DNS Record Types Explained: A, AAAA, CNAME, MX, TXT

DNS record types are the different kinds of entries a domain’s zone can hold, and each one answers a different question about a name. An A record says which IPv4 address a name lives at, an AAAA record gives the IPv6 address, a CNAME says “this name is an alias for that one,” an MX record names the mail servers, and a TXT record holds free-form text that other systems read for verification and policy. Almost every “my site is down after I changed DNS” problem comes down to picking the wrong type or misunderstanding how two types interact.

If you need a refresher on how resolution itself works, start with what DNS is. This guide focuses on what goes inside the zone.

What a DNS record actually contains

Every record, whatever its type, has the same basic shape:

name          TTL    class  type   value
www.example.com. 3600 IN     A      203.0.113.10

• Name — the hostname the record belongs to. @ is the shorthand for the zone apex (the bare domain).
• TTL — time to live, in seconds. Resolvers cache the answer for this long before asking again.
• Class — almost always IN (internet).
• Type — the record type, which determines how the value is interpreted.
• Value — an IP address, another hostname, a priority plus hostname, or a text string, depending on type.

A single name can have several records of the same type (multiple A records for basic round-robin, multiple MX records for redundancy), and several different types at once, with one important exception covered below.

A and AAAA: names to addresses

The A record is the oldest and most fundamental type. It maps a name to a 32-bit IPv4 address. AAAA (“quad-A”) does the same for 128-bit IPv6 addresses; the name comes from an IPv6 address being four times the length of an IPv4 one. The differences between the two address families are covered in IPv4 vs IPv6.

Publish both if your server is reachable over both protocols. Clients that support IPv6 will typically prefer the AAAA answer and fall back to A. Publishing an AAAA record for a host that isn’t actually listening on IPv6 is a classic source of slow or failed connections, because some clients will try IPv6 first and wait.

CNAME: aliases, and the apex problem

A CNAME (canonical name) record says one name is an alias for another. When a resolver hits a CNAME, it restarts the lookup using the target name and returns whatever that resolves to.

www.example.com.  3600  IN  CNAME  example-site.hosting-provider.net.

This is how most hosted platforms and CDNs work: you point your name at a hostname they control, and they can change the underlying IP addresses whenever they like without you editing anything.

The catch is the rule that a name with a CNAME cannot have any other records. That makes a CNAME at the zone apex illegal, because the apex must carry SOA and NS records. Many DNS providers work around this with a non-standard type usually called ALIAS, ANAME, or “CNAME flattening”: the provider resolves the target itself and serves the resulting A/AAAA records at the apex.

Dangling CNAMEs are also a security concern. If you delete a cloud resource but leave the CNAME pointing at it, someone else may be able to claim that resource name and serve content on your domain. That attack is covered in subdomain takeover explained.

MX: where email goes

MX (mail exchanger) records tell sending mail servers where to deliver email for a domain. Each has a priority number and a hostname:

example.com.  3600  IN  MX  10  mail1.example.com.
example.com.  3600  IN  MX  20  mail2.example.com.

Lower numbers are tried first. Equal priorities spread load between servers. The target must be a hostname with its own A/AAAA records, not an IP address and not a CNAME.

TXT: verification and email policy

TXT records hold arbitrary strings. They began as a general-purpose notes field and became the standard place to publish machine-readable policy. The most common uses:

• Domain ownership verification — a service asks you to publish a random token so it can confirm you control the domain.
• SPF — the list of servers allowed to send mail for your domain.
• DKIM — public keys receivers use to verify mail signatures.
• DMARC — the policy telling receivers what to do with mail that fails SPF and DKIM.

How those three fit together is explained in SPF, DKIM, and DMARC explained.

The supporting cast

Type	Purpose	Example value
A	Name to IPv4 address	203.0.113.10
AAAA	Name to IPv6 address	2001:db8::10
CNAME	Alias to another name	site.provider.net.
MX	Mail servers, with priority	10 mail.example.com.
TXT	Free-form text and policy	"v=spf1 include:... -all"
NS	Authoritative nameservers for the zone	ns1.dns-host.net.
SOA	Zone metadata: primary server, serial, timers	(one per zone)
CAA	Which certificate authorities may issue for the domain	0 issue "ca.example"
SRV	Host and port for a named service	10 5 5060 sip.example.com.
PTR	Reverse lookup, IP address back to name	host.example.com.

CAA is worth adding to any domain that serves HTTPS: it narrows which certificate authorities are allowed to issue certificates for you, reducing the impact of a mis-issuance. PTR records live in the reverse zone controlled by whoever owns the IP block, which is why you usually set them through your hosting provider rather than your registrar.

TTLs and propagation

“DNS propagation” is really just caching. When you change a record, resolvers that cached the old answer keep serving it until its TTL expires. There is no global push.

Two practical habits follow:

1. Lower the TTL before a planned change. Drop it to a few minutes a day or so in advance, make the change, then raise it again once things are stable.
2. Remember negative caching. If a resolver looked up a name before the record existed, it may cache the “does not exist” answer for a period defined in the SOA record.

Caching is also why DNS answers are a target for tampering; DNS cache poisoning and its main defense, DNSSEC, are covered separately.

Common mistakes

• CNAME at the apex. Use your provider’s alias or flattening feature instead.
• CNAME alongside other records. A name with a CNAME can’t also have MX or TXT records.
• Missing trailing dot. In zone-file syntax, a hostname without a final . is treated as relative and gets the zone name appended, producing mail.example.com.example.com.
• Multiple SPF records. A domain should publish exactly one SPF TXT record; merge the includes into one.
• Stale records after decommissioning. Remove DNS entries when you remove the resource they point to.

The takeaway

Most of DNS comes down to a handful of record types. A and AAAA map names to addresses, CNAME aliases one name to another (never at the apex, never next to other records), MX routes mail by priority, and TXT carries verification tokens and email policy. Add CAA to restrict certificate issuance, keep TTLs low around planned changes, and clean up records when the infrastructure behind them goes away.