DNS Records Explained: A, AAAA, CNAME, MX, TXT, and CAA

DNS entries – often also called DNS records – contain technical information about how various services of a domain can be reached or what information is published about a domain.

For example, an A record can connect a hostname to an IPv4 address. MX records determine which mail servers should accept emails for a domain. TXT records are used for SPF, DKIM, DMARC, and the verification of external services, among other things.

The most important record types in everyday hosting are A, AAAA, CNAME, MX, TXT, and CAA. In this article, we explain their tasks, typical use cases, and important differences.

Briefly explained: Not every DNS record leads to a website. Different record types fulfill different tasks for web servers, email, verifications, certificates, and other internet services.

What is a DNS record? #

A DNS record is a piece of information within a DNS zone. Depending on the record type, it can contain, for example, an IP address, another hostname, a responsible mail server, or text information.

A DNS record typically includes several pieces of information:

• the name or host
• the record type
• the corresponding value or target
• a TTL
• for certain record types, additional information such as a priority

We explain how DNS, resolvers, authoritative name servers, and DNS zones fundamentally work together at DNS simply explained: How the Domain Name System works.

What does the name of a DNS record mean? #

The name determines for which domain name or hostname a record applies.

For the domain:

meine-firma.ch

can, for example, DNS entries for the following names exist:

meine-firma.ch

www.meine-firma.ch

mail.meine-firma.ch

shop.meine-firma.ch

In DNS management interfaces, the actual domain is sometimes also referred to as @ displayed. How a provider or an administrative interface displays names can vary.

What does TTL mean? #

TTL stands for Time to Live. In simple terms, the value determines how long a DNS response may be cached by resolvers or other DNS caches.

A TTL of:

3600

corresponds to 3600 seconds or one hour.

When a DNS record is changed, older information may still be present in caches until its validity period has expired.

We explain why changes are not necessarily visible everywhere at the same time at DNS Propagation Explained: Why Changes Can Take Time.

A-Record: Connect a hostname with an IPv4 address #

The A-Record is among the most important DNS records for websites and other services accessible via IPv4.

It maps an IPv4 address to a domain or host name.

A simplified example:

meine-firma.ch.    A    192.0.2.10

The gist of this entry is:

meine-firma.ch → 192.0.2.10

Does a DNS resolver ask for the IPv4 address of meine-firma.ch, this A record can provide the corresponding address.

Important: An IP address in an A record does not automatically mean that a working website is present there. The addressed server must also be configured for the domain and the desired service.

When is an A record used? #

Typical use cases are a domain or subdomain that should point directly to the IPv4 address of a server.

For example, could:

meine-firma.ch

and

shop.meine-firma.ch

each have their own A-records and thereby point to different IPv4 addresses.

The DNS merely determines the technical destination. Which website the web server then delivers is decided at the server level.

AAAA Record: The IPv6 counterpart to the A record #

The AAAA record basically performs a similar task as the A record, but contains an IPv6 address.

A simplified example:

meine-firma.ch.    AAAA    2001:db8::10

This allows a hostname to be resolved via IPv6.

Can a domain have both A and AAAA records at the same time? #

Yes. A hostname can be reachable via both IPv4 and IPv6.

Then, for example, both record types can be present:

meine-firma.ch.    A       192.0.2.10
meine-firma.ch.    AAAA    2001:db8::10

A client with the appropriate network connection can then use a suitable connection.

Attention: An AAAA record should only exist if the service in question can actually be reached correctly at the specified IPv6 address. An outdated or incorrect AAAA record can cause access via IPv6 to fail, even though IPv4 works correctly.

CNAME Record: Pointing one name to another name #

CNAME stands for Canonical Name.

A CNAME record points one DNS name to another DNS name.

A simplified example:

www.meine-firma.ch.    CNAME    meine-firma.ch.

This means that www.meine-firma.ch as an alias for meine-firma.ch referred.

The resolver must then determine the required DNS information for the target name.

CNAME is not an HTTP redirect #

This difference is particularly important.

A CNAME record does not redirect a browser to another URL. It operates at the DNS level.

If:

www.meine-firma.ch

via CNAME to:

meine-firma.ch

shows, that does not automatically mean that the browser changes its displayed address from www.meine-firma.ch on meine-firma.ch changed.

A redirect like HTTP 301 or 302 is a different technical function and takes place at the level of the web server or web application.

Note: CNAME = DNS alias. 301/302 = HTTP redirect. Neither should be confused with the other.

Why cannot a CNAME be arbitrarily combined with other records? #

Special DNS rules apply to a DNS name defined as a CNAME. In principle, a CNAME must not be used in parallel with other data such as A, AAAA, or MX records for the same name.

Therefore, an existing record should not simply be changed to a CNAME without considering the rest of the DNS configuration.

Especially with the actual domain – for example meine-firma.ch – is this relevant because further DNS information is usually needed there.

MX record: Set mail server for a domain #

MX stands for Mail Exchange.

MX records determine which mail servers should accept emails for a domain.

If someone sends a message to:

info@meine-firma.ch

sent, the sending mail server can determine via DNS which MX servers for meine-firma.ch are responsible.

A simplified example could look like this:

meine-firma.ch.    MX    10 mail.meine-firma.ch.

The number 10 is the priority of the MX record in the process.

What does the priority in MX records mean? #

There can be multiple MX records for a domain.

For example:

meine-firma.ch.    MX    10 mx1.example.net.
meine-firma.ch.    MX    20 mx2.example.net.

With MX records, a lower numerical value a higher preference.

In this example, therefore, the server is fundamentally given priority 10 ahead of the server with priority 20 preferred.

How multiple MX servers are actually used also depends on the behavior of the participating mail servers and their reachability.

MX records point to hostnames, not IP addresses #

The destination of an MX record is a hostname.

This hostname, in turn, must be resolvable via DNS to an accessible address.

An MX destination should therefore look like this, for example:

mail.meine-firma.ch

and not directly like:

192.0.2.20

Important: MX records should not be changed on a whim. An incorrect MX configuration can disrupt email delivery for an entire domain.

SpamExperts also uses MX records #

When a domain is protected by SpamExperts Incoming Filtering, the MX records point to the designated SpamExperts infrastructure.

Incoming emails are then first accepted and checked by SpamExperts. Legitimate messages are subsequently forwarded to the configured destination mail server.

We will handle the setup separately under Set up SpamExperts incoming filtering and configure MX records.

TXT Record: Publish text information in the DNS #

A TXT record makes it possible to publish text information via DNS.

TXT records are used for very different purposes.

In everyday hosting and email operations, you will encounter them, among other places, in:

• SPF
• DKIM
• DMARC
• Domain Verifications
• Confirmations for external services

Therefore, a TXT record is not automatically an SPF or DMARC record. TXT initially only designates the DNS record type. The meaning is derived from the content and the name of the record.

SPF is published via TXT #

SPF can specify which systems are authorized to send emails for a domain.

An SPF record can begin, for example, with:

v=spf1

The full policy depends on which systems actually send emails for the domain.

With SPF, it is particularly important not to simply create multiple independent SPF policies for the same domain.

The various authorized shipping sources must be combined into a valid SPF policy, if necessary.

DKIM also uses DNS #

With DKIM, a public key is published via DNS. Receiving mail servers can use this to verify a message's DKIM signature.

DKIM records use a so-called selector. A corresponding name can, for example, follow the scheme:

selector._domainkey.meine-firma.ch

follow.

A domain can use multiple DKIM selectors, for example when different sending systems are used.

DMARC is also published as a TXT record #

DMARC uses a TXT record under a special name.

This follows the scheme:

_dmarc.meine-firma.ch

For example, a DMARC policy can be implemented with:

v=DMARC1;

Start.

SPF, DKIM, and DMARC fulfill different tasks and should not be understood as three variants of the same procedure.

We explain the connections under SPF, DKIM, and DMARC explained with CURIAWEB Hosting.

TXT records for domain verifications #

Many external services require a specific TXT record to verify a domain.

The provider usually specifies a name or host and an exact TXT value for this.

After the entry, the external service can check via DNS whether the requested information is present.

This makes it possible to prove that someone has control over the domain's DNS configuration without having to provide a file on the website.

Practical Tip: Adopt verification values exactly as provided by the respective service. Even minor changes can cause the verification to fail.

CAA Record: Restrict Certificate Authorities #

CAA stands for Certification Authority Authorization.

With CAA records, a domain owner can specify which certification authorities are generally authorized to issue certificates for the domain or name space in question.

For example, a CAA record can authorize a specific certificate authority.

CAA is therefore a security-related DNS record in connection with the issuance of TLS certificates.

Is a CAA record strictly required? #

No. A domain does not strictly require its own CAA record for a TLS certificate to be issued in general.

If no relevant CAA record exists, CAA does not impose any additional restriction on specific certificate authorities.

If CAA records are present, certification authorities must take them into account accordingly when issuing certificates.

Attention: Misconfigured CAA records can prevent the issuance or renewal of a desired TLS certificate. Therefore, only change them if you know their purpose and the Certificate Authority used.

What is the difference between A and CNAME? #

These two record types are particularly often confused.

A A-Record points directly to an IPv4 address:

shop.meine-firma.ch.    A    192.0.2.10

A CNAME record points to a different DNS name instead:

shop.meine-firma.ch.    CNAME    ziel.example.net.

Which record should be used depends on the technical specification of the service.

If a hosting or third-party provider explicitly specifies a particular CNAME, it should not be arbitrarily replaced with the currently resolved IP address of the target name. This IP address could change later.

What is the difference between A and AAAA? #

Both records connect a name directly to an IP address.

The difference lies in the IP protocol used:

• A → IPv4
• AAAA → IPv6

Both can exist in parallel for the same hostname, provided the service is correctly reachable via both protocols.

What is the difference between MX and A? #

An A record returns an IPv4 address for a name.

An MX record, on the other hand, specifies which mail servers are responsible for receiving emails for a domain.

Therefore, a working A record for the website is no proof that the email configuration is also correct.

Website and email can use completely different technical goals.

What is the difference between MX and SMTP? #

These terms are also frequently confused with one another.

MX is a DNS record type, which is used to determine responsible mail servers when receiving emails.

SMTP, on the other hand, is a Protocol for the transmission of e-mails.

Therefore, the MX records used for a domain's incoming mail are not automatically the same server details that you need to enter as the outgoing mail server in Outlook, Apple Mail, or Thunderbird.

We explain the differences between IMAP, POP3, and SMTP at IMAP, POP3, and SMTP explained.

Additional DNS record types #

A, AAAA, CNAME, MX, TXT and CAA are among the DNS records that hosting customers come into contact with particularly often. However, DNS knows other record types.

This includes, for example NS for nameserver information, SOA for basic administrative information of a DNS zone and SRV for certain services.

The fact that we are not covering these here to the same extent therefore does not mean that they are technically less relevant. The focus of this article is on the record types that are particularly frequently checked or adjusted manually in typical website, hosting, and email configurations.

What is an NS record? #

NS stands for Name Server.

NS records specify nameservers for a DNS zone or delegation.

The nameservers of a domain are particularly important because they determine which DNS infrastructure is responsible for the corresponding information.

A change of authoritative nameservers is therefore much more far-reaching than changing a single A or TXT record.

Where to find the nameservers intended for your CURIAWEB hosting and when you need them, we will cover under Finding and correctly using CURIAWEB nameservers.

What is an SOA record? #

SOA stands for Start of Authority.

The SOA record contains basic management information for a DNS zone. This includes, among other things, details that are relevant for the management and synchronization of a zone.

In normal hosting operations, this record usually does not need to be changed manually.

What is an SRV record? #

SRV records can provide information about which host and port a specific service can be reached at.

They are used by various applications and protocols.

If an external service requires an SRV record, you should adopt the values provided by the provider exactly and, in particular, not confuse priority, weight, port, and target with each other.

Can I have multiple records of the same type? #

That depends on the record type and the specific name.

Multiple A or AAAA records for the same hostname are technically possible. Multiple MX records are also common and use priorities.

Multiple TXT records can also exist for a single name, provided that the respective application and DNS rules permit it.

However, that does not mean that every combination is sensible or valid.

A particularly important example is SPF: Several different TXT records can exist, but for the same name there should not be multiple independent SPF policies with v=spf1 be generated.

How can I check existing DNS records? #

When troubleshooting, you should not only check what is entered in an administrative interface, but also, if necessary, check what information is actually resolved via DNS.

This is helpful, for example, after:

• a change in the IP address
• a nameserver change
• an MX change
• a hosting change
• the setup of an external service

We explain how to check current DNS information for a domain at Check DNS records: View current DNS configuration of a domain.

Edit DNS records at CURIAWEB #

If the DNS zone of your domain is managed via your CURIAWEB hosting, you can manage the records in cPanel via the Zone editor view and edit.

We explain the practical operation at Using the DNS Zone Editor in cPanel.

Always check the purpose of the record in question before making a change.

Important: Do not delete a DNS record simply because its purpose is unknown to you. Existing records may be required for websites, email, SSL/TLS, verifications, or external services.

Common mistakes in DNS records #

Many DNS problems are not caused by a failure of DNS itself, but by a misconfiguration.

Typical causes include, for example:

• an incorrect IP address in an A or AAAA record
• an outdated AAAA record
• an incorrect CNAME destination
• faulty MX records
• multiple independent SPF policies
• faulty CAA restrictions
• An entry was changed in the wrong DNS zone
• The change was made on non-authoritative name servers

The last point in particular is important: A correctly looking entry in an administrative interface has no effect if this DNS zone is not even used authoritatively for the domain.

Why does my DNS change still show the old value? #

After a change, DNS resolvers may still have a previous value cached.

Therefore, a query at one location may already return the new value, while the previous information is still temporarily used elsewhere.

Do not repeatedly change a correct DNS entry just because the result is not yet visible everywhere immediately after the change.

Change DNS record or nameserver? #

These two processes should also be clearly separated.

When you change an A, MX, or TXT record, you are editing a single piece of information within the existing DNS zone.

If, on the other hand, you change the authoritative name servers of a domain, you are changing the DNS infrastructure responsible for the zone.

Therefore, when changing nameservers, it must be ensured that the required DNS configuration is fully present on the new nameservers.

Note: Changing a single DNS record = changing a part of the zone. Changing the nameserver = transferring responsibility for the DNS zone.

DNS records and domain transfers are also different things #

A domain transfer transfers the management of a domain to another registrar.

That is not the same as changing A, MX, or TXT records.

Depending on the transfer and configuration, the existing nameservers and thus the DNS resolution can remain unchanged.

Conversely, you can change DNS records without transferring the domain to another registrar.

We will discuss the general procedure under Domain transfer to CURIAWEB: How the transfer works.

Summary #

DNS uses different record types for different tasks.

A A-Record connects a name to an IPv4 address, while a AAAA record used IPv6 for this.

A CNAME record defines an alias to another DNS name and is not an HTTP redirect.

MX records define the mail servers for incoming emails of a domain and can have different priorities.

TXT Records are used, among other things, for SPF, DKIM, DMARC, and domain verifications.

With CAA records it can be restricted which certification authorities are allowed to issue certificates for a domain.

Additional record types such as NS, SOA, and SRV fulfill additional tasks within the Domain Name System.

DNS records should always be changed purposefully and with knowledge of their function. An incorrect change can affect not only a website, but also email, certificates, or external services of a domain.