Most executives only think about DNS when something breaks: the website disappears, email starts bouncing, or a vendor asks you to "add a TXT record" and nobody knows where to log in. This is DNS records explained in plain English, for people who need to understand what they are approving without becoming network engineers.

DNS (the Domain Name System) is the internet's directory. When someone types your domain into a browser or sends you an email, their computer asks DNS a question: where does this go? The answers come from records you control in your domain's DNS zone. A handful of record types do almost all the work for a typical business, and once you understand them, most DNS conversations get much simpler.

The zone, the records and who answers

Every domain has a DNS zone: a list of records hosted by a DNS provider. That provider might be your registrar, your web host, or a dedicated service like Cloudflare. Your registrar keeps a pointer, called the nameserver delegation, that tells the world which provider is authoritative for your domain.

Each record has four parts:

  • Name: what the record is about, such as the root domain (often shown as @), www, or _dmarc.
  • Type: what kind of answer it gives (A, CNAME, MX, TXT and so on).
  • Value: the answer itself, such as an IP address or a hostname.
  • TTL: how long other systems may cache the answer before asking again.

A and AAAA records: the address

An A record maps a name to an IPv4 address, the familiar four numbers separated by dots. An AAAA record does the same thing for an IPv6 address.

example.com.        A      203.0.113.10
example.com.        AAAA   2001:db8::10

When a browser asks where example.com lives, the A record answers with the server's address. If your website moves to a new host, this is often the record that changes.

CNAME records: the alias

A CNAME record says "this name is really that other name, go ask about that instead." It points a name at another hostname, not at an address.

www.example.com.    CNAME  example-site.hosting-provider.net.

CNAMEs are popular because the provider can change their addresses without you touching anything. Your record keeps pointing at their hostname, and they control where that hostname leads.

Two rules trip people up. First, a name that has a CNAME cannot have any other records. You cannot put a CNAME and a TXT record on the same name. Second, standard DNS does not allow a CNAME at the root of the domain (example.com itself), because the root must also hold records like MX and NS. Some providers work around this. Cloudflare, for example, uses a technique called CNAME flattening that lets you set a CNAME at the root and answers with the underlying address instead.

MX records: where your email goes

MX (mail exchanger) records tell other mail servers where to deliver email for your domain. Each one has a priority number and a hostname. Lower numbers are tried first.

example.com.        MX  1   smtp.google.com.

That example is the single MX record Google Workspace currently uses. Microsoft 365 uses a tenant-specific hostname shown in your admin center. If you use a mail filtering service, your MX records point at the filter instead, and it passes clean mail on to your mailboxes.

A few practical points:

  • MX records must point at a hostname, not an IP address.
  • If your MX records are wrong or missing, inbound email fails. Outbound mail may still work, which is why this problem sometimes goes unnoticed for a while.
  • MX records only control receiving. They have nothing to do with whether your outgoing mail lands in the inbox. That is the job of TXT records.

TXT records: the notes field that runs your email security

A TXT record holds text. DNS itself does not care what the text says, which is exactly why so many services use it. Three uses matter most.

SPF

SPF lists the servers allowed to send email as your domain. It lives in a TXT record at the root that starts with v=spf1.

example.com.   TXT   "v=spf1 include:_spf.google.com include:spf.protection.outlook.com -all"

You can have only one SPF record per name. Two SPF records is an error under the SPF standard, and receiving servers treat it as a failure. SPF also has a limit of ten DNS lookups, which fills up quickly when every marketing tool asks you to add an include.

DKIM

DKIM publishes a public key that receiving servers use to check the signature on your outgoing messages. Each sending service gets its own record at a name like selector._domainkey.example.com. Some services, including Microsoft 365, have you publish a CNAME that points at a key they host; others give you a long TXT value to paste.

DMARC

DMARC tells receivers what to do when a message claiming to be from your domain fails SPF and DKIM checks, and optionally where to send reports. It lives at _dmarc.

_dmarc.example.com.   TXT   "v=DMARC1; p=quarantine"

Our guide to SPF, DKIM and DMARC goes deeper on all three, including how to handle HubSpot, Mailchimp and other third-party senders.

Verification

The last common use is proving you own the domain. Google Search Console, Microsoft 365, Meta and many others ask you to add a TXT record with a unique string. They check for it, and some keep checking. Deleting an old-looking verification record can quietly break a service months later, so label them when you add them.

NS records: who is in charge

NS records list the nameservers that are authoritative for a domain. You normally do not edit these inside the zone. The ones that matter are set at your registrar, and changing them moves your entire DNS to a new provider. That is a bigger operation than editing a record, and we cover it in our article on DNS migration to Cloudflare.

Other records you might see

Type What it does
SRV Points a specific service (such as older Microsoft Teams or Skype for Business setups) at a host and port
CAA Lists which certificate authorities may issue SSL certificates for your domain
PTR Reverse lookup from an IP address to a name, managed by whoever owns the IP, usually your mail or hosting provider
SOA Administrative details about the zone, managed by your DNS provider

TTL: why changes are not instant

Every record has a TTL in seconds. If a record has a TTL of 3600, a resolver that looked it up may keep using that answer for up to an hour before asking again. That is why a DNS change can appear to work for you and not for a customer: you are seeing a fresh answer, they are seeing a cached one.

The practical lesson: before a planned change, lower the TTL on the records you are about to change, wait out the old TTL, then make the change. Afterward, raise the TTL back. On Cloudflare, the Auto setting is 300 seconds, and records proxied through Cloudflare always use Auto.

Cloudflare's orange cloud

If your DNS is on Cloudflare, you will see a proxy status on A, AAAA and CNAME records. Proxied (orange cloud) means web traffic goes through Cloudflare, and DNS answers return Cloudflare's addresses rather than your server's. DNS only (grey cloud) returns your real address. Only those three record types can be proxied. MX and TXT records are always DNS only, and any hostname used for mail should be set to DNS only as well.

The mistakes we see most

  • Two SPF records instead of one merged record.
  • An SPF record that exceeds ten lookups after years of added tools.
  • A CNAME placed on a name that also needs other records.
  • Mail server hostnames proxied through Cloudflare, which breaks mail.
  • Verification records deleted during cleanup because nobody knew what they were.
  • Records for retired vendors left pointing at addresses someone else now controls. A dangling CNAME to a service you no longer use can let someone else serve content on your subdomain.
  • No documentation of who has the DNS login.

If your zone has grown messy over the years, a review is usually quick and pays for itself the first time it prevents an outage. That is the core of our DNS management service.

Frequently asked questions

What is the difference between an A record and a CNAME?

An A record points a name directly at an IP address. A CNAME points a name at another name, and the final address comes from that other name's records. Use a CNAME when a provider gives you a hostname to point at, and an A record when they give you an IP address.

Can I have more than one MX record?

Yes. Many setups use several MX records with different priorities for redundancy, and receiving servers try the lowest priority number first. Just make sure every MX record points at a server that is actually meant to receive your mail.

Can I have more than one TXT record on my domain?

Yes, you can have many TXT records on the same name, for example several verification strings. The exception is SPF: only one TXT record starting with v=spf1 is allowed per name, so additional senders must be merged into that one record.

How long do DNS changes take to work?

Record changes typically reach most of the internet within the record's TTL, often minutes to an hour. Nameserver changes at the registrar take longer, commonly up to a day or two. Lowering TTLs ahead of a planned change makes the switch faster and easier to reverse.

Where do I edit my DNS records?

At whichever provider your domain's nameservers point to, which is not always the company you bought the domain from. A public lookup of your domain's NS records will show the provider, and that is where the records live.