Domain & DNS Management
Complete Guide to DNS Record Types and Configurations
Last reviewed
Summary: A and AAAA records point a name at an IPv4 or IPv6 address; CNAME makes one name an alias of another; MX tells the world which servers receive your email; TXT holds text used for verification and email security (SPF, DKIM, DMARC). Most website and email problems after a move trace back to one of these five.
Record types at a glance
| Type | Purpose | Example value |
|---|---|---|
| A | Name → IPv4 address | 203.0.113.10 |
| AAAA | Name → IPv6 address | 2001:db8::10 |
| CNAME | Alias to another hostname | example.ca. |
| MX | Mail servers, with priority | 10 mail.example.ca. |
| TXT | Free text: SPF, DKIM, verification | "v=spf1 include:_spf.mailhost.example -all" |
| CAA | Which CAs may issue certificates | 0 issue "letsencrypt.org" |
| NS | Authoritative nameservers | ns1.dnsprovider.example. |
| PTR | Reverse DNS: IP → name (set by IP owner) | mail.example.ca. |
A sample zone file
$TTL 3600
@ IN A 203.0.113.10
@ IN AAAA 2001:db8::10
www IN CNAME example.ca.
@ IN MX 10 mail.example.ca.
mail IN A 203.0.113.20
@ IN TXT "v=spf1 mx -all"
sel1._domainkey IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."
_dmarc IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.ca"
@ IN CAA 0 issue "letsencrypt.org"Email authentication: SPF, DKIM and DMARC
- SPF lists the servers allowed to send mail for your domain. Keep it under 10 DNS lookups and publish only one SPF record.
- DKIM adds a cryptographic signature; your mail provider gives you the public key to publish as a TXT record under a selector.
- DMARC tells receivers what to do when SPF/DKIM fail and where to send reports. Start with p=none, review reports, then move to quarantine or reject.
Large mailbox providers now require SPF, DKIM and DMARC from bulk senders, so set all three even for a small business.
Checking records from the command line
dig +short example.ca A
dig +short example.ca MX
dig +short TXT _dmarc.example.ca
# Ask a specific authoritative server, bypassing caches
dig @ns1.dnsprovider.example example.ca A
# Reverse lookup
dig -x 203.0.113.20 +shortChoosing TTLs
A TTL of 3600 seconds (one hour) is a sensible default. Lower it to 300 a day or two before a planned change such as a server migration, then raise it again afterwards.
Related: domains and DNS overview, SSL/TLS setup and transferring .CA domains.
Get new technical guides by email
Occasional, practical server and hosting tutorials for Canadian webmasters. Unsubscribe any time.