DNS Record Types Explained: A, AAAA, MX, TXT, CNAME (2026)

DNS Record Types Explained: A, AAAA, MX, TXT, CNAME (2026)

A DNS record is one line in a zone: a name, a type and a value that tell the internet how to handle that name. An A record points a host at an IPv4 address. An MX record says where mail goes. TXT holds free text that email authentication and domain verification hang off. This piece covers the records you'll meet every day, what TTL does, A vs CNAME, and what to audit in your own zone.

Look one up. The DNS Lookup tool queries A, AAAA, MX, TXT, NS, CNAME and SOA live. The DNS Record Explainer walks a pasted zone line by line.

The example values below are for andraxpentester.in and www.andraxpentester.in, returned by our DNS Lookup API on 15 October 2026 (IST). Public resolvers (Cloudflare and Google DNS over HTTPS) returned the same MX, TXT, NS, SOA and CNAME values, but different A/AAAA addresses from our tool and from each other. Treat the addresses as a snapshot: answers can differ by resolver and over time.

What a DNS record is

Authoritative nameservers answer with resource records. Each one has roughly (illustrative line; TTL 60 is what public resolvers showed for this A record that day):

name                    TTL   class  type   value
andraxpentester.in.     60    IN     A      84.32.84.140

• name: the owner (often written without the trailing dot in panels).
• TTL: how many seconds a resolver may cache the answer.
• class: almost always IN (Internet).
• type: A, MX, TXT, …
• value: the type-specific data (an address, a hostname, a string).

RFC 1035 defines the classic types. RFC 3596 adds AAAA. WHOIS tells you who registered the domain; DNS tells you where it points. See What Is WHOIS? for the registration side.

A and AAAA

A maps a name to an IPv4 address. AAAA maps it to a 128-bit IPv6 address.

From the DNS Lookup tool for andraxpentester.in:

A
  84.32.84.140
  88.222.222.148

AAAA
  2a02:4780:84:5efa:ac73:b842:d581:8acc
  2a02:4780:84:89ec:661:ec:35d:fcc1

A name can have several A or AAAA records (round-robin or anycast). How you read the address itself is covered in IPv4 notation and CIDR.

CNAME

A CNAME is an alias: this name is another name, never an IP. Resolvers follow the chain until they hit an A/AAAA (or another answer).

www.andraxpentester.in  CNAME  www.andraxpentester.in.cdn.hstgr.net

RFC 2181 §10.1: an alias name "may have no other data." So you can't put a CNAME at the zone apex next to MX, TXT or NS in standard DNS. Many providers offer ALIAS or ANAME (or CNAME flattening) as a product feature that synthesises A/AAAA at the apex; that's outside the classic CNAME rule.

MX

MX records name the mail servers for a domain, each with a preference. Lower numbers are tried first.

andraxpentester.in  MX  5   mx1.hostinger.com
andraxpentester.in  MX  10  mx2.hostinger.com

MX alone does not stop spoofing. You still want SPF, DKIM and DMARC in TXT. That stack is covered in SPF, DKIM and DMARC explained; the email authentication checker scores a live domain.

TXT

TXT is free-form text. Today it's usually machine-readable: SPF, DKIM public keys, DMARC policies, and site-verification tokens.

andraxpentester.in  TXT  "v=spf1 include:_spf.mail.hostinger.com ~all"
andraxpentester.in  TXT  "google-site-verification=AzAInVR8nnbPNkm_vO8b80_P1PxwmD-8Ume74xCWApA"

RFC 7208 is the SPF spec (the v=spf1 … string lives in TXT). Treat old verification tokens as clutter: remove them when the vendor is gone.

NS and SOA

NS records name the authoritative servers for the zone (delegation):

andraxpentester.in  NS  cosmos.dns-parking.com
andraxpentester.in  NS  nova.dns-parking.com

SOA (start of authority) is the zone's control record: primary nameserver, admin mailbox, serial, and timers.

andraxpentester.in  SOA  nova.dns-parking.com dns.hostinger.com
  serial=2026101501  refresh=10000  retry=2400  expire=604800  minttl=600

Bump the serial whenever you change the zone so secondaries know to refresh. Date-style serials (YYYYMMDDnn) are common; the number only needs to increase.

CAA

CAA (RFC 8659) lists which certificate authorities may issue for the domain. A CA that checks CAA must refuse to issue if your record doesn't allow it. Example shape from the RFC:

certs.example.com.  CAA  0  issue  "ca1.example.net"

andraxpentester.in had no CAA in the lookup on 15 October 2026. That's allowed, but a CAA record is a cheap control once you know which CA you use. Check with the CAA record checker; the certificate side is in SSL/TLS certificates explained.

PTR

PTR maps an IP address back to a name (reverse DNS). It lives under in-addr.arpa / ip6.arpa, usually at your ISP or hosting provider, not in your forward zone. One paragraph is enough here; the full story is Reverse DNS and PTR records. The reverse DNS lookup tool queries one.

TTL and "propagation"

TTL is a cache lifetime, not a global countdown. After you change a record, resolvers that still hold the old answer keep serving it until their copy expires. Lower the TTL ahead of a planned cutover (hours or a day before), make the change, then raise it again. The TTL a lookup shows is the resolver's remaining cache time, so it counts down and can differ between resolvers. There is no universal "DNS takes 24–48 hours" number; it depends on the old TTL and who's caching.

A vs CNAME

Rule of thumb: CNAME when the target is a name someone else manages; A/AAAA when you manage the address.

What to audit in your own zone

DNS is public. Anything you publish is visible to anyone doing recon (web reconnaissance basics).

• Dangling CNAMEs. If shop.example.com CNAMEs to a SaaS hostname you no longer control, someone else may be able to claim that target. Remove the record when you remove the service; inventory CNAMEs regularly.
• TXT clutter. Old google-site-verification=… strings and SPF include:s for vendors you dropped.
• Missing CAA. Add one when you have a preferred CA.
• Email auth. Missing or weak SPF/DMARC (link above); don't re-paste the whole policy here.
• Zone transfers. AXFR should be limited to your own secondaries. Don't test AXFR against other people's domains.
• No secrets in records. API keys, internal hostnames you'd rather not advertise, and staging URLs all show up in casual lookups.

How to look it up

Use the DNS Lookup tool for a quick live view, or the Record Explainer if you already have zone text. From a terminal:

dig andraxpentester.in MX
dig andraxpentester.in TXT
dig www.andraxpentester.in CNAME

FAQ

What's the difference between A and CNAME?

A points at an IP address. CNAME points at another name.

Can a CNAME point to an IP?

No. The value must be a domain name. Use A or AAAA for addresses.

What is TTL?

How long a resolver may cache that answer, in seconds.

How long does DNS propagation take?

Until caches expire the old TTL. Lower TTLs before a change if you need a faster cutover. Don't trust a fixed "48 hours" promise.

Which records do I need for email?

MX for delivery, plus SPF, DKIM and DMARC as TXT (and a good DMARC policy over time). See the email authentication article.