Understanding DNS records: A, AAAA, CNAME, MX, TXT

DNS is the Internet's phone book: it translates names into IP addresses. Misconfigured, it can make a site invisible for hours. Well understood, it becomes a powerful tool.

• A and AAAA records point a name to an IP address, CNAME creates an alias.
• Lower the TTL to 300 s at least 48 h before an IP change.
• Never use a CNAME at the root of the domain.
• Enable DNSSEC and export the zone regularly.

The essential record types

Each record has a specific role. A points a name to an IPv4, AAAA to an IPv6, CNAME creates an alias to another name, MX designates mail servers and TXT carries free-form information, including ownership proofs and anti-spam policies.

• A / AAAA: the name to the server's IP address (v4 and v6).
• CNAME: an alias (www to the main domain), never at the root.
• MX: email reception; TXT: SPF, DKIM, DMARC and verifications.

TTL and propagation: why “it's not working yet”

The TTL (Time To Live) tells how long a resolver can keep a response in cache. A 24-hour TTL means a change can take a full day to propagate everywhere. Before a migration, lower the TTL to 300 seconds 48 hours in advance.

• Lower the TTL to 300 s at least 48 hours before any IP change.
• Test with a public resolver (1.1.1.1, 8.8.8.8) rather than your local cache.
• Never jump to conclusions: propagation takes time by nature.
• Server change ahead: choose your VPS before editing the records.

The classic mistakes that break everything

A CNAME at the root of the domain (forbidden by the standard and a source of mail outages), an MX pointing to a CNAME instead of an A record, an SPF with too many lookups, or a forgotten trailing dot in command-line tools: the list of pitfalls is long but well known.

• Never a CNAME on the root domain (use A/AAAA or ALIAS).
• MX records must point to names with an A/AAAA record.
• Check SPF/DKIM/DMARC after every change of email provider.

Securing and hardening your DNS zone

Enable DNSSEC to cryptographically sign your zone, use at least two nameservers on separate networks, and keep an export of your zone at hand. If your DNS provider has a problem, you'll be able to migrate in minutes. To host your site behind these records, see the ACLClouds Linux VPS plans.

• Enable DNSSEC at your registrar and DNS host.
• Regularly export the zone (BIND format) as a backup.
• Monitor domain expiry with alerts at 60, 30 and 7 days.