How to configure DNS records: A, AAAA, CNAME, MX, and TXT explained

Every domain name needs DNS records to work. When you type a URL, DNS records tell the browser where to find your website, where to deliver your email, and how to prove you own the domain. This guide explains the five DNS record types you will configure most often — A, AAAA, CNAME, MX, and TXT — with practical examples you can adapt to your own domain.

What DNS records do

DNS (Domain Name System) is the phone book of the internet. When you visit example.com, your browser asks a DNS resolver for the IP address of that domain. The resolver queries authoritative nameservers, which return DNS records that map your domain name to specific destinations: web servers, mail servers, verification tokens, or other domains.

Every DNS record has a type (what it does), a name (usually @ for the root domain or a subdomain), a value (the destination), and a TTL (Time To Live — how long resolvers cache the record before asking again). Most hosting providers give you a DNS management panel where you add and edit these records.

A record — point a domain to an IPv4 address

The A record maps a domain or subdomain to a 32-bit IPv4 address (for example, 192.0.2.1). This is the most common record type — it tells browsers the numeric address of your web server.

Example — root domain to a server:

Type: A
Name: @
Content: 192.0.2.1
TTL: 300

Example — www subdomain redirect:

Type: A
Name: www
Content: 192.0.2.1
TTL: 300

If your hosting provider gives you a dedicated IP address, use an A record. Many modern platforms (Cloudflare Pages, Netlify, Vercel) use CNAME records instead of A records.

AAAA record — point a domain to an IPv6 address

The AAAA record (quad-A) maps a domain to a 128-bit IPv6 address (for example, 2001:db8::1). It works identically to an A record but for the newer IP addressing scheme. Most websites have both A and AAAA records so visitors on both IPv4 and IPv6 networks can reach the site.

Example:

Type: AAAA
Name: @
Content: 2001:db8::1
TTL: 300

If your host does not provide an IPv6 address, you can skip the AAAA record for now. Both records are optional, but having both improves reachability.

CNAME record — alias one domain to another

A CNAME record makes one domain name an alias for another. When a resolver looks up a CNAME, it gets the canonical name and then resolves that instead. CNAMEs are commonly used for subdomains that point to a third-party service.

Example — www pointing to root domain:

Type: CNAME
Name: www
Content: @
TTL: 3600

Example — custom subdomain for a third-party service:

Type: CNAME
Name: crm
Content: salesforce.com
TTL: 3600

A CNAME cannot be set on the root domain (@) in most DNS systems. The root domain must use an A or AAAA record. This is a common mistake — if you try to create a CNAME on @, the DNS provider will reject it.

MX record — direct email to a mail server

The MX (Mail Exchange) record tells mail servers where to deliver email sent to your domain. Unlike other records, MX records point to mail server hostnames, not IP addresses, and include a priority value.

Lower priority = higher preference. If you list multiple MX records, mail servers try the lowest number first and fall back to higher numbers if the first server is unavailable.

Example — Google Workspace mail:

Type: MX
Name: @
Content: ASPMX.L.GOOGLE.COM
Priority: 1
TTL: 3600

Example — multiple mail providers (backup):

Type: MX    Name: @    Content: mail.primary.com    Priority: 10
Type: MX    Name: @    Content: mail.backup.com    Priority: 20

MX records must always point to a hostname — never an IP address. If you are using a managed email service (Google Workspace, Microsoft 365, Proton Mail), your provider gives you specific MX values to enter.

TXT record — verification, SPF, DKIM, and DMARC

TXT records store arbitrary text and serve several purposes: domain ownership verification, email authentication (SPF, DKIM, DMARC), and security records.

Domain verification

When you connect a domain to a service (Google Workspace, Microsoft 365, a CDN, or an SSL provider), the service asks you to add a TXT record to prove you control the domain.

Type: TXT
Name: @
Content: google-site-verification=abc123xyz789
TTL: 3600

The TXT value is unique to your account. Copy it exactly — spaces and quotes matter.

SPF — specify which servers can send email from your domain

SPF (Sender Policy Framework) is a TXT record that lists the mail servers authorized to send email on behalf of your domain. Receiving mail servers check this to detect forged sender addresses.

Type: TXT
Name: @
Content: v=spf1 include:_spf.google.com ~all
TTL: 3600

• v=spf1 — SPF version 1
• include:_spf.google.com — allow Google's servers to send mail
• ~all — softfail (mail from other servers is suspicious but not rejected)

For a simple setup using one email provider, the provider gives you the full SPF string. For complex setups (multiple providers), you add include: entries for each.

DKIM and DMARC

DKIM (DomainKeys Identified Mail) and DMARC (Domain-based Message Authentication, Reporting and Conformance) are more advanced email authentication records. Many email providers set these up automatically or provide the exact records to add.

DNSSEC — signing your DNS data

DNSSEC adds cryptographic signatures to your DNS records so resolvers can verify the records have not been tampered with in transit. When you enable DNSSEC, your domain registrar publishes a DS (Delegation Signer) record in the parent zone.

Note: If your DNS provider supports DNSSEC, enable it in the DNS provider's dashboard — the registrar then needs the DS record information. Cloudflare, Google Cloud DNS, and Route 53 all support DNSSEC.

How to verify your DNS changes

DNS changes are not instant. After you update a record, it can take anywhere from a few seconds to 48 hours to propagate globally, depending on the TTL of the old record and the resolver's cache. The average is 5–30 minutes.

Check propagation with a DNS lookup tool:

• dig A example.com — query A record from your default resolver
• dig @1.1.1.1 A example.com — query Cloudflare's resolver directly
• dig @8.8.8.8 A example.com — query Google's resolver
• Online tools like dnschecker.org show how your records resolve from resolvers worldwide

Check email DNS:

• dig MX example.com — verify MX records are pointing to the right servers
• dig TXT example.com — verify SPF, DKIM, and verification TXT records

Flush your local cache: If your browser or computer is still resolving the old value, flush the local DNS cache:

• macOS: sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder
• Windows: ipconfig /flushdns
• Linux: systemd-resolve --flush-caches or service nscd restart

Common mistakes to avoid

• CNAME on root domain (@) — Most DNS providers block this because RFC 1034 prohibits it. Use an A/AAAA record instead.
• MX records pointing to IP addresses — MX must point to hostnames, not IP addresses.
• Forgetting the trailing dot — In some DNS UIs, values ending in a dot (mail.example.com.) are fully qualified and not relative to the domain. Check your provider's format rules.
• Conflicting records — Having both an A record and a CNAME on the same name causes conflicts. One name, one canonical record.
• Setting TTL too high — When planning a migration, lower your TTL to 300 seconds 24 hours in advance so the change propagates faster.
• TXT records with quotes — Enter the TXT value without surrounding quotes in most DNS UIs. The quotes are part of the zone file format, not the record value.

Summary

Configure these five record types and you can set up virtually any domain for web hosting, email, and third-party services. Always verify changes with dig or an online DNS checker, and plan TTL changes before migrations to minimize downtime.

FAQ

How long does it take for DNS changes to propagate?

Most changes take 5–30 minutes to reach the majority of resolvers globally. The old record's TTL and the resolver's cache behavior determine the actual time. After 48 hours, virtually all resolvers will have the new record.

Can I have both A and CNAME records for the same subdomain?

No. A name cannot be both a canonical record (A/AAAA) and an alias (CNAME) at the same time. If you need a CNAME on a subdomain, do not also create an A record on that same name.

Should I use Cloudflare proxy (orange cloud) with my A record?

For web traffic, yes — Cloudflare proxy adds CDN caching, DDoS protection, and performance optimization. However, MX records should never be proxied. DNS-only MX records are required for email delivery to work correctly.

What is the difference between TTL and propagation?

TTL (Time To Live) is a setting on each DNS record telling resolvers how many seconds to cache it before asking the authoritative nameserver again. Propagation is the informal term for the time it takes all resolvers worldwide to fetch the updated record after you change it.

Do I need to set up DNSSEC?

DNSSEC is recommended for production domains. It prevents DNS spoofing attacks where an attacker redirects your visitors to a malicious server. Most DNS providers make it a one-click toggle once your registrar supports DS records.