DNS records explained: A, AAAA, CNAME, MX, TXT, NS and more

• A and AAAA point a name to an IPv4 or IPv6 address; CNAME makes a name an alias of another name.
• MX says which servers receive e-mail; TXT holds text such as SPF, DKIM, DMARC and verification codes.
• NS records delegate the domain to its name servers; changing them moves your whole DNS elsewhere.
• Changes are not pushed out anywhere; resolvers keep the old answer until its TTL runs out.

• No CNAME at the root (example.com itself): the root also holds the NS and SOA records, and a CNAME cannot sit next to other records. Use A/AAAA at the root; many providers offer ALIAS/ANAME or CNAME flattening for this.
• A name that has a CNAME can have no other records, so you cannot add MX or TXT to a subdomain that is a CNAME.
• MX and NS records must point to a host name, never directly to an IP address or to a CNAME.
• Only one SPF record per name; several TXT records for other purposes are fine.
• In some control panels the trailing dot matters: mail.example.com. is a full name; without the dot the panel may append your domain and create mail.example.com.example.com.

Every record has a TTL (time to live) in seconds. Resolvers run by internet providers and public DNS services keep the answer in their cache for that long. When you change a record, those that already cached the old value keep using it until the TTL runs out. That is what people call DNS propagation.

Plan changes: a day before moving a website, lower the TTL of the records you will change to 300 seconds (5 minutes), and raise it back to 3600 or more afterwards. Changing name servers (NS) takes longer, because the NS records in the parent zone (for example .com) can have a TTL of up to two days, and some resolvers wait that long.

Negative answers are cached too: if you look a name up before creating it, the “no such name” answer can be kept for the negative TTL set in the zone's SOA record.

• Website on a host: A (and AAAA, if available) for example.com, and www as a CNAME to example.com.
• Google Workspace or Microsoft 365 mail: the MX records they give you, an SPF include, DKIM as CNAME/TXT and a DMARC record. Details in the SPF, DKIM and DMARC guide.
• Verification for Google Search Console and similar services: a TXT record on the domain; it can sit next to SPF.
• A subdomain for a SaaS service (shop, help desk): shop CNAME to the host name the provider gives you.

• Look the domain up to see A, AAAA, MX, NS, TXT and more in one place.
• The DNS propagation check asks public resolvers around the world and your authoritative name servers whether they already see the new value.
• The E-mail security check checks MX, SPF, DKIM and DMARC.