DNS Records Explained: A, AAAA, CNAME, MX, TXT, NS

The short answer

DNS is the directory that turns a domain name into an address computers can reach. A DNS record is a single line in that directory: a name, a type, a value and a TTL (how many seconds the answer may be cached).

All records for a domain live in its DNS zone at your DNS provider, which may be your registrar, your host or a separate service such as Cloudflare. There are many record types, but a typical business only needs six.

The six common types

A and AAAA

A is the most basic record: "example.com lives on the server with this IP". AAAA does the same for IPv6. If your server has no IPv6 address, you do not need AAAA — and a wrong AAAA record can make the site unreachable for some visitors.

CNAME

CNAME says "this name is the same as that one". It is the usual way to connect www or a subdomain to a cloud platform that changes its own IPs. Two limits matter:

• By the standard, a CNAME cannot sit on the root domain (example.com). Providers offer ALIAS, ANAME or "CNAME flattening" for that case.
• If a name has a CNAME, it cannot have any other records.

MX

MX points to the mail server for the domain. The number before the host is the priority: lower means preferred. The MX value must be a hostname, not an IP address and not a CNAME.

TXT

TXT is a general-purpose text field. In practice it holds:

• domain ownership verification for Google Search Console, email services and SSL providers;
• SPF — the list of servers allowed to send mail for the domain;
• DKIM — a public key used to sign messages (usually on a name like selector._domainkey);
• DMARC — the policy for messages that fail checks (on the _dmarc name).

NS

NS records define which DNS servers are authoritative for the domain. You change them at the registrar when moving DNS management to another provider. Without a clear reason, leave them alone.

Which records you need for common tasks

To get a website online:

• A (plus AAAA if you have IPv6) for example.com;
• CNAME for www pointing to the main domain or the platform address.

To run email on your domain:

• MX from your mail provider;
• TXT with SPF;
• TXT with the DKIM key;
• TXT with DMARC on _dmarc.

To verify a domain in a service:

• TXT (sometimes CNAME) with the value the service gives you.

A minimal zone looks like this:

example.com.          3600  A      203.0.113.10
www.example.com.      3600  CNAME  example.com.
example.com.          3600  MX     10 mx.mail-provider.com.
example.com.          3600  TXT    "v=spf1 include:_spf.mail-provider.com ~all"
_dmarc.example.com.   3600  TXT    "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

Common mistakes

• Two SPF records on one domain. There must be exactly one; combine senders with include: in a single line.
• CNAME on the root domain. Many panels will refuse it, and if one allows it, email may break.
• The trailing dot. Some panels expect names relative to the zone (www), others fully qualified (www.example.com.). Mixing them up produces www.example.com.example.com.
• Deleting MX records when moving a website. Site and mail are independent; leave mail records alone when changing hosts.
• Expecting instant results. Changes respect TTL, so old values can stay in caches for a while.

How to check your records

To see what DNS actually returns:

dig example.com A +short
dig example.com MX +short
dig example.com TXT +short

On Windows, use nslookup -type=MX example.com.