DNS record types, explained without jargon

DNS is a phone book. Each record type answers a different question about your domain.

A — where the website lives

Points a name at an IPv4 address.

@ means the domain itself. Almost every site needs an A record for @ and either an A or CNAME for www.

AAAA — same thing, IPv6

Identical in purpose, but the value is an IPv6 address. Having one alongside your A record is good practice and costs nothing.

CNAME — an alias to another name

Points one name at another name rather than an address.

The rule that catches people out: a CNAME cannot coexist with any other record on the same host, and that includes the root @. If you try to CNAME your root domain you'll break your MX records and your email with them. Use an A record at the root.

MX — where email goes

Tells the world which server accepts mail for your domain. Lower priority numbers are tried first.

If you use Microsoft 365 through us, this is set up for you. If you change nameservers without copying your MX records across, incoming email stops — see How to change your nameservers.

TXT — arbitrary text, mostly verification and email security

Three uses you'll actually meet:

SPF — lists who may send email as your domain:

v=spf1 include:spf.protection.outlook.com -all

You may only have one SPF record. Two is a misconfiguration and mail providers treat it as a failure. Merge them into one instead.

DKIM — a public key used to sign your outgoing mail. Your mail provider gives you the value.

DMARC — tells receivers what to do when SPF or DKIM fails:

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com

Start with p=none for a couple of weeks and read the reports before moving to quarantine or reject.

SRV — a service on a specific port

Used by VoIP, Microsoft Teams, Minecraft servers and similar. The provider always tells you exactly what to enter.

CAA — which authorities may issue your certificates

Restricts SSL issuance to named certificate authorities. Optional, but worth having:

0 issue "letsencrypt.org"

If you add one, include every authority you use. A CAA record that omits your certificate provider will silently block renewal.

TTL — how long answers are cached

Time To Live, in seconds. 3600 (one hour) is a sensible default.

Before a planned change, drop the TTL to 300 a day ahead. Resolvers then pick up the new value within five minutes instead of an hour. Put it back afterwards.