DNS records are instructions that tell the internet where your domain's traffic should go. Each record type does one specific job: A and AAAA point a name at a server, CNAME aliases one name to another, MX routes email, TXT holds verification and authentication data, SRV points at specific services, and CAA controls who can issue SSL certificates for your domain.
You edit all of these from the same place: Domains, click your domain, open the DNS subpage. See DNS records and how to manage them for the editor walkthrough. This article is about what each record type actually does and when you'd reach for it.
A and AAAA: pointing a name at a server
An A record maps a name to an IPv4 address, like 192.0.2.1. It's the record that makes yourdomain.com load your site. An AAAA record does the same thing for IPv6 addresses.
You'll touch an A record when:
- You're pointing a domain at hosting for the first time.
- You're moving a domain to a different server and need to update the IP.
- You're setting up a subdomain (like
app.yourdomain.com) to point somewhere different from your root domain.
Most sites today don't set an AAAA record unless the host specifically provides an IPv6 address. If you don't have one, that's fine. IPv4 alone works.
CNAME: aliasing one name to another
A CNAME record makes one name an alias for another. The classic example: www.yourdomain.com pointing to yourdomain.com, so both load the same site without you maintaining two separate A records.
The rule that trips people up: you can't put a CNAME on the root domain (the @ name). Root domains need an A or AAAA record. CNAMEs only work on subdomains like www, blog, or shop.
You'll use a CNAME when a third-party service tells you to point a subdomain at their infrastructure, for example a help desk tool, a landing page builder, or a CDN. They give you a target hostname, you create a CNAME pointing your subdomain at it.
MX: routing email
An MX record tells the world where to deliver email for your domain. It has a priority number and a value, for example priority 10 pointing at mail.yourdomain.com. Lower priority numbers are tried first.
If you're using our hosting email, MX records are set automatically. You don't need to touch them. If you're moving email to Google Workspace, Microsoft 365, or another provider, you'll replace the existing MX records with the ones that provider gives you. Get this wrong and mail either bounces or gets delivered to the wrong place, so copy the values exactly, including priority numbers.
TXT: verification and email authentication
TXT records hold arbitrary text, and they've become the catch-all for proving things about a domain without touching its actual traffic routing. Common uses:
- SPF - declares which mail servers are allowed to send email as your domain. Helps prevent spoofing.
- DKIM - holds a cryptographic signing key so receiving mail servers can verify a message actually came from your domain and wasn't altered in transit.
- DMARC - tells receiving mail servers what to do when SPF or DKIM checks fail (quarantine, reject, or do nothing).
- Domain verification - Google Search Console, Microsoft 365, and similar services ask you to add a
TXTrecord with a specific string to prove you control the domain.
For hosted domains using our email, SPF and DKIM are configured automatically. DMARC isn't set by default, so if you want it, you'll add that TXT record yourself. If you're setting up a new domain-verification TXT record for a third-party service, paste the exact value they give you, don't edit it.
SRV and CAA: specialty records
SRV records point at a specific service running on a specific port, commonly used for things like SIP (VoIP) or certain chat and federation protocols. The record includes a priority, weight, port, and target hostname. Most people never create one; you'll only need it if a specific service's setup instructions tell you to.
CAA records restrict which certificate authorities are allowed to issue SSL certificates for your domain. If you set a CAA record naming only letsencrypt.org, no other certificate authority can issue a valid cert for your domain, even if someone tried to. This is a security hardening step, not something required for SSL to work. If you don't set one, any certificate authority can issue for your domain, which is the default and fine for most people.
How these connect to nameservers and propagation
All of this only applies if your domain uses our nameservers. Records you edit take effect on our side within a minute or two, though resolvers around the world may take longer to pick up the change; see how long does DNS propagation take for what's happening during that window. If your domain uses different nameservers, you'll manage these same record types at your other DNS provider instead. For background on which nameservers we use and why, see our nameservers and DNS provider.
If you're changing ownership of the domain itself rather than its DNS, that's a different process. See domain contacts for how registrant, admin, tech, and billing roles work.
When to get help
If you're not sure which record type to use for a specific instruction from a third-party service, or a change didn't behave the way you expected after enough time has passed for propagation, open a ticket from Support → New ticket in the portal. Real people look at these, and DNS mistakes are easy to make and easy to fix once someone's looking at the actual record set.