DNS record types
Understand address, alias, mail, and text records. Check the record name separately from its value.
PPORT ·
Quick start
- Identify the role of the record.
- Set the name and value correctly.
- Compare the result and relevant caches.
Record types
| Type | Purpose |
|---|---|
| A | IPv4 address |
| AAAA | IPv6 address |
| CNAME | Alias to another DNS name |
| MX | Mail exchange; lower preference is tried first |
| NS | Authoritative nameservers |
| TXT | Text, including SPF and verification records |
| SOA | Zone authority and timing information |
| CAA | Certificate authority authorization |
Aliases and the zone apex
A CNAME points to another DNS name. A name with a CNAME generally cannot also hold other data, so the zone apex cannot use an ordinary CNAME alongside its SOA and NS records. Provider-specific flattening or ALIAS features are separate mechanisms.
Mail authentication records
SPF is commonly stored in a TXT record at the sending domain. DMARC uses _dmarc.example.com; DKIM uses a selector such as selector._domainkey.example.com.
Use the actual domain and selector. A record being present does not confirm that its policy is correct or that real messages pass authentication.
After a change
Compare the authoritative configuration, recursive resolver answers, and client cache. TTL is not a global propagation timer. Distinguish an absent name from an absent record type and from a resolver failure.
Commands to compare before and after
Replace example.com with a domain you administer. Query A and AAAA separately; record name, type, address and time. IPv4 and IPv6 can point to different servers. These read-only DNS queries disclose the queried domain to the resolver.
Compare the default resolver with 1.1.1.1 to observe different viewpoints. Different answers do not automatically mean misconfiguration: consider geographic CDN answers and split DNS. In dig, +noall +answer shows only the answer section. If empty, remove those options and inspect the response status.
Resolve-DnsName example.com -Type A
Resolve-DnsName example.com -Type AAAA
Resolve-DnsName example.com -Type A -Server 1.1.1.1dig example.com A +noall +answer
dig example.com AAAA +noall +answer
dig @1.1.1.1 example.com A +noall +answerExample: old address after lowering TTL
Illustration: at 10:00 a resolver receives the old A record with TTL 3,600 seconds. At 10:10 the operator changes the address and lowers TTL to 300. That change does not retroactively shorten the cached old response to 300 seconds. Expiry, refresh and resolver policy can leave the old value visible for a while.
For a planned migration, lower TTL ahead of time and allow for the previous TTL. Compare authoritative configuration separately from user-side lookups. PPORT uses a server-side resolver and application cache; it is not a worldwide propagation test or a direct authoritative query.
Distinguishing DNS failures
NXDOMAIN says the queried name, or the end of an alias chain, does not exist. NODATA describes an existing name without the requested record type. Missing AAAA does not prove the whole site is absent. A previously negative answer may remain cached after adding a record.
SERVFAIL and timeout are not equivalent to missing records. Delegation, DNSSEC validation, server responses or network conditions may require investigation. PPORT can omit some per-type errors, so do not classify NXDOMAIN, NODATA or validation failure from an empty result alone. Check local response status and authoritative DNS configuration.