You buy a domain, open the DNS settings, and you're greeted by a form asking for a "record type" with a dropdown full of cryptic two- and four-letter codes. A? CNAME? MX? TXT? Pick the wrong one and your site won't load or your email won't arrive.
DNS records are just instructions that tell the internet how to handle your domain — where the website lives, where email goes, how to verify you own it. Once you know what each type is for, that dropdown stops being scary. Here's the field guide.
The records you'll actually use
| Record | Points to | Used for |
|---|---|---|
| A | An IPv4 address | Sending your domain to a server |
| AAAA | An IPv6 address | Same, but for IPv6 |
| CNAME | Another domain name | Aliasing one name to another |
| MX | Mail servers | Telling the world where your email goes |
| TXT | Free-form text | SPF, DKIM, DMARC, domain verification |
| NS | Name servers | Saying who's authoritative for the domain |
| CAA | Certificate authorities | Limiting who can issue your TLS certs |
That covers 95% of what you'll ever touch. Let's go through the important ones.
A and AAAA — the address records
These are the most fundamental: they map a name to an IP address. An A record points to an IPv4 address (192.0.2.10); an AAAA record points to an IPv6 address. When someone visits your site, this is the record that says "the server is here."
example.com → A → 192.0.2.10
CNAME — the alias
A CNAME points one name at another name rather than an IP. Handy for subdomains that should follow wherever another host lives:
www.example.com → CNAME → example.comshop.example.com → CNAME → mystore.shopify.com
The classic gotcha: you generally can't put a CNAME on your root/apex domain (
example.comitself), only on subdomains. Many providers offer "CNAME flattening" or an ALIAS/ANAME record to work around this — reach for that instead of forcing a CNAME at the root.
MX — where email goes
MX (Mail eXchange) records tell other mail servers where to deliver email for your domain. They have a priority number (lower = tried first):
example.com → MX → 10 mail.example.com
No MX records, or wrong ones, and your email silently stops arriving — with no error on your website to hint at it.
TXT — the Swiss army knife
TXT records hold arbitrary text, and they've become the home for email security and verification:
- SPF, DKIM and DMARC (all explained here) all live in TXT records.
- Domain ownership verification ("add this TXT record to prove you own the domain") uses them too.
NS — who's in charge
NS (Name Server) records say which servers are authoritative for your domain — i.e., who holds the real answers. You usually set these at your registrar to point at your DNS provider.
CAA — who can issue your certificates
A CAA record restricts which certificate authorities are allowed to issue TLS certificates for your domain — a small but worthwhile security control.
TTL: the setting on every record
Every record also has a TTL (Time To Live) — how long resolvers may cache it before re-checking. It's not a record type, but it affects every record: a high TTL means changes take longer to roll out. (More on this in how DNS works.)
Pro tip: before changing a record, lower its TTL a day ahead. Then the change takes effect in minutes, not hours.
Quick reference: which record do I need?
| I want to… | Use |
|---|---|
| Point my domain at a server | A (or AAAA for IPv6) |
| Point a subdomain at another host | CNAME |
| Receive email at my domain | MX |
| Set up SPF / DKIM / DMARC | TXT |
| Change my DNS provider | NS (at your registrar) |
| Control who issues my certs | CAA |
The bottom line
DNS records are just routing instructions. A/AAAA send visitors to your server, CNAME aliases names, MX routes email, TXT handles verification and email security, and NS says who's in charge. Get those right and your domain just works.
And because a single wrong record can take your site or email offline while everything else looks fine, it's worth monitoring your DNS — checking that it resolves and returns the records you expect. You can inspect any domain's records right now with the free DNS lookup tool.