DNS records, explained
DNS records are the settings that connect a domain to everything it does: its website, its email, its certificates and the services that check it. This guide explains every record type one by one, with what each field means, the values it accepts, real examples, common mistakes and how to enter it at your DNS host. Look up any domain's records live, or type a record and have every part explained.
The ones most domains need: A, AAAA, CNAME, MX, TXT, SPF, DKIM, DMARC, Verification, NS.
The five parts of every record
www 3600 IN A 192.0.2.10
| wwwName | Which name the record is for. In a dashboard for example.com, www means www.example.com, and @ means example.com itself. |
|---|---|
| 3600TTL | Time to live: how many seconds resolvers may cache the answer. 3600 is one hour. |
| INClass | Always IN (internet). Most dashboards leave it out. |
| AType | What kind of record it is, which decides what the value means. |
| 192.0.2.10Value | The data. For an A record, an IPv4 address. Each type has its own format, explained on its page. |
Several records can share a name and type (two A records for two servers, five MX records). A name with a CNAME is the exception: it can't have anything else.
Look up any domain's records
Every record type
Websites
Point names at the servers that run your site.
| Type | What it does | How common |
|---|---|---|
| A | Points a name at an IPv4 addressEveryday | Everyday |
| AAAA | Points a name at an IPv6 addressEveryday | Everyday |
| CNAME | Makes a name an alias of another nameEveryday | Everyday |
| ALIAS | A CNAME-like pointer that works at the root (provider feature)Common | Common |
| HTTPS | Tells browsers how to connect: HTTP/3, addresses, ECHCommon | Common |
Receive mail, and prove the mail you send is really from you.
| Type | What it does | How common |
|---|---|---|
| MX | Says which servers receive the domain's emailEveryday | Everyday |
| TXT | Free text: SPF, DKIM, DMARC, verification tokensEveryday | Everyday |
| SPF | Lists the servers allowed to send email as the domain (TXT record)Everyday | Everyday |
| DKIM | Publishes the public key that signs your email (TXT record)Everyday | Everyday |
| DMARC | What to do with mail that fails SPF and DKIM, and where to report it (TXT record)Everyday | Everyday |
| MTA-STS | Makes other servers use encrypted connections to deliver your mail (TXT record)Common | Common |
| TLS-RPT | Asks senders to report TLS problems delivering your mail (TXT record)Common | Common |
| BIMI | Shows your logo next to your email in supporting inboxes (TXT record)Specialist | Specialist |
| Verification | Tokens that prove to a service that you control the domain (TXT record)Everyday | Everyday |
Delegation
Say which servers answer for a domain.
| Type | What it does | How common |
|---|---|---|
| DNAME | Aliases a whole subtree of namesRare | Rare |
| NS | Names the servers that answer for a domainEveryday | Everyday |
| SOA | The zone's header: primary server, contact, version and timersCommon | Common |
Services
Find the host and port for other services, and reverse DNS.
| Type | What it does | How common |
|---|---|---|
| SVCB | Service binding for any protocolSpecialist | Specialist |
| PTR | Reverse DNS: the name for an IP addressCommon | Common |
| SRV | Says which host and port run a serviceCommon | Common |
| NAPTR | Rewrite rules that turn a name or number into a service addressSpecialist | Specialist |
| URI | Publishes a URI for a serviceRare | Rare |
Certificates and keys
Control certificates and publish keys.
| Type | What it does | How common |
|---|---|---|
| CAA | Says which certificate authorities may issue certificatesCommon | Common |
| TLSA | DANE: pins the TLS certificate or key for a serviceSpecialist | Specialist |
| SSHFP | Publishes SSH host key fingerprintsSpecialist | Specialist |
| SMIMEA | Publishes an S/MIME certificate for an email addressRare | Rare |
| OPENPGPKEY | Publishes an OpenPGP public key for an email addressRare | Rare |
| CERT | Stores a certificate or revocation listRare | Rare |
DNSSEC
Sign a zone so answers can be verified.
| Type | What it does | How common |
|---|---|---|
| DNSKEY | DNSSEC: the zone's public signing keysCommon | Common |
| DS | DNSSEC: the parent's fingerprint of your keyCommon | Common |
| RRSIG | DNSSEC: the signature on a set of recordsCommon | Common |
| NSEC | DNSSEC: signed proof that a name or type doesn't existSpecialist | Specialist |
| NSEC3 | DNSSEC: hashed proof of non-existenceSpecialist | Specialist |
| NSEC3PARAM | DNSSEC: the NSEC3 settings for a zoneSpecialist | Specialist |
| CDS | DNSSEC: asks the parent to update your DS automaticallySpecialist | Specialist |
| CDNSKEY | DNSSEC: the key the parent should trustSpecialist | Specialist |
Check a record
Type or paste a record in zone-file form (name, TTL, type, value) or just its value. Each part is explained as you type.
A valid MX record.
| Part | What it means |
|---|---|
| Name@ | @ means the domain itself (the root, or apex), such as example.com. |
| TTL3600 | Resolvers may keep this answer for 1 hour before asking again. Changes can take that long to reach everyone. |
| ClassIN | Internet. Every record you'll write uses IN. |
| TypeMX | Mail server for the domain. |
| Priority10 | Lower numbers are tried first. Servers with the same number share the load. 10 on its own means nothing; only the order between your MX records matters. |
| Mail servermail.example.com. | The host that receives this domain's email. It must have an A or AAAA record, and must not be a CNAME. |
Builders and experiments
- SPF builder: pick your email senders and count the DNS lookups live.
- DMARC builder: policy, reports and alignment, each explained.
- CAA builder: choose which certificate authorities may issue for you.
- Zone playground: paste a whole zone file, find problems, and watch how a resolver answers.
- DNS TTL: why changes take time, and how to make them fast.
The complete list of record types
Every type in the IANA registry you might meet, with its number. Obsolete and query-only types are listed so nothing you see in a lookup or zone file is a mystery.
| Type | Number | Purpose | Status |
|---|---|---|---|
| A | 1 | IPv4 addressin use | in use |
| NS | 2 | Nameserver for a zonein use | in use |
| MD | 3 | Mail destination, replaced by MXobsolete | obsolete |
| MF | 4 | Mail forwarder, replaced by MXobsolete | obsolete |
| CNAME | 5 | Alias to another namein use | in use |
| SOA | 6 | Start of authority for a zonein use | in use |
| MB | 7 | Mailbox domain nameexperimental | experimental |
| MG | 8 | Mail group memberexperimental | experimental |
| MR | 9 | Mail renameexperimental | experimental |
| NULL | 10 | Anything, never used in zone filesexperimental | experimental |
| WKS | 11 | Well-known services, replaced by SRVobsolete | obsolete |
| PTR | 12 | Reverse DNS: address to namein use | in use |
| HINFO | 13 | Host CPU and operating systemin use | in use |
| MINFO | 14 | Mailbox or mail list informationexperimental | experimental |
| MX | 15 | Mail server for the domainin use | in use |
| TXT | 16 | Free text: SPF, DKIM, DMARC, verificationin use | in use |
| RP | 17 | Responsible personin use | in use |
| AFSDB | 18 | AFS database locationobsolete | obsolete |
| X25 | 19 | X.25 addressobsolete | obsolete |
| ISDN | 20 | ISDN addressobsolete | obsolete |
| RT | 21 | Route throughobsolete | obsolete |
| NSAP | 22 | NSAP addressobsolete | obsolete |
| SIG | 24 | Signature, replaced by RRSIGobsolete | obsolete |
| KEY | 25 | Public key, replaced by DNSKEYobsolete | obsolete |
| PX | 26 | X.400 mail mappingobsolete | obsolete |
| GPOS | 27 | Geographical position, replaced by LOCobsolete | obsolete |
| AAAA | 28 | IPv6 addressin use | in use |
| LOC | 29 | Geographical locationin use | in use |
| NXT | 30 | Next domain, replaced by NSECobsolete | obsolete |
| SRV | 33 | Where a service runs: host and portin use | in use |
| NAPTR | 35 | Rewrite rules, used by phone systems (ENUM, SIP)in use | in use |
| KX | 36 | Key exchangerin use | in use |
| CERT | 37 | Certificate or certificate revocation listin use | in use |
| A6 | 38 | IPv6 address in parts, replaced by AAAAobsolete | obsolete |
| DNAME | 39 | Alias for a whole subtreein use | in use |
| OPT | 41 | EDNS options, only in messagesquery only | query only |
| APL | 42 | Address prefix listexperimental | experimental |
| DS | 43 | DNSSEC: fingerprint of a child zone's keyin use | in use |
| SSHFP | 44 | SSH host key fingerprintin use | in use |
| IPSECKEY | 45 | IPsec public keyin use | in use |
| RRSIG | 46 | DNSSEC signaturein use | in use |
| NSEC | 47 | DNSSEC proof that a name doesn't existin use | in use |
| DNSKEY | 48 | DNSSEC public keyin use | in use |
| DHCID | 49 | DHCP client identifierin use | in use |
| NSEC3 | 50 | DNSSEC hashed proof of non-existencein use | in use |
| NSEC3PARAM | 51 | Settings for NSEC3in use | in use |
| TLSA | 52 | DANE: TLS certificate pinin use | in use |
| SMIMEA | 53 | S/MIME certificate for an email addressin use | in use |
| HIP | 55 | Host Identity Protocolin use | in use |
| CDS | 59 | Child's copy of DS, for automatic updatesin use | in use |
| CDNSKEY | 60 | Child's copy of DNSKEY, for automatic updatesin use | in use |
| OPENPGPKEY | 61 | OpenPGP public key for an email addressin use | in use |
| CSYNC | 62 | Child-to-parent sync of NS and gluein use | in use |
| ZONEMD | 63 | Digest of a whole zonein use | in use |
| SVCB | 64 | Service binding: endpoints and settingsin use | in use |
| HTTPS | 65 | Service binding for websitesin use | in use |
| SPF | 99 | SPF as its own type, retired: use TXTobsolete | obsolete |
| EUI48 | 108 | 48-bit hardware (MAC) addressin use | in use |
| EUI64 | 109 | 64-bit hardware addressin use | in use |
| TKEY | 249 | Transaction key, only in messagesquery only | query only |
| TSIG | 250 | Transaction signature, only in messagesquery only | query only |
| IXFR | 251 | Incremental zone transfer requestquery only | query only |
| AXFR | 252 | Full zone transfer requestquery only | query only |
| ANY | 255 | Request for all records (most servers answer briefly)query only | query only |
| URI | 256 | A URI for a servicein use | in use |
| CAA | 257 | Which certificate authorities may issuein use | in use |
| DLV | 32769 | DNSSEC lookaside validation, retiredobsolete | obsolete |
Questions
What is a DNS record?
A line of information in a domain's DNS that says where something lives: which server runs the website (A, AAAA, CNAME), which servers take the email (MX), which services are allowed to send email or issue certificates (TXT, CAA), and which servers answer for the domain at all (NS).
What are the most common DNS record types?
A, AAAA, CNAME, MX, TXT and NS cover almost every domain. Add CAA to control certificates, SRV for some services such as Microsoft Teams, and the TXT-based SPF, DKIM and DMARC for email.
Where do I change my DNS records?
At your DNS host: the company your domain's nameservers point to. That's often your registrar, but if your nameservers are at Cloudflare, Vercel or another host, records must be changed there. Look up the domain's NS records above to see which it is.
How long do DNS changes take?
Up to the old record's TTL, often an hour, because resolvers keep their cached copy until it expires. Nameserver changes can take a day or two. See DNS TTL, and flush your DNS cache to see a change on your own device sooner.
What does @ mean in DNS?
The domain itself, also called the root or apex: in the DNS for example.com, @ means example.com and www means www.example.com.
This guide is also available as Markdown, for AI assistants and offline reading.
Lemon Domains keeps every domain you own in one place, with expiry reminders, change monitoring and DNS editing from your AI assistant. Get started free