Whoistrackr
DNS Reference Guide

DNS Record Types Explained: A, AAAA, CNAME, MX, TXT, NS, SOA & CAA

The Domain Name System (DNS) translates human-readable domain names into IP addresses, mail routing instructions, and cryptographic verification policies. When diagnosing domain connectivity or email deliverability with Whoistrackr, understanding each resource record type and its Time-to-Live (TTL) behavior is essential.

Core Address & Alias Records

Record Purpose Example Value
A Maps a hostname to an IPv4 address (32-bit). Multiple A records enable round-robin load distribution. 93.184.215.14
AAAA Maps a hostname to an IPv6 address (128-bit). 2606:2800:21f:cb07:6820:80da:af6b:8b2c
CNAME Canonical Name record that aliases one subdomain to another target hostname. Under RFC 1034, a CNAME cannot coexist with other records (like MX or TXT) at the zone apex (@). www.example.com → example.com

Mail Routing & Verification Records (MX & TXT)

MX (Mail Exchanger)

MX records direct inbound email for a domain to one or more mail servers. Every MX record includes a numeric priority (preference value) alongside a target hostname:

  • Lower preference numbers indicate higher priority (e.g., priority 10 is tried before priority 20).
  • MX targets must point to a hostname that resolves to an A or AAAA record—never directly to a CNAME or raw IP address.

TXT (SPF, DKIM, DMARC & Domain Verification)

TXT records carry arbitrary machine-readable text strings and form the foundation of modern email authentication and ownership verification:

  • SPF (Sender Policy Framework): Published at the root domain (e.g., v=spf1 include:_spf.google.com ~all) to specify which mail servers are authorized to send mail on behalf of the domain.
  • DKIM (DomainKeys Identified Mail): Published at <selector>._domainkey.example.com containing the public cryptographic key used by receiving mail servers to verify message signatures.
  • DMARC (Domain-based Message Authentication, Reporting, and Conformance): Published at _dmarc.example.com (e.g., v=DMARC1; p=reject;) to instruct receivers how to handle messages that fail SPF or DKIM alignment.

Authority & Certificate Control Records (NS, SOA, CAA)

  • NS (Name Server): Identifies the authoritative DNS servers for a zone. The NS records in your DNS zone must match the delegation glue records configured at your domain registrar.
  • SOA (Start of Authority): Contains administrative metadata about the zone, including the primary nameserver, zone serial number, refresh interval, retry timer, and negative caching TTL.
  • CAA (Certification Authority Authorization): Specifies which Certificate Authorities (CAs) are permitted to issue TLS/SSL certificates for the domain (e.g., 0 issue "letsencrypt.org").

Understanding TTL (Time to Live)

Every DNS record includes a TTL value measured in seconds. Recursive resolvers cache a record for up to its TTL before querying the authoritative nameserver again. Before migrating web hosts or switching mail providers, lowering the TTL (for example, to 300 seconds) ahead of time minimizes cutover downtime.