature that returns addresses for the apex while the target is managed as a name; it is a vendor feature, not a standard record type, so read your host’s documentation. Subdomains such as www can be CNAMEs freely.
Mail and text: MX, TXT
MX gives a preference and a hostname (lower preference is tried first, RFC 5321 §5.1), and the target must have address records and must not be a CNAME. Details in How to set up MX records and MX points to a CNAME. Use the MX lookup to inspect them.
TXT holds arbitrary strings. Email authentication uses it at three places: SPF at the domain name, DMARC at _dmarc, DKIM keys at <selector>._domainkey. See How to create an SPF record, DKIM and DMARC.
Zone structure: NS, SOA
NS records name the servers that answer for the zone. The same set is also stored at the registrar and published in the parent zone, so the two must agree. SOA lists the primary name server, a contact mailbox written with a dot instead of @, a serial number and timers. Its last field is used for negative caching (RFC 2308 §5), which affects how long a missing name stays missing.
Policy and services: CAA, SRV
CAA, defined in RFC 8659, lets a domain owner “specify the Certification Authorities (CAs) authorized to issue certificates”. CAs check it before issuing. Without CAA, any CA may issue. An issue tag with a CA’s identifier restricts issuance to that CA; take the exact identifier from the CA’s documentation.
SRV (RFC 2782) has the format _Service._Proto.Name TTL Class SRV Priority Weight Port Target. It lets clients find a service host and port; the target must be a name with address records. Mail clients, SIP and some chat software use it.
Reverse and signing: PTR, DS, DNSKEY
PTR lives in in-addr.arpa (IPv4) or ip6.arpa (IPv6) and is controlled by whoever owns the IP, not by the domain owner; see Reverse DNS for mail servers and the reverse DNS lookup. DNSKEY publishes the zone’s signing key, and DS in the parent zone vouches for it. If DS and DNSKEY disagree, validating resolvers return an error for the entire domain, which is why DNSSEC changes need care.
FAQ
Which record points my domain to a website?
An A record (and AAAA for IPv6) at the apex, plus a CNAME or A for www.
Can one name have several records of the same type? Yes. Several A records give multiple addresses and several MX records give multiple mail servers. A CNAME is the exception, since a name can have only one alias target.
Why does my DNS panel not list some types? Panels often show only the common ones. If you need CAA, SRV or DS, check whether your DNS host supports them before moving the domain.
Sources
- RFC 1034, §3.6.2 Aliases and canonical names: https://www.rfc-editor.org/rfc/rfc1034#section-3.6.2
- RFC 1035, §3.2.2 TYPE values and §3.3 Standard RRs: https://www.rfc-editor.org/rfc/rfc1035#section-3.3
- RFC 2308, §5 Caching Negative Answers: https://www.rfc-editor.org/rfc/rfc2308#section-5
- RFC 2782, A DNS RR for specifying the location of services (DNS SRV): https://www.rfc-editor.org/rfc/rfc2782
- RFC 5321, §5.1 Locating the Target Host: https://www.rfc-editor.org/rfc/rfc5321#section-5.1
- RFC 8659, DNS Certification Authority Authorization (CAA) Resource Record: https://www.rfc-editor.org/rfc/rfc8659