Your domain's DNS is just a set of records, and each record type answers a different question. One says where your website lives, another says where your email goes, another proves your mail is legitimate. When you understand what each type does, editing your DNS stops feeling like defusing a bomb and starts feeling like filling in a form. This is a plain-English tour of the record types you will actually run into, grouped by the job they do, so you know which one to reach for and what it controls.
The records that point your domain at a server
These are the ones that decide where your website and services live.
- A record. Maps a name to an IPv4 address (like 203.0.113.10). This is the workhorse: your root domain and most subdomains use an A record to say "the site is at this server." If your website is down after a move, a wrong or missing A record is the usual suspect. See website down after a DNS change.
- AAAA record. The same idea for IPv6 addresses. Modern networks increasingly reach sites over IPv6, and a missing AAAA can make a site unreachable for some visitors. See missing AAAA records.
- CNAME record. An alias that points one name at another name instead of an IP. Common for subdomains like www or a service that says "point a CNAME at us." A CNAME cannot live at your root domain, which is where the next record comes in.
- ALIAS / ANAME record. A provider-specific way to get CNAME-like behavior at the root domain, where a plain CNAME is not allowed. See ANAME and ALIAS records at the root.
The records that route and protect your email
Email has its own stack of DNS records, and inbox placement depends on getting them right.
- MX record. Says which mail server receives email for your domain, and in what priority order. No MX, or a wrong one, and your mail stops. See MX, SPF, DKIM, and DMARC setup.
- TXT record. A flexible text record used for several things, most importantly email authentication. Your SPF record (which servers may send as you), your DKIM key (a signature proving a message really came from you), and your DMARC policy (what to do with mail that fails) all live in TXT records. TXT records are also how many services verify you own a domain. See understanding SPF and how to create a DMARC record.
- PTR record (reverse DNS). Maps an IP address back to a name, the reverse of an A record. Mail servers check it to decide whether to trust a sender, so it matters for deliverability. See reverse DNS, PTR, and FCrDNS.
The records that run the domain itself
You rarely touch these day to day, but they are the foundation.
- NS record. Names the authoritative nameservers for your domain, the servers that hold all the records above. Changing your NS records is how you move your DNS to a new provider, and it is the top of the whole chain. See how DNS delegation works.
- SOA record. The "start of authority" record holds administrative settings for the zone, like the primary nameserver and timing values. There is exactly one per domain, and your provider manages it for you.
The records that add security and extra services
- CAA record. Says which certificate authorities are allowed to issue TLS certificates for your domain, which blocks a rogue authority from issuing one behind your back. See DNSSEC and CAA records explained.
- SRV record. Points to the server and port for a specific service, used by things like VoIP and some chat and calendaring systems. You add these only when a service explicitly asks for one.
How the records work together
It helps to see a single domain use several types at once. Say you run example.com. Your NS records point the whole domain at your DNS provider's nameservers, which hold everything else. An A record on the root sends visitors of example.com to your web server's IPv4 address, and an AAAA record does the same over IPv6. A CNAME on www points www.example.com back at the root so both spellings work. Your MX record sends mail for @example.com to your mail provider, while a TXT record holds the SPF entry that says which servers may send as you, and another TXT record holds your DMARC policy. A CAA record limits which authority can issue your TLS certificate. None of these conflict, because each answers a different question: where the site is, where mail goes, and who is allowed to act for the domain. Editing one record changes one of those answers and leaves the rest alone, which is why a careful DNS change is safer than it feels.
A note on wildcard records
You may also see a wildcard, written with an asterisk like *.example.com. A wildcard record answers for any subdomain you have not defined explicitly, which is handy when you want every possible subdomain to resolve to the same place. Use it deliberately, since a wildcard can mask a typo by resolving a subdomain you never meant to create.
TTL: the setting on every record
Every record carries a TTL, or time to live, which tells resolvers how long they may cache the answer before checking again. A low TTL means changes take effect quickly but resolvers ask more often; a high TTL means the opposite. When you plan a change, lowering the TTL a day ahead makes the switch propagate faster. See DNS propagation and TTL.
How to see all your records at once
To read your current records, you can query them one type at a time with dig, or get the whole picture at once. Our Domain Health Report shows your records across DNS, mail, and security and grades them, so you can spot a missing or misconfigured record without running a dozen separate lookups. Once you know what each type does, that report reads like a checklist of your domain's health, and fixing an issue is usually a matter of correcting a single record.