DNS Record Types Explained: A, AAAA, CNAME, MX, TXT, and More

DNS is the internet’s phone book — it translates human-readable domain names into the IP addresses and server configurations that make services work. Each piece of information is stored in a specific record type. Understanding them means you can diagnose problems, configure services correctly, and reason about how traffic flows.

How DNS Works (Quick Recap)

When you navigate to example.com, your computer:

1. Checks local cache and /etc/hosts
2. Queries your DNS resolver (typically your ISP or 8.8.8.8)
3. Resolver queries root DNS servers → TLD servers (.com) → authoritative nameservers
4. Authoritative nameserver returns the record for example.com
5. Response is cached for TTL seconds

The records stored at authoritative nameservers are what we configure.

A Record — IPv4 Address

Maps a hostname to an IPv4 address. The most fundamental DNS record.

; Format: hostname  TTL  class  type  value
example.com.      3600  IN     A     93.184.216.34
www.example.com.  3600  IN     A     93.184.216.34
mail.example.com. 3600  IN     A     203.0.113.42

Multiple A records = round-robin load balancing:

example.com.  300  IN  A  10.0.0.1
example.com.  300  IN  A  10.0.0.2
example.com.  300  IN  A  10.0.0.3

Resolvers return all three; clients typically use the first (randomized on each response).

AAAA Record — IPv6 Address

Same as A record, but for IPv6. Named “AAAA” because IPv6 addresses are 4× longer than IPv4.

example.com.  3600  IN  AAAA  2606:2800:220:1:248:1893:25c8:1946

Modern infrastructure should publish both A and AAAA records. Clients with IPv6 connectivity prefer AAAA; those without fall back to A automatically (Happy Eyeballs algorithm).

CNAME Record — Canonical Name (Alias)

Maps a hostname to another hostname. Used for aliases and pointing subdomains at external services.

www.example.com.      3600  IN  CNAME  example.com.
blog.example.com.     3600  IN  CNAME  example.ghost.io.
shop.example.com.     3600  IN  CNAME  stores.myshopify.com.

Rules:

• The target (right side) must ultimately resolve to an A or AAAA record
• Cannot be used at the domain apex (@ / example.com)
• Cannot coexist with other record types at the same name (no CNAME + MX at the same hostname)

# Lookup follows the chain:
dig www.example.com
# www.example.com → CNAME → example.com → A → 93.184.216.34

MX Record — Mail Exchange

Directs email for your domain to the correct mail servers. Lower priority number = higher priority.

; Google Workspace
example.com.  3600  IN  MX  1   aspmx.l.google.com.
example.com.  3600  IN  MX  5   alt1.aspmx.l.google.com.
example.com.  3600  IN  MX  5   alt2.aspmx.l.google.com.
example.com.  3600  IN  MX  10  alt3.aspmx.l.google.com.

; Microsoft 365
example.com.  3600  IN  MX  0   example-com.mail.protection.outlook.com.

MX rules:

• MX records must point to hostnames (A/AAAA records), not IP addresses or CNAMEs
• Multiple MX records provide fallback: if priority 1 fails, try priority 5
• A domain with no MX record → email goes to the A record’s IP (if any)
• Parked domains should have no MX record

TXT Record — Text / Verification Data

Stores arbitrary text. Originally for human-readable notes, now primarily used for:

; Multiple TXT records at the same hostname — all coexist
example.com.             TXT  "v=spf1 include:_spf.google.com ~all"
example.com.             TXT  "google-site-verification=abc123xyz"
_dmarc.example.com.      TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"
google._domainkey.ex.    TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCSqG..."

TXT records can be up to 255 characters per string; multiple strings in one record are concatenated by resolvers.

NS Record — Name Server

Lists the authoritative DNS servers for the domain. Set by your domain registrar, not something you normally edit.

example.com.  172800  IN  NS  ns1.exampledns.com.
example.com.  172800  IN  NS  ns2.exampledns.com.

You change NS records when migrating DNS providers. Changes take 24-48 hours to propagate through the global DNS system.

SOA Record — Start of Authority

One per zone, contains zone metadata. Your DNS provider manages this automatically.

example.com.  3600  IN  SOA  ns1.exampledns.com. hostmaster.example.com. (
                              2026082001  ; Serial (YYYYMMDDNN)
                              7200        ; Refresh — secondaries refresh every 2h
                              3600        ; Retry — retry failed refresh after 1h
                              1209600     ; Expire — discard zone data after 14d
                              300 )       ; Minimum TTL for negative caching

SRV Record — Service Location

Specifies hostname and port for specific services. Used by XMPP, SIP, Microsoft Teams, and others.

; _service._protocol.name  TTL  class  SRV  priority  weight  port  target
_xmpp-server._tcp.example.com.  3600  IN  SRV  5  0  5269  xmpp.example.com.
_sip._tls.example.com.          3600  IN  SRV  10 20 5061  sipserver.example.com.

Fields: priority (lower = preferred), weight (load distribution among equal priority), port, target hostname.

PTR Record — Reverse DNS

Maps an IP address back to a hostname. Used for email server reputation and logging.

; Reverse DNS is in the in-addr.arpa zone, IP octets reversed
42.113.0.203.in-addr.arpa.  3600  IN  PTR  mail.example.com.

PTR records are managed by whoever owns the IP address block (your hosting provider or ISP), not by you at your domain registrar. Request PTR setup from your hosting provider’s control panel.

# Lookup PTR
dig -x 203.0.113.42 +short
# → mail.example.com.

CAA Record — Certification Authority Authorization

Restricts which Certificate Authorities can issue SSL certificates for your domain. Reduces risk of misissuance.

example.com.  3600  IN  CAA  0  issue "letsencrypt.org"
example.com.  3600  IN  CAA  0  issue "digicert.com"
example.com.  3600  IN  CAA  0  issuewild "letsencrypt.org"
example.com.  3600  IN  CAA  0  iodef "mailto:security@example.com"

If a CA checks your CAA record and isn’t listed, it must refuse to issue. Missing CAA record = any CA can issue.

Quick Reference Table

Diagnosing DNS with dig

# Lookup specific record type
dig A example.com
dig MX example.com
dig TXT example.com
dig AAAA example.com

# Short output only
dig A example.com +short

# Query specific nameserver
dig A example.com @8.8.8.8

# Check all records (ANY — often blocked)
dig ANY example.com

# Trace resolution path
dig A example.com +trace

# Check TTL remaining
dig A example.com | grep -A2 "ANSWER SECTION"

DNS problems are usually one of: wrong record type, missing record, wrong value, or TTL not yet expired after a change. Start with dig to see exactly what’s in DNS.