DNS Records Explained: A, AAAA, CNAME, MX, TXT, SPF, DKIM

DNS (Domain Name System) is the internet's phone book, translating domain names into server addresses. Whenever you set up a website, configure email or connect a service to your domain, you work with DNS records. This guide explains the most common record types along with when to use which.

How does DNS work?

When you type arcnar.com into your browser, this happens:

Your computer asks "what is the IP address of arcnar.com?"
The question reaches the domain's nameservers.
The nameserver looks at the records in the DNS zone defined for that domain.
The value in the matching record (e.g. an IP) is returned and the browser connects to that server.

So you edit your DNS records wherever the domain's nameservers point — this is usually your hosting/server provider's DNS panel.

A and AAAA records — bind a domain to an IP

An A record binds a domain to an IPv4 address: arcnar.com → 203.0.113.10
An AAAA record does the same for IPv6: arcnar.com → 2001:db8::1

You use A/AAAA to point your root domain (yoursite.com) and usually www to a server.

Type   Name   Value            TTL
A      @      203.0.113.10     3600
A      www    203.0.113.10     3600
AAAA   @      2001:db8::1      3600

@ represents the root domain.

CNAME record — point a domain at another domain

A CNAME (Canonical Name) makes a subdomain an alias of another domain. Its most common use:

Type   Name   Value
CNAME  www    yoursite.com

This way www.yoursite.com goes wherever yoursite.com goes. CNAME is also used to connect external services: blog.yoursite.com → xxx.wordpress.com, shop.yoursite.com → shops.myshopify.com.

A CNAME cannot be used on the root domain. You cannot define a CNAME for yoursite.com (the RFC requires other records such as MX and NS to exist at the root). If you need to point the root domain at a service, use the A record that service provides, or use your provider's ALIAS / ANAME support.

MX record — which server receives email?

The MX (Mail Exchange) record tells the internet which server email for your domain should be delivered to. Each MX record has a priority value; the lower number is tried first.

Type  Name  Priority  Value
MX    @     10        mail.yoursite.com
MX    @     20        backup-mail.yoursite.com

If you use Google Workspace, Microsoft 365 or your hosting's email server, you enter the MX records that service provides exactly. If the MX record is wrong, no email reaches your domain.

TXT record — verification and email security

A TXT record holds free text. Its main uses:

Domain verification: services like Google, Microsoft and Meta say "add this TXT record", you add it, and they confirm the domain is yours.
SPF, DKIM, DMARC: so your outgoing email does not land in spam (below).

A domain can have multiple TXT records.

SPF — who can send email on your behalf?

SPF (Sender Policy Framework) is a TXT record that lists the servers allowed to send email for your domain:

Type  Name  Value
TXT   @     "v=spf1 include:_spf.google.com include:mail.yoursite.com -all"

-all means "no server not on the list may send on my behalf". There must be exactly one SPF record per domain.

DKIM — signs outgoing email

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every email you send; the receiving server verifies that signature against the public key in DNS. Your email provider gives you a DKIM TXT record (usually with a name like selector._domainkey.yoursite.com).

DMARC — what to do if SPF/DKIM fail?

Type  Name     Value
TXT   _dmarc   "v=DMARC1; p=quarantine; rua=mailto:[email protected]"

Starting with p=none (report only), observing your email flow, and then moving to p=quarantine or p=reject is the safest path.

Planning to send email: Without at least MX + SPF + DKIM + DMARC, the email you send is put in spam or rejected by Gmail and Outlook. These four are no longer "optional".

NS records and nameservers

The NS record specifies which nameservers manage your domain's DNS. You usually change these in the panel of the company the domain is registered with. NS records are also used to delegate a subdomain's DNS to another provider.

TTL — how long does a change take to propagate?

TTL (Time To Live) is how long, in seconds, a record is kept in caches. TTL 3600 = servers remember this record for 1 hour.

For normal operation, 3600 (1 hour) is a reasonable value.
If you are planning a server migration / IP change, set the TTL of the affected records to 300 (5 min) a few days in advance. At the moment of the switch everyone sees the new value quickly.
Once the migration has settled, raise the TTL again.

Quick reference

Need	Record
Point the root domain at a server	A (+ AAAA)
Point www at the root	CNAME www → yoursite.com
Point a subdomain at a server/service	A or CNAME
Receive email	MX
Send email (without landing in spam)	TXT: SPF, DKIM, DMARC
Verify a domain with a service	TXT
Delegate a subdomain's DNS	NS

At Arcnar: From Panel → Domains → your domain → DNS tab you can add and edit every record type and change the nameservers. A new domain comes with basic A + www CNAME records pre-filled with recommended values.

Frequently asked questions

What is the difference between an A record and a CNAME?

An A record binds a domain directly to an IPv4 address. A CNAME points a domain at another domain as an "alias" (e.g. www.yoursite.com → yoursite.com). A CNAME cannot be used on the root domain (yoursite.com); there you need A/AAAA or ALIAS/ANAME.

How long does a DNS change take to propagate?

A change propagates in the time of the record's TTL — typically a few minutes to 24-48 hours. If you are planning a big change, lowering the TTL to 300 seconds a few days in advance speeds up propagation.

Which records are needed to send email?

At least one MX record (which server receives incoming mail), an SPF record (TXT — which servers may send on your behalf) and preferably DKIM (TXT — signing of outgoing email) with DMARC. Without these three, the email you send lands in spam.

What is a TXT record for?

A TXT record holds free text and is used for verification: SPF policy, DKIM public key, DMARC policy, Google/Microsoft domain verification, and so on. A domain can have multiple TXT records.