Basic DNS records: A, AAAA, CNAME, MX and TXT

What each of the five most common records is for, what TTL means and why a DNS change "does not work straight away".

DNS is the address book of the Internet: it turns names that people remember into data that computers need. A domain has a zone, and the zone holds records. Each record has a name, a type, a time to live (TTL) and a value. For everyday work five types are enough.

A and AAAA: the server address

An A record points to an IPv4 address, an AAAA record to an IPv6 address:

example.com.      3600  A     203.0.113.10
example.com.      3600  AAAA  2001:db8::10
www.example.com.  3600  A     203.0.113.10

A browser that wants to open example.com asks for both types and connects to whichever address works. One name can have several A records (load distribution), and a name may have no AAAA at all. Then the site works over IPv4 only.

CNAME: an alias for another name

A CNAME says “this name is really that name”:

www.example.com.   3600  CNAME  example.com.
shop.example.com.  3600  CNAME  shops.myshopify.com.

The resolver receives the CNAME and then looks up the addresses of the target name itself. This is handy for external services: when the provider changes its IP address, you do not have to do anything.

Two rules people trip over most often:

A name with a CNAME cannot have any other records. You cannot add MX or TXT to it.
The zone apex (example.com with no prefix) cannot be a CNAME, because it always has SOA and NS records. Some DNS providers work around this with an ALIAS record or “CNAME flattening”.

MX: where to deliver mail

MX points to the servers that accept mail for the domain. The number before the name is the priority: lower wins, the others are backups.

example.com.  3600  MX  10 mx1.example.com.
example.com.  3600  MX  20 mx2.example.com.

An MX value must be a name with an A or AAAA record, not an IP address and not a CNAME. A domain that accepts no mail at all can declare it with a “null MX” record: MX 0 .

TXT: text for other systems

TXT holds arbitrary text. In practice other systems use it:

SPF (v=spf1 …): which servers may send mail for the domain,
DKIM (selector._domainkey): the key for message signatures,
DMARC (_dmarc): what to do with forged mail,
domain ownership verification for Google, Microsoft and other services.

One name can have many TXT records, but only one SPF record. Long text (a DKIM key, for example) is split into quoted chunks of 255 characters, and the reader joins them back together. The quickest way to check mail records is E-mail: SPF, DKIM, DMARC.

TTL: why a change “does not work straight away”

TTL (time to live) is the number of seconds a resolver may keep an answer in its cache. With a TTL of 3600, your ISP’s resolver remembers the old address for up to an hour after a query and does not ask again. The change in your zone is instant, but the world sees it only once the cached copies expire.

How to change records without stress:

A day before, lower the TTL of the record you will change to 300 seconds.
Wait at least as long as the old TTL.
Change the value. Old copies will now disappear within 5 minutes.
When everything works, restore a longer TTL.

The popular “DNS propagation check” is really a look at which resolvers still hold an old copy. Records do not “spread” across the Internet; they expire from caches one by one.

How to check it

In DNS lookup enter the domain, tick the types (A, AAAA, MX, TXT, CNAME) and compare the answers of three resolvers: Cloudflare, Google and Quad9. The TTL column shows how many seconds are left before the copy expires in that resolver. When resolvers return different values, the change is in progress and you only need to wait.

Quick "site is down" diagnosis: no A or AAAA record for the name means a DNS error. The record exists but points to the old address: that is TTL and caching. The record exists and the address is correct: the problem lies further on, on the server or in the network.