DNS records are instructions stored for your domain that tell the internet where to find your services. An A record points your domain to a server's IPv4 address, AAAA does the same for IPv6, CNAME makes one name an alias of another, MX says which servers receive your email, and TXT holds text used for verification and email security. Get these right and your website and email just work.
This guide explains each common record type, shows example records, and covers the mistakes that cause most DNS problems.
How DNS works in 30 seconds
When someone types example.co.za into a browser, their device asks a DNS resolver (usually run by their ISP or a public DNS service) for the address. The resolver finds the domain's nameservers, which are the servers holding your DNS records, and asks them. The answer comes back, the browser connects to that IP address, and your site loads.
The resolver caches the answer for as long as the record's TTL (time to live) allows, so the next lookup is instant. That's also why DNS changes aren't always visible immediately.
Anatomy of a DNS record
Every record has the same basic parts:
www.example.co.za. 3600 IN A 203.0.113.10
| Part | Meaning |
|---|---|
www.example.co.za. |
The name (host). @ is often used in dashboards to mean the bare domain |
3600 |
TTL in seconds (here, one hour) |
IN |
Class, almost always IN (internet) |
A |
Record type |
203.0.113.10 |
The value |
The records you'll use most
A record - domain to IPv4 address
Points a name to an IPv4 address. This is how most websites are connected to their server.
example.co.za. 3600 IN A 203.0.113.10
AAAA record - domain to IPv6 address
The same as an A record, but for IPv6 addresses. Only add one if your server actually supports IPv6; a wrong AAAA record can make the site fail for visitors on IPv6 networks.
example.co.za. 3600 IN AAAA 2001:db8::10
CNAME record - alias to another name
Makes one name point to another name instead of an IP address. Common for www and for services that give you a hostname to point at.
www.example.co.za. 3600 IN CNAME example.co.za.
Two rules: a CNAME can't be used on the bare domain (example.co.za itself) in standard DNS, and a name with a CNAME can't have other records alongside it.
MX record - where email is delivered
Tells other mail servers where to deliver email for your domain. The number is a priority: lower numbers are tried first.
example.co.za. 3600 IN MX 10 mail.example.co.za.
example.co.za. 3600 IN MX 20 mail2.example.co.za.
MX records must point to a hostname, not directly to an IP address, and that hostname needs its own A record.
TXT record - text for verification and email security
Holds free-form text. It's used for domain verification (Google Search Console, Microsoft 365 and others) and for email authentication:
example.co.za. 3600 IN TXT "v=spf1 mx include:_spf.example.net -all"
_dmarc.example.co.za. 3600 IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]"
default._domainkey.example.co.za. 3600 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."
- SPF lists the servers allowed to send mail for your domain. You should have only one SPF record per domain.
- DKIM publishes a public key that receivers use to verify your mail's signature.
- DMARC tells receivers what to do with mail that fails SPF and DKIM checks, and where to send reports. See dmarc.org for the specification.
Our guide to SPF, DKIM and DMARC covers these in depth.
Other record types worth knowing
| Type | What it does | When you'll see it |
|---|---|---|
| NS | Lists the nameservers for a domain or subdomain | Delegating DNS to a provider |
| SOA | Start of authority: zone serial number and timers | Created automatically by your DNS host |
| SRV | Points a service (with port and priority) to a host | Some VoIP, chat and Microsoft 365 setups |
| CAA | Lists which certificate authorities may issue SSL for your domain | Tightening SSL security |
| PTR | Reverse DNS, IP to name | Set by whoever controls the IP, important for mail servers |
A CAA record that allows only Let's Encrypt looks like this:
example.co.za. 3600 IN CAA 0 issue "letsencrypt.org"
If you add CAA, make sure it includes every certificate authority you use, or certificate renewals will fail.
Checking your DNS records
You can look up any public record from the command line:
dig example.co.za A +short
dig example.co.za MX +short
dig example.co.za TXT +short
dig www.example.co.za CNAME +short
On Windows, use nslookup -type=MX example.co.za. Online DNS lookup tools do the same from a browser.
Common DNS mistakes
- Editing records at the wrong provider. Records only take effect at the nameservers your domain uses. Check your NS records first; see what nameservers are.
- Multiple SPF records. Merge them into one
v=spf1record. - Forgetting the trailing dot in raw zone files, which turns
mail.example.co.za.intomail.example.co.za.example.co.za. Most dashboards handle this for you. - Long TTLs before a migration. Lower the TTL a day or two before you change servers.
- Deleting "unknown" TXT records that were actually verification or DKIM records.
- A CNAME on the bare domain, which conflicts with the MX and other records there.
Frequently asked questions
How long do DNS changes take to work?
New records are often visible within minutes. Changes to existing records depend on the old TTL, because resolvers keep the cached answer until it expires. Nameserver changes can take longer, as they involve the registry as well.
What's the difference between an A record and a CNAME?
An A record points a name directly to an IP address. A CNAME points a name to another name, which is then resolved to an IP. Use A records for the bare domain and CNAMEs for aliases like www or third-party services.
Why isn't my email working after I changed DNS?
Check that your MX records point to the right mail server, that the mail hostname has an A record, and that your SPF record includes your mail server. If you changed nameservers, make sure all the old records were recreated at the new provider.
Can I have more than one MX record?
Yes. Multiple MX records with different priorities provide fallback. Mail is delivered to the lowest priority number first, and tried on the next if that server is unavailable.
With NewHost, DNS for your domains is managed in the same dashboard as your hosting, using NewHost DNS by default. Register or transfer a domain on the domains page, and read how to point your domain to your hosting next.