DNS Record Types — A, AAAA, CNAME, MX, TXT, SRV
DNS records at a glance
All record types you actually encounter in practice, with function, example value and notes. For live lookups, open the DNS Lookup tool and query a domain.
| Type | Purpose | Example value | Note |
|---|---|---|---|
| A | Hostname → IPv4 | 93.184.216.34 |
Most common record |
| AAAA | Hostname → IPv6 | 2606:2800:220:1:248:1893:25c8:1946 |
"Quad-A", required for IPv6-only clients |
| CNAME | Hostname → another hostname | www.example.com → example.com |
Not allowed at the zone apex |
| MX | Mail servers for a domain | 10 mail.example.com |
Lowest priority wins |
| TXT | Arbitrary text | "v=spf1 ip4:1.2.3.4 -all" |
SPF, DKIM, DMARC, verifications |
| NS | Authoritative nameservers | ns1.example.com |
At least 2 NS per zone recommended |
| SOA | Start of Authority | ns1 hostmaster 2025 … |
One per zone; defines TTL defaults |
| PTR | IP → hostname (reverse) | 34.216.184.93.in-addr.arpa → example.com |
Required for serious mail servers |
| SRV | Service lookup | _sip._tcp 10 60 5060 sipsrv.example.com |
LDAP, SIP, XMPP, Matrix, Minecraft |
| CAA | CA authorization for TLS certs | 0 issue "letsencrypt.org" |
Prevents mis-issuance |
| DNSKEY | DNSSEC public key | base64-encoded key | Part of the DNSSEC chain of trust |
| DS | DNSSEC Delegation Signer | hash of DNSKEY | Placed in the parent zone |
| TLSA | TLS cert pinning (DANE) | 3 1 1 <hash> |
Niche, but used in mail |
| SSHFP | SSH host-key fingerprint | 1 1 <fingerprint> |
Verifies SSH server via DNS |
| NAPTR | URI lookup / ENUM | complex | VoIP numbers → SIP URIs |
| HTTPS / SVCB | HTTPS service config | 1 . alpn=h3,h2 … |
Modern: HTTP/3, ECH, IP hints |
Notes per record type
A & AAAA — the basics
A domain can have multiple A and AAAA records. Resolvers return all answers and can use round-robin or geo-routing. Best practice: publish both A and AAAA as soon as the server supports both stacks.
CNAME — aliasing with caveats
A CNAME points to another hostname. At the zone apex (example.com. with no subdomain) CNAME is not allowed per RFC — many DNS providers (Cloudflare, Route 53) offer a synthetic ALIAS or ANAME record instead. Never let a CNAME coexist with other record types on the same name.
MX — mail routing
Priority (lower = preferred). Multiple MX with equal priority load-balance. Use at least two MX on physically separate servers.
TXT — the catch-all
Common uses:
- SPF (
v=spf1 …) — authorized senders - DKIM (
selector._domainkey.example.com) — public key for signature verification - DMARC (
_dmarc.example.com) — policy for SPF/DKIM failures - Domain verification (Google Workspace, Microsoft 365, Atlassian etc.)
Validate live with Check SPF, DKIM and DMARC.
CAA — protect against unauthorized certificates
Without a CAA record, any CA can issue a certificate for your domain. With CAA 0 issue "letsencrypt.org" only Let's Encrypt can. For wildcards: CAA 0 issuewild "letsencrypt.org".
SRV — service discovery
Format: _service._proto.name TTL IN SRV priority weight port target. Used by SIP, XMPP, Matrix federation, Active Directory (_ldap._tcp.dc._msdcs.…), Minecraft server discovery.
HTTPS/SVCB — the future
RFC 9460. Broad browser support since 2023. Enables HTTP/3 auto-upgrade, ECH (Encrypted Client Hello), IP hints. Emerging as the modern replacement for A/AAAA.
TTL recommendations
| Record type | Typical TTL | Reason |
|---|---|---|
| A / AAAA, stable host | 1 h – 24 h | Long TTL = better caching |
| A / AAAA, failover setup | 30 s – 5 min | Need fast switchover |
| MX | 1 h – 24 h | Rarely changes |
| TXT (SPF/DKIM/DMARC) | 1 h | Policy updates expected |
| CNAME | match target | Align with target lifetime |
| NS / SOA | 1–2 days | Stable |
Practical tips
- Lower TTL before any DNS change: 24 h before migration set TTL to 5 min; restore after the cutover.
- Reverse DNS (PTR) for mail servers: Forward (
mail.example.com → IP) and reverse (IP → mail.example.com) must match, otherwise many recipients reject mail. - Set CAA before issuing a wildcard certificate.
- DNSSEC: enable it through providers that manage it automatically (Cloudflare, deSEC, AWS Route 53).
Related
- DNS Explained — How name resolution works on the internet
- Check SPF, DKIM and DMARC — step-by-step
- Find the IP of a Domain — combined DNS workflow
- Tools: DNS Lookup, Whois Lookup, DNS Leak Test
- Glossary: DNS, DNSSEC, DKIM, SPF, DMARC