DNS Records Explained: A, AAAA, CNAME, MX, TXT, NS and TTL.

DNS is the internet's phone book: it turns names into the addresses and settings computers need. Most outages blamed on "the server" that start right after a change actually start in DNS. Knowing the handful of record types you meet every day makes those problems much quicker to find.

Key takeaways

• A/AAAA map a name to an IPv4/IPv6 address; CNAME makes a name an alias of another.
• MX says where email for a domain goes; TXT carries verification and email-security data.
• NS records delegate a domain to its nameservers.
• TTL controls how long resolvers cache an answer - lower it before planned changes.
• Monitor critical records so an unexpected change raises an alert.

How a lookup works

When a browser needs www.example.com:

1. It asks the operating system's resolver, which checks its cache.
2. If not cached, a recursive resolver (from your ISP, company or a public service) does the work.
3. The resolver asks a root server, which points it at the .com servers.
4. The .com servers point it at the authoritative nameservers for example.com (from its NS records).
5. The authoritative server returns the answer, which every resolver caches for the record's TTL.

The common record types

A and AAAA

The records most lookups end at. A name can have several A records; clients pick one, which gives simple load spreading.

CNAME

Points one name at another, which is then looked up. Two rules trip people up:

• A name with a CNAME can't have any other records.
• The zone apex (example.com itself) can't be a CNAME; providers offer "ALIAS" or "flattening" features instead.

MX

Lists mail servers in priority order - the lowest number is tried first. MX targets must be names with A/AAAA records, not CNAMEs or IP addresses.

TXT

Holds text. It's used for SPF (which servers may send mail for your domain), DKIM keys, DMARC policy and ownership verification for many services.

NS

Delegates the domain to nameservers. If the NS records at the registrar and in the zone disagree, some resolvers get different answers than others.

TTL and propagation

Every record has a TTL (time to live) in seconds. Resolvers may cache the answer for that long, so a change only reaches everyone after the old TTL has expired. "DNS propagation" is just caches expiring.

For a planned change:

1. A day before, lower the TTL to 300 seconds.
2. Wait for the old TTL to pass.
3. Make the change - it now spreads within about five minutes.
4. Once stable, raise the TTL again.

Checking records

dig +short A example.com
dig +short MX example.com
dig example.com TXT
dig @ns1.provider.net example.com A   # ask the authoritative server directly
nslookup -type=AAAA example.com

Asking the authoritative server tells you what is published; asking a public resolver tells you what users see right now. You can also use the online DNS lookup and MX lookup tools.

What goes wrong

• Expired domain or nameserver delegation - everything stops resolving at once.
• A typo in a record during a migration - traffic goes to the old server or nowhere.
• Missing AAAA, or a stale one - IPv6 users get errors while IPv4 users don't.
• Wrong SPF/DKIM after changing mail providers - mail lands in spam.
• Hijacked records - visitors are sent to an attacker's server.

A DNS monitor that checks the expected values of your A, MX and NS records alerts you to all of these before customers notice.

Frequently asked questions

• How long does DNS propagation take?

  +

  As long as the old TTL. With a TTL of one hour, most resolvers pick up a change within an hour; some ignore TTLs and take longer.

• What is the difference between a CNAME and an A record?

  +

  An A record gives an IP address directly. A CNAME says "look up this other name instead", adding one more lookup.

• Why does DNS work from my computer but not for a customer?

  +

  Different resolvers may have cached different answers, or the customer's resolver may be blocked from your nameservers. Compare answers from several public resolvers.