What is the difference between an A record and a CNAME?

An A record maps a name directly to an IPv4 address. A CNAME makes a name an alias of another name, and resolvers then look up that other name to find the address. A CNAME must be the only record at its name.

Can I use a CNAME at the root domain?

No. The root (apex) of a zone always has SOA and NS records, and a CNAME cannot coexist with other records. Many DNS providers offer ALIAS, ANAME or CNAME flattening instead, which publishes ordinary A and AAAA records for you.

What does the number in an MX record mean?

It is the preference. Sending servers try the MX with the lowest number first and fall back to higher numbers if it is unavailable.

Can a domain have two SPF records?

No. SPF allows only one TXT record starting with v=spf1 at a name. Two of them cause a permanent error, so merge them into a single record.

DNS Record Types Explained: A, CNAME, MX, TXT & More

Every DNS answer is made of resource records. Each record has an owner name, a type, a time-to-live (TTL) and data whose format depends on the type. Knowing what each type is for—and what it cannot do—solves a surprising share of DNS problems before you open a support ticket.

A record looks like this in zone-file format:

www.example.com.   300   IN   A   192.0.2.10
;  owner name      TTL  class type data

The TTL (300 seconds here) is how long resolvers may cache the answer. It matters most when you change something: until cached copies expire, some users still see the old value.

DNS record types at a glance

Type	What it does	Example value
A	Maps a name to an IPv4 address	`192.0.2.10`
AAAA	Maps a name to an IPv6 address	`2001:db8::10`
CNAME	Makes a name an alias of another name	`example.cdn-provider.net.`
MX	Lists the servers that accept email	`10 mx1.example.net.`
TXT	Holds text: SPF, DMARC, verification tokens	`"v=spf1 include:_spf.google.com ~all"`
NS	Names the authoritative nameservers	`ns1.example-dns.net.`
SOA	Administrative settings for the zone	Primary server, serial, timers
CAA	Limits which CAs may issue certificates	`0 issue "letsencrypt.org"`
DS	Links a signed zone to its parent (DNSSEC)	Key tag, algorithm, digest
DNSKEY	Publishes a zone's DNSSEC public keys	Flags, algorithm, key

Address records: A and AAAA

A records map a name to an IPv4 address; AAAA records map it to an IPv6 address. A name can have several of each, and clients will try them in some order.

example.com.   3600  IN  A     192.0.2.10
example.com.   3600  IN  AAAA  2001:db8::10

Two problems come up often. The first is a stale address after moving hosts—the record still points to the old server. The second is publishing an AAAA record for a server that doesn't actually accept IPv6 connections. Clients that prefer IPv6 then wait for a timeout before falling back, which looks like a slow or broken site to some visitors only.

An address in a private range such as 10.0.0.0/8 or 192.168.0.0/16 in public DNS is usually a mistake copied from an internal network.

CNAME: aliases

A CNAME says "this name is an alias; look up that other name instead". It is common for pointing www at a hosting or CDN provider:

www.example.com.  300  IN  CNAME  example.cdn-provider.net.

The rule that trips people up: a CNAME must be the only record at its name. You cannot have a CNAME and an MX or TXT record at the same name. Because the zone apex (example.com itself) always has SOA and NS records, a CNAME is not allowed there. Many DNS providers offer a workaround called ALIAS, ANAME or "CNAME flattening" that resolves the target and publishes ordinary A/AAAA records for you.

MX: mail servers

MX records list the servers that accept email for a domain, with a preference number—lower values are tried first.

example.com.  3600  IN  MX  10 mx1.example.net.
example.com.  3600  IN  MX  20 mx2.example.net.

An MX target must be a hostname with its own A or AAAA records, not an IP address and ideally not a CNAME. A domain that should never receive email can say so explicitly with a "null MX" (MX 0 ., defined in RFC 7505).

TXT: text, SPF and verification

TXT records hold arbitrary text. In practice they carry email policies (SPF, and DMARC at _dmarc.example.com), and ownership tokens for services such as search consoles and certificate authorities.

A common error is publishing two SPF records—two TXT records at the same name that both start with v=spf1. SPF permits only one, and receivers treat duplicates as a permanent error. Merge them into a single record instead.

NS and SOA: zone structure

NS records name the authoritative nameservers for a zone. They appear in two places: in the parent zone (set via your registrar) and in your own zone (set at your DNS provider). The two lists should match—see troubleshooting nameserver mismatches.

The SOA (start of authority) record holds administrative values for the zone: the primary server, a contact address, a serial number that increases on each change, timers for secondary servers, and the TTL used for caching "no such record" answers.

CAA: certificate authority authorization

CAA records list which certificate authorities may issue certificates for a name:

example.com.  3600  IN  CAA  0 issue "letsencrypt.org"

CAA is optional. With no CAA record (at the name or any parent), any public CA may issue. With one, certificate requests through an unlisted CA will be refused—so add your new provider before switching.

DS and DNSKEY: DNSSEC

DNSKEY records publish the public keys a zone signs its data with. A DS record, stored in the parent zone, contains a hash of one of those keys and links the two zones into a chain of trust. They are covered in detail in DS, DNSKEY and RRSIG records explained.

"No records" is not always wrong

When a lookup returns nothing, there are distinct possibilities, and they mean different things:

NOERROR with no answer (often called NODATA): the name exists but has no records of that type. Normal for many names—a mail-only domain has no A record, for example.
NXDOMAIN: the name does not exist at all.
SERVFAIL: the resolver could not get an answer, often because of a DNSSEC failure or unreachable nameservers.
Timeout: no response arrived. This says nothing about whether records exist.

The DNS Record Inspector reports each of these separately, so you can tell a missing record from a failing server.