Domain Name System (DNS) Records, Email Authentication & TTL Reference
Exhaustive syntax guide for A, AAAA, CNAME, ALIAS, MX, TXT, SPF, DKIM, DMARC, and CAA security records.
Table of Contents
Standard Host Routing Records
Pointing domains to web servers and CDN endpoints.
| Record Type | Target Value | Example Record | Rule & Behavior |
|---|---|---|---|
| `A` | IPv4 Address (32-bit) | `example.com. 300 IN A 104.19.192.175` | Points hostname directly to an IPv4 server address. |
| `AAAA` | IPv6 Address (128-bit) | `example.com. 300 IN AAAA 2606:4700::6813` | Points hostname to modern IPv6 global routing address. |
| `CNAME` | Canonical Hostname | `www 300 IN CNAME docswift.pages.dev.` | Aliases one hostname to another. CANNOT coexist at zone apex (`@`) in standard DNS. |
| `ALIAS / ANAME` | Apex Hostname | `@ IN ALIAS custom.pages.dev.` | Virtual record provided by Cloudflare/Route53 that flattens CNAME at root apex. |
Email Deliverability & Anti-Spoofing Suite
Mandatory security records required by Google (Gmail) and Yahoo to prevent emails from going to spam.
| Record | Type | Example Value Syntax | Protection Purpose |
|---|---|---|---|
| `MX` | Priority + Host | `10 mail.example.com.` | Routes inbound email to designated mail servers (lower number = higher priority). |
| `SPF` | TXT | `v=spf1 include:_spf.google.com ~all` | Specifies which IP addresses are authorized to send mail from this domain. |
| `DKIM` | TXT (Selector) | `v=DKIM1; k=rsa; p=MIGfMA0GCSq...` | Provides public cryptographic key used to verify email digital signatures. |
| `DMARC` | TXT (`_dmarc`) | `v=DMARC1; p=reject; rua=mailto:[email protected]` | Enforces policy on emails failing SPF/DKIM (none, quarantine, reject). |
Security & Verification Records
Controlling SSL certificate issuance and ownership proof.
| Record Type | Syntax Example | Security Function |
|---|---|---|
| `CAA` | `0 issue "letsencrypt.org"` | Specifies which Certificate Authorities (CAs) are permitted to issue SSL certificates for this domain. |
| `TXT` | `google-site-verification=...` | Proves domain ownership to Google Search Console, GitHub, and Cloudflare. |
Interactive Client-Side Tools for this Guide
Test and run these patterns directly inside your browser with zero server uploads:
Frequently Asked Questions
Why can I not put a standard CNAME record on the root domain (@)?
RFC 1034 forbids CNAME records on the zone apex because a CNAME forbids any other records (like MX, NS, or SOA) from coexisting with it. Cloudflare solves this using "CNAME Flattening" (ALIAS record).
What is DNS TTL (Time to Live)?
TTL tells DNS resolvers (like Google 8.8.8.8 or Cloudflare 1.1.1.1) how many seconds to cache a record before querying authoritative nameservers again. A 300s TTL allows changes to propagate in 5 minutes.