Infrastructure · 10 minute read

DNS records: a working reference

DNS is the layer where an outage looks like someone else’s problem. It is also the only part of your stack whose failures never appear in your own logs.

Record types you will actually set

Type	Holds	Notes
`A`	IPv4 address	The basic mapping. Multiple A records give crude round-robin with no health checking.
`AAAA`	IPv6 address	Large mobile networks are IPv6-only internally; without AAAA they reach you through NAT64 and you own neither the latency nor the logs.
`CNAME`	Another name	Cannot coexist with any other record for the same name, which is why a CNAME at the zone apex is illegal — the apex must carry SOA and NS.
`ALIAS` / `ANAME`	Another name, flattened	Provider-specific, not a real record type. Resolves the target and answers with its address, which is how you point an apex at a CDN.
`MX`	Mail host and priority	Lower priority number wins. Must point at a hostname, never an IP. A single dot with priority 0 is a null MX — RFC 7505 for "this domain receives no mail".
`TXT`	Free text	Carries SPF, DKIM, DMARC and domain-verification tokens. 255 characters per string; longer values are split into several quoted strings in one record.
`NS`	Nameserver	Delegation. Must match what the parent zone publishes, or resolvers see a lame delegation.
`SOA`	Zone metadata	Serial, refresh, retry, expire and the negative-caching TTL — the last of which decides how long an `NXDOMAIN` sticks.
`CAA`	Permitted certificate authority	Restricts who may issue for the domain. One line of defence against mis-issuance, checked by every public CA at issuance time.
`SRV`	Service, port and host	Used by SIP, XMPP, Minecraft and Microsoft 365 autodiscovery.
`PTR`	Reverse name	Lives in the provider’s reverse zone, not yours. Matching forward and reverse DNS is effectively mandatory for a mail sender.
`HTTPS` / `SVCB`	Service binding	Advertises HTTP/3, alternative ports and ECH before the first connection. Chrome and Safari query it; it removes a round trip.
`TLSA`	Certificate association	DANE. Requires DNSSEC to mean anything, and is mostly used for SMTP.
`DS` / `DNSKEY` / `RRSIG`	DNSSEC chain	The DS record lives in the parent zone. A DS that no longer matches your DNSKEY makes the entire domain fail to resolve for validating resolvers — the classic self-inflicted DNSSEC outage.

TTL, and why your change has not taken effect

A TTL is how long a resolver may reuse an answer. You cannot shorten it retroactively: a resolver that cached the old value for 86,400 seconds will hold it for the rest of that period no matter what you publish now.

Situation	TTL	Reasoning
Steady state	3600–86400	Fewer queries, faster resolution, lower load on your nameservers.
Before a planned migration	300	Lower it at least one old-TTL period before the change, or the reduction itself is still cached.
During a migration	60–300	Fast rollback if the new target is wrong.
After it has settled	back to 3600+	Low TTLs mean every visitor pays for a lookup and an outage of your nameservers becomes immediately visible.

Mail authentication, as DNS

; SPF - who may send as this domain. One SPF record only, ever.
example.com.          TXT  "v=spf1 include:_spf.google.com ~all"

; DKIM - the public key; the selector is chosen by your mail provider.
sel1._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCSq..."

; DMARC - what to do when SPF and DKIM disagree, plus where to report.
_dmarc.example.com.   TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com; pct=100"

; A domain that sends no mail at all should still say so:
example.com.          MX   0 .
example.com.          TXT  "v=spf1 -all"
_dmarc.example.com.   TXT  "v=DMARC1; p=reject;"

Two SPF records is a permanent error, not a merge — combine them into one. ~all is softfail and is the right place to start; move to -all once reports show nothing legitimate is failing. Keep SPF under ten DNS lookups or it fails with permerror, and note that each include: can cost several.

Checking it from outside

dig +short example.com A
dig +short example.com AAAA
dig example.com MX +noall +answer
dig +short TXT example.com
dig +short TXT _dmarc.example.com
dig +short CAA example.com
dig +trace example.com            # walk the delegation from the root
dig @1.1.1.1 example.com          # ask a specific resolver
dig +nssearch example.com         # compare SOA serials across your nameservers

The last one is the quickest way to catch nameservers that have fallen out of sync, which produces intermittent failures that are otherwise almost impossible to reproduce.