DNS records explained for founders: A, CNAME, MX, TXT
What A, AAAA, CNAME, MX, TXT, NS and CAA records do, which ones your app's domain needs, the mistakes that break sites and email, and how to check your setup.
Leer en español →
DNS records are the entries that tell the internet where each part of your domain lives: an A or CNAME record sends visitors to your app's host, MX records send email to your mailbox provider, and TXT records prove ownership and publish email security rules. For a typical app you need a handful of them, and most outages after "connecting a domain" come from one record that is missing, duplicated or pointing to an old service.
This guide explains each record type in plain words, shows a sample setup for an app on Vercel or Netlify with email on a separate provider, and lists the mistakes that most often take a site or inbox offline.
Who is in charge of my DNS?
Three roles are often confused:
- Registrar: the company where you bought the domain and pay the renewal.
- DNS host: the service that stores your records and answers lookups. It may be the registrar, Cloudflare, Vercel, Netlify or another provider.
- Nameservers (NS): set at the registrar, they say which DNS host is in charge.
Only the DNS host named by your nameservers matters. A common trap: you edit records at the registrar while the nameservers point to Cloudflare, so nothing you change has any effect. Before touching anything, run dig ns yourdomain.com (or look it up on Google Public DNS) and edit records where those nameservers belong.
What does each record type do?
| Record | What it does | Typical value for an app |
|---|---|---|
| A | Points a name to an IPv4 address | Your host's IP for the root domain (Vercel suggests one in your project's domain settings; Netlify documents 75.2.60.5) |
| AAAA | Points a name to an IPv6 address | Only if your host tells you to; Vercel does not support IPv6 for custom domains yet |
| CNAME | Makes one name an alias of another name | www pointing to the value your host shows, such as yoursite.netlify.app |
| MX | Says which servers receive email for the domain | Your mailbox provider's servers, with priorities |
| TXT | Free-form text used for verification and email rules | SPF, DKIM keys, DMARC, site verification codes |
| NS | Delegates the domain or a subdomain to a DNS host | Set at the registrar; rarely edited inside the zone |
| CAA | Lists which certificate authorities may issue certificates | Leave empty, or include letsencrypt.org if your host uses it |
Why can't the root domain be a CNAME?
The DNS rules say a name with a CNAME cannot have any other records. The root (yourdomain.com) always carries NS records and usually MX and TXT too, so a CNAME there would conflict. That is why hosts give you an A record for the root and a CNAME for www. Some DNS providers offer "flattening" or ALIAS records that behave like a CNAME at the root; use them only if your host's docs say it supports that.
What does a working setup look like?
Here is a realistic zone for an app on Vercel with Google Workspace email and a transactional email service. The A record value and CNAME target are examples; use the exact values your host and providers show you.
Type Name Value
A @ 76.76.21.21
CNAME www <value shown in your Vercel domain settings>
MX @ smtp.google.com (priority 1)
TXT @ v=spf1 include:_spf.google.com include:<your sender> ~all
TXT google._domainkey v=DKIM1; k=rsa; p=<key from Google>
TXT _dmarc v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comNote that @ means the root domain itself, and the Name field holds only the prefix. Typing www.yourdomain.com in the name field creates www.yourdomain.com.yourdomain.com on many providers, which is one of the most common setup errors.
What is TTL and why does propagation take time?
TTL (time to live) is how many seconds resolvers may cache a record before asking again. If a record had a TTL of one day, some visitors may keep getting the old value for up to a day after you change it. Changes to normal records usually show up fast; changing nameservers can take 24 to 48 hours to reach everyone, according to Vercel's domain docs.
A practical habit: a day before a planned change, lower the TTL on the records you will edit to something like 300 seconds. Make the change once the old TTL has expired, confirm everything works, then raise it again.
Which mistakes break a site or email?
- Moving nameservers and losing email. If you switch nameservers to your web host, the new zone starts empty unless you copy every record. Recreate the MX and email TXT records first, or mail stops arriving.
- Two SPF records. A domain can have only one TXT record starting with
v=spf1. Two of them make SPF fail. Merge them into one record with severalinclude:entries. - Leftover records from a parking page. An old A or AAAA record from the registrar's default page sends some visitors (and certificate checks) to the wrong place. Delete what you don't recognize after confirming what it was for.
- Proxy turned on during setup. Cloudflare's proxy (the orange cloud) sits between visitors and your host. Some hosts need it set to DNS only so they can verify the domain and issue certificates.
- Restrictive CAA record. If a CAA record allows only one certificate authority and it isn't the one your host uses, HTTPS never gets set up. Our guide to SSL certificates not working walks through this.
How do I check my DNS records?
From a terminal:
dig ns yourdomain.com +short
dig a yourdomain.com +short
dig cname www.yourdomain.com +short
dig mx yourdomain.com +short
dig txt yourdomain.com +shortCompare each answer with what your host and email provider expect. Without a terminal, query the same names on dns.google. Then check from the services themselves: your host's domain settings should show the domain as valid, and your email provider's admin console should show the domain verified.
Quick answers
Do I need to move my nameservers to Vercel or Netlify? Usually not. Adding the A and CNAME records they show at your current DNS host is enough. Moving nameservers helps mainly for wildcard subdomains.
Why does my site work on my phone but not on my laptop? One of them is still using a cached old record. Wait for the TTL to expire, or flush the DNS cache on that device and network.
Is it safe to delete records I don't recognize? Not blindly. A TXT record may verify a service you still use. Search the value, find what added it, then decide.
What is the _dmarc record for? It tells receiving mail servers what to do with email that fails SPF and DKIM checks. Our guide on emails going to spam explains how to set it up.
Want someone to look over your DNS?
A wrong record can take down the site and the inbox at the same time, so it's worth a second pair of eyes before a big change. Our maintenance and support plans cover domain and DNS work, and our custom domain guide for Lovable walks through a full connection. The free health check also shows what is visible from outside, or you can get in touch.
