DNS Record Types Explained: A Complete Developer Guide

1. How DNS Resolution Actually Works

When you type example.com into a browser, a chain of queries happens in under 100ms:

1. Browser cache — checked first. If the IP was recent, done.
2. OS resolver cache — your machine's local DNS cache.
3. Recursive resolver — typically your ISP's or a public one (Cloudflare 1.1.1.1, Google 8.8.8.8). It does the heavy lifting from here.
4. Root nameservers — 13 sets of servers (a.root-servers.net through m.root-servers.net). They don't know your IP, they know which TLD servers handle .com.
5. TLD nameservers — Verisign's servers handle .com. They don't know your IP, they know which nameservers are authoritative for example.com.
6. Authoritative nameserver — your DNS provider (Cloudflare, Route 53, your registrar). It has the actual records and returns the answer.

The recursive resolver caches the answer for the duration of the TTL, then the whole chain repeats. This is why changing DNS records isn't instant — every resolver in the world that has your old record cached must wait for their cached copy to expire.

2. A and AAAA Records — IPv4 and IPv6

A Record — IPv4

Maps a hostname directly to an IPv4 address. This is the most fundamental DNS record.

example.com.     300   IN   A   203.0.113.42
www.example.com. 300   IN   A   203.0.113.42

You can have multiple A records for the same hostname, pointing to different IPs. DNS resolvers return all of them, and most clients use round-robin load balancing across them. This is the simplest form of DNS-based load balancing.

AAAA Record — IPv6

The same concept but for IPv6 addresses. An AAAA record should exist alongside an A record for dual-stack support. Modern clients prefer IPv6 when available (Happy Eyeballs algorithm).

example.com.  300  IN  AAAA  2001:db8::1

3. CNAME Records — Aliases

A CNAME (Canonical Name) points a hostname to another hostname. The second hostname is then resolved through its own DNS records. This chain of resolution is the key difference from an A record.

www.example.com.  300  IN  CNAME  example.com.
blog.example.com. 300  IN  CNAME  mysite.netlify.app.
api.example.com.  300  IN  CNAME  myapp.us-east-1.elb.amazonaws.com.

When to use CNAME vs A

• Use CNAME when pointing a subdomain to a cloud provider's hostname (load balancers, CDNs, PaaS) — their IP changes and you can't hard-code it
• Use A record for root domain, for servers with stable IPs, or when resolution speed matters (CNAME adds one extra lookup)
• Never use CNAME for the root domain (@ / naked domain) — it breaks MX, TXT, and other records at that level per RFC 1034

CNAME Chains

A CNAME can point to another CNAME, but this is bad practice. Each hop adds a DNS query round-trip. Limit chains to one level. Most DNS providers cap chain depth at 8–10 hops before returning SERVFAIL.

4. MX Records — Email Routing

MX (Mail Exchanger) records specify which mail servers receive email for your domain. Each MX record has a priority (preference) value — lower numbers have higher priority.

example.com.  3600  IN  MX  10  mail1.example.com.
example.com.  3600  IN  MX  20  mail2.example.com.   ; fallback
example.com.  3600  IN  MX  10  aspmx.l.google.com.  ; Google Workspace

When another mail server sends email to [email protected], it queries your MX records, sorts by priority, and connects to the lowest-priority server first. Equal-priority records get random selection (load distribution).

5. TXT Records — Email Authentication and Verification

TXT records store arbitrary text. Their primary modern use is email authentication — three standards work together to prove your emails are legitimate:

SPF — Sender Policy Framework

An SPF record lists all IP addresses and services authorized to send email for your domain. Receiving mail servers check it to decide whether to accept or reject incoming mail.

; Allow Google Workspace + Sendgrid + your own server
example.com.  TXT  "v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.42 -all"

; -all = reject mail from unlisted sources (hard fail)
; ~all = mark as soft fail (recommended while testing)
; ?all = neutral (never use in production)

DKIM — DomainKeys Identified Mail

DKIM adds a cryptographic signature to every outgoing email. The public key is published in DNS; the private key is held by your mail server. Receiving servers verify the signature to confirm the email was not modified in transit and genuinely originated from your domain.

; Key selector: "google" (set by your email provider)
google._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCSq..."

DMARC — Policy and Reporting

DMARC ties SPF and DKIM together. It defines what receiving servers should do when a message fails SPF and DKIM checks, and where to send aggregate reports about authentication results.

_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; pct=100; rua=mailto:[email protected]"

; p=none      → monitor only (good for initial rollout)
; p=quarantine → send failing mail to spam
; p=reject     → block failing mail entirely (strongest protection)

TXT records are also used for domain ownership verification by Google Search Console, SSL certificate issuance (ACME DNS-01 challenge), Microsoft 365 setup, and many other services.

6. NS Records — Nameserver Delegation

NS (Name Server) records specify which DNS servers are authoritative for your domain. They are set at your domain registrar and delegate authority to your DNS provider.

example.com.  86400  IN  NS  ns1.cloudflare.com.
example.com.  86400  IN  NS  ns2.cloudflare.com.

You can delegate a subdomain to a different nameserver entirely — useful for giving a client or team control over their own subdomain:

; Delegate staging.example.com to a separate nameserver
staging.example.com.  86400  IN  NS  ns1.staging-dns-provider.com.

NS records typically have a long TTL (86400 seconds = 24 hours) because nameserver changes are rare and resolvers cache them aggressively. Changing nameservers always requires patience — you must wait for the old NS TTL to expire globally.

7. SOA Record — Zone Authority

SOA (Start of Authority) is automatically managed by your DNS provider. It contains administrative information about the DNS zone: which nameserver is the primary, the zone administrator's email, and timing parameters that secondary nameservers use to sync.

example.com.  3600  IN  SOA  ns1.cloudflare.com. dns.cloudflare.com. (
    2026032601  ; Serial (often YYYYMMDDNN)
    7200        ; Refresh — how often secondaries check for updates
    3600        ; Retry — how often to retry after a failed refresh
    1209600     ; Expire — how long secondaries serve data without contact
    300         ; Negative TTL — how long to cache NXDOMAIN responses
)

You generally don't need to manually edit the SOA record. The most practically relevant field is the Negative TTL — it controls how long "this record does not exist" responses are cached. A short negative TTL (300s) means typos and missing records are corrected quickly. A long one means a mistyped subdomain lookup stays cached as NXDOMAIN for a long time.

8. SRV Records — Service Location

SRV (Service) records advertise which host and port provides a specific service. Commonly used by VoIP (SIP), XMPP/Jabber, Microsoft Lync/Teams, and game servers.

; Format: _service._proto.name  TTL  IN  SRV  priority  weight  port  target
_sip._tcp.example.com.   3600  IN  SRV  10  60  5060  sip.example.com.
_xmpp._tcp.example.com.  3600  IN  SRV  5   0   5222  xmpp.example.com.

Clients that support SRV discovery (like VoIP phones and XMPP clients) query this record instead of needing hard-coded hostnames and ports. Priority and weight work like MX records — lower priority is preferred; equal-priority records are weighted randomly.

9. CAA Records — Certificate Authority Authorization

CAA records restrict which Certificate Authorities (CAs) are permitted to issue SSL certificates for your domain. Without a CAA record, any CA can issue for your domain.

; Only Let's Encrypt and DigiCert may issue
example.com.  CAA  0  issue    "letsencrypt.org"
example.com.  CAA  0  issue    "digicert.com"
example.com.  CAA  0  issuewild "letsencrypt.org"   ; wildcard certs
example.com.  CAA  0  iodef    "mailto:[email protected]"  ; violation reports

The iodef tag sends violation reports when an unauthorized CA receives a certificate request for your domain — giving you visibility into attempted attacks.

10. TTL Strategy — How Long to Cache Your Records

Frequently Asked Questions

What is the difference between a CNAME and an A record?

An A record maps a hostname directly to an IPv4 address. A CNAME creates an alias to another hostname. Use A records at the root domain and for stable IPs. Use CNAME for subdomains pointing to cloud service hostnames. Never use CNAME at the root domain.

Why does DNS propagation take up to 48 hours?

Because resolvers worldwide cache your records until their TTL expires. To speed up planned changes, lower the TTL to 300 seconds 24–48 hours before making the change. After propagation completes, raise it back.

What are SPF, DKIM, and DMARC?

Three email authentication standards stored as TXT records. SPF authorizes which servers can send for your domain. DKIM signs outgoing messages cryptographically. DMARC enforces policy when SPF/DKIM fail and collects reports. You need all three for reliable email delivery.

What is the difference between MX priority 10 and 20?

Lower numbers = higher priority. Priority 10 is tried before 20. Equal priority records share load randomly.

What is a CAA record?

Restricts which CAs can issue SSL certificates for your domain. Prevents unauthorized certificate issuance. Add one if you want to lock down who can issue certs for your domain.

What is DNSSEC?

Adds cryptographic signatures to DNS records to prevent cache poisoning. Enable it if your registrar and DNS provider support it. Key rotation must be done carefully — mistakes can take your domain offline.