DNS Records Explained: A, AAAA, MX, TXT, NS, CAA, SOA, CNAME

DNS records are the connective tissue of the internet. Every domain lookup, email delivery, SSL issuance, and subdomain alias flows through DNS records. But unless you work in infrastructure, most of these acronyms are opaque. This guide explains every DNS record type you'll encounter — what it does, when to use it, and common mistakes.

A record — where the domain points

The A record maps a domain name to an IPv4 address. When you type "github.com" in a browser, DNS resolves it to the A record (currently 140.82.121.4), and your browser connects to that IP.

Every public-facing domain needs at least one A record (or AAAA for IPv6). Our DNS Lookup tool shows all A records grouped together with their TTLs.

AAAA record — IPv6 address

Same as A but for IPv6. AAAA records aren't mandatory, but most modern CDNs (Cloudflare, Fastly) include them by default. IPv6 adoption is around 45% globally (2026 data) and higher for mobile traffic.

MX record — mail servers

MX records tell the world where to deliver email for the domain. A typical domain using Google Workspace has MX records pointing to smtp.google.com; Microsoft 365 uses yourdomain-com.mail.protection.outlook.com.

MX records include a priority number — lower number = higher priority. Usually there are 3-5 MX records with different priorities for redundancy.

TXT record — the Swiss Army knife

TXT records are plain text strings. They're used for:

• SPF — who's allowed to send mail as your domain (e.g., v=spf1 include:_spf.google.com ~all)
• DKIM — cryptographic email signatures
• DMARC — policy for how receivers should handle SPF/DKIM failures
• Domain verification — Google, Microsoft, and many SaaS tools ask you to add a TXT record to prove ownership
• Public notes — some domains use TXT for ownership statements or SRV hints

NS record — authoritative nameservers

NS records tell the world which nameservers are authoritative for the domain. If you use Cloudflare DNS, your NS records will look like irene.ns.cloudflare.com and todd.ns.cloudflare.com. If you use Route 53, they'll be ns-*.awsdns-*.net etc.

CNAME record — canonical aliases

A CNAME says "this hostname is an alias for that hostname." Common uses:

• www.example.com CNAME example.com — the www subdomain is an alias for the apex
• shop.example.com CNAME myshop.myshopify.com — your shop subdomain points at Shopify
• cdn.example.com CNAME d12345.cloudfront.net — your CDN is served by CloudFront

Rule: you can't have a CNAME at the apex (example.com) — most registrars offer ALIAS or ANAME records as a workaround.

SOA record — start of authority

The SOA record holds administrative info about the DNS zone: primary nameserver, admin email, serial number, and TTL defaults. Every zone has exactly one SOA record. You rarely need to read or edit it directly.

CAA record — certificate authority authorization

CAA records restrict which CAs can issue SSL certificates for your domain. Without a CAA record, any CA in the world can issue a cert for example.com. With CAA 0 issue "letsencrypt.org", only Let's Encrypt is allowed.

CAA is a critical defense against CA-level attacks or compromised CAs. Highly recommended for production domains. Every modern CA (Let's Encrypt, DigiCert, Sectigo) is required to check CAA before issuing a cert.

Understanding TTL

Every DNS record has a TTL (time-to-live) in seconds — how long resolvers should cache the record. Common values:

• 300s (5 min) — common default, good for records that change
• 3600s (1 hour) — common for A/AAAA records
• 86400s (24 hours) — common for NS, MX, TXT records that don't change

When you're about to change a DNS record, first lower the TTL (e.g., to 60s) and wait until the old TTL has expired. Then make the change — resolvers will pick it up within 60 seconds instead of an hour.

Check any domain's DNS records

Our DNS Lookup tool queries all 8 record types in parallel via Cloudflare's 1.1.1.1 resolver. You can check any domain's records in under 100ms, color-coded by type. Try it on a popular domain like github.com or openai.com.

Related: WHOIS and subdomains

Once you understand DNS records, two related concepts become useful:

• WHOIS Lookup — who owns the domain, when it expires, which registrar manages it
• Subdomain Finder — discovers every subdomain of a domain via Certificate Transparency logs, not just the ones you know about

Try it now: Check any domain's DNS records for free — A, AAAA, MX, TXT, NS, CNAME, SOA, CAA in one request.