DNS turns names into the information computers need: which IP serves a website, which server accepts a domain’s email, which keys verify its mail. When you point a domain at a new VPS, you’ll edit a handful of record types. Here’s what each one does.

Anatomy of a record

www.example.com.   3600   IN   A   203.0.113.10
└── name           └ TTL  └class └type └ value
  • Name — the hostname. @ in DNS panels means the bare domain (example.com).
  • TTL — seconds that resolvers may cache the answer. See DNS propagation and TTLs.
  • Type and value — what the record says.

A — IPv4 address

example.com.       A    203.0.113.10
www.example.com.   A    203.0.113.10

The core record for a website: “this name lives at this IPv4 address”. Point both the bare domain and www at your server (or make www a CNAME).

AAAA — IPv6 address

example.com.   AAAA   2001:db8::10

Same as A, for IPv6. Only add it if the server really answers on that IPv6 address — otherwise IPv6 users (and Let’s Encrypt validation) will fail. See configuring IPv6.

CNAME — alias to another name

www.example.com.    CNAME   example.com.
shop.example.com.   CNAME   shops.myplatform.com.

“This name is an alias; look up that other name instead.” Rules:

  • A CNAME can’t coexist with other records at the same name.
  • The bare domain (example.com) can’t be a CNAME, because it must also have NS and SOA records. Some DNS providers offer “CNAME flattening” or ALIAS/ANAME records to work around this.
  • Don’t point MX or NS records at a CNAME.

See A record vs CNAME.

MX — mail servers

example.com.   MX   10 mail.example.com.
example.com.   MX   20 backup-mx.example.net.

Which servers accept email for the domain, with a priority (lower = preferred). The target must be a hostname with an A/AAAA record, not an IP. Using a hosted email provider? Enter the MX records they give you. See MX records.

TXT — text, mostly for verification and email security

example.com.                      TXT  "v=spf1 mx include:_spf.mailprovider.com -all"
default._domainkey.example.com.   TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqh…"
_dmarc.example.com.               TXT  "v=DMARC1; p=quarantine; rua=mailto:[email protected]"
example.com.                      TXT  "google-site-verification=…"
  • SPF — which servers may send mail for the domain.
  • DKIM — public key that verifies signatures on outgoing mail.
  • DMARC — policy for mail failing SPF/DKIM, plus reporting.
  • Verification tokens — proving ownership to Google, Microsoft and others.

A domain should have only one SPF record. See SPF, DKIM and DMARC and TXT records.

NS — nameservers

example.com.   NS   ns1.dnsprovider.com.
example.com.   NS   ns2.dnsprovider.com.

Which servers are authoritative for the zone. The NS records set at your registrar decide where the internet looks for your DNS — if you edit records at a DNS provider that isn’t listed there, nothing changes. NS records within the zone can also delegate a subdomain to other nameservers. See nameservers explained.

SOA — start of authority

One per zone, created by your DNS provider: primary nameserver, admin contact, serial number and timers (including the negative-caching TTL — how long “this name doesn’t exist” is cached). You rarely edit it.

PTR — reverse DNS

10.113.0.203.in-addr.arpa.   PTR   mail.example.com.

Maps an IP back to a name. It’s set by whoever controls the IP address block — your hosting provider — not in your domain’s DNS. Essential for mail servers. On our USA VPS, you can set PTR records in the client area. See PTR records and reverse DNS.

CAA — which certificate authorities may issue

example.com.   CAA   0 issue "letsencrypt.org"
example.com.   CAA   0 issuewild ";"

Restricts certificate issuance to the listed CAs (here: Let’s Encrypt only, no wildcards). Optional, but a good safeguard. See CAA records.

SRV — service location

_sip._tcp.example.com.   SRV   10 60 5060 sip.example.com.

Priority, weight, port and target for a service. Used by SIP, XMPP, Minecraft, Microsoft services and some auto-discovery mechanisms.

A typical setup for a VPS

Name Type Value
@ A your server’s IPv4
www CNAME example.com. (or A to the same IP)
@ MX your mail provider’s servers
@ TXT SPF record
selector._domainkey TXT DKIM key
_dmarc TXT DMARC policy
@ CAA 0 issue "letsencrypt.org" (optional)

Checking your records

dig +short example.com A
dig +short www.example.com
dig +short example.com MX
dig +short example.com TXT

Query the authoritative nameserver directly to bypass caches. See the dig command and DNS propagation.

  • DNS
  • Domains
  • Networking