DNS records explained: A, AAAA, CNAME, MX, TXT and NS
Computers connect to IP addresses; people type names. The Domain Name System sits between the two: it takes a name such as example.com and returns the records stored for it — an address, a mail server, a line of text that proves who owns the domain. This guide covers how a lookup travels, what each common record type holds, and why a change you made an hour ago may still not be visible everywhere.
How a name becomes an address
When you open a website, your device asks a recursive resolver — usually run by your internet provider, or a public one such as 1.1.1.1 or 8.8.8.8. If the resolver has the answer in its cache, it replies at once. If not, it works down the hierarchy from the top:
- It asks a root server which servers are responsible for the top-level domain, such as .com. There are 13 root server identities, run by 12 independent organisations from more than 2,000 locations worldwide.
- It asks one of the top-level domain servers which name servers hold the domain example.com.
- It asks one of those authoritative name servers for the record itself, and gets the answer.
The resolver then keeps the answer for as long as the record's TTL (time to live) allows, and every other device that asks within that time gets the stored copy. Most lookups never go further than that cache, which is why DNS is fast — and why changes are slow to spread.
The six records the DNS lookup tool shows
| Type | What it holds | Example |
|---|---|---|
A | An IPv4 address for the name. | example.com → 192.0.2.10 |
AAAA | An IPv6 address for the name. | example.com → 2001:db8::10 |
CNAME | “This name is an alias: look up that other name instead.” | www.example.com → example.com |
MX | The mail servers that accept email for the domain, each with a priority number. | 10 mail.example.com |
TXT | Free-form text, mostly used to prove domain ownership and to publish email security policies. | v=spf1 include:_spf.example.net -all |
NS | The authoritative name servers for the domain. | ns1.example.net |
A name can have several records of the same type. Two A records mean two servers that can both answer; browsers pick one and fall back to the other.
Other record types you will meet
| Type | What it holds |
|---|---|
SOA | Administrative data for the zone: the primary name server, a contact, and timers — including how long a “does not exist” answer may be cached. |
PTR | Reverse DNS: the name for an IP address. Mail servers check it; most other software ignores it. |
SRV | Where a specific service runs — host and port — used by some chat, calling and directory services. |
CAA | Which certificate authorities may issue TLS certificates for the domain. |
HTTPS / SVCB | Connection hints for browsers: supported protocols such as HTTP/3, and alternative endpoints. |
DS / DNSKEY | DNSSEC keys, which let a resolver check that answers were not forged on the way. |
The rules a CNAME must follow
A CNAME says the whole name is an alias, so it cannot share that name with any other record. That has three practical consequences:
- No CNAME at the root of a domain. example.com always has NS and SOA records, so it cannot also be a CNAME; www.example.com can. Many DNS providers offer a workaround called ALIAS, ANAME or CNAME flattening: they follow the alias themselves and publish the resulting addresses as ordinary A and AAAA records.
- No CNAME next to MX or TXT. If shop.example.com is a CNAME, it cannot also have its own MX or TXT record.
- MX and NS records must point to a real host name, never to an alias.
Records that decide where email goes
Mail servers look up the recipient domain's MX records and try them in order of priority — the lower number first. Two MX records with the same number share the load.
A domain that receives no mail at all can say so with a null MX: a single MX record with priority 0 and a single dot as the host. Senders then give up straight away instead of retrying for days.
Three TXT records protect a domain against people sending mail in its name:
- SPF, on the domain itself, lists the servers allowed to send mail for it. A domain must publish only one SPF record, and checking it may not take more than 10 further DNS lookups — a limit that a long chain of include: entries quietly exceeds.
- DKIM, at selector._domainkey.example.com, publishes the public key that verifies the signature on outgoing mail.
- DMARC, at _dmarc.example.com, tells receivers what to do with mail that fails those checks, and where to send reports.
A single piece of text in DNS is limited to 255 characters, so long TXT records are published as several quoted strings. They are joined without spaces when read, so a record split into two pieces is still one record.
TTL and why changes take time
Every record carries a TTL in seconds. A record with a TTL of 3600 can be served from a resolver's cache for up to an hour after it was fetched. When you change a record, resolvers that fetched the old one keep serving it until its TTL runs out. What is often called “DNS propagation” is really this: old copies expiring, one cache at a time.
For a planned change, lower the TTL to a few minutes a day or two beforehand, make the change, and raise it again once it has settled.
“Does not exist” answers are cached too. If you look up a name before creating it, resolvers may remember that it did not exist for as long as the zone's SOA record allows — often an hour.
Reading an answer
| Result | What it means |
|---|---|
NOERROR + records | The name exists and has records of the type you asked for. |
NOERROR, no records | The name exists, but has no records of that type — a domain with no IPv6, for example, has no AAAA. |
NXDOMAIN | The name does not exist at all. Check the spelling, or whether the domain has expired. |
SERVFAIL | The resolver could not get a trustworthy answer. Common causes are broken name servers and a DNSSEC signature that does not verify. |
Why the tool may show a different answer from your computer
The DNS lookup tool asks public resolvers over an encrypted connection — Cloudflare first, then Google if that fails — so it shows what the public internet sees right now. Your own device may answer differently for ordinary reasons: its resolver still has an older copy cached, a VPN or company network has its own internal names, or an entry in the computer's hosts file overrides DNS altogether.
Frequently asked questions
How long does a DNS change take?
Up to the TTL the old record had, counted from the last time each resolver fetched it. A change of name servers can take longer — often a day or two — because the NS records at the top-level domain usually have long TTLs.
Can a domain have both a CNAME and an MX record?
Not on the same name. Put the CNAME on a subdomain such as www, or use your DNS provider's alias-flattening feature at the root.
Why do my TXT records appear in several quoted pieces?
Because a single piece is limited to 255 characters. The pieces are joined without spaces when read, so the record works as written.
Is DNS private?
Classic DNS travels unencrypted, so your network and your provider can see which names you look up. DNS over HTTPS and DNS over TLS encrypt the question between your device and the resolver; the resolver itself still sees it.