DNS records explained: A, AAAA, CNAME, MX, TXT and CAA
A and AAAA records point a name at a server's address, CNAME points one name at another, MX says where email goes, TXT holds text such as verifications and SPF, and CAA limits who can issue certificates.
Applies to: Cloudflare
On this page
DNS records are the individual instructions for your domain. The six you'll meet most are: A (points a name at an IPv4 address), AAAA (an IPv6 address), CNAME (points one name at another name), MX (where email is delivered), TXT (text, used for verification and email security) and CAA (which certificate authorities may issue certificates for your domain). For domains on Oogle hosting, these records live in Cloudflare and we change them for you on request.
Parts of a record
Every record has:
- A name: which part of your domain it applies to.
@means the domain itself (example.com, the "apex");wwwmeanswww.example.com. - A type: A, CNAME, MX and so on.
- Content: the answer, such as an address or another name.
- A TTL: how long other servers may cache it. See How long DNS changes take.
In Cloudflare, A, AAAA and CNAME records also have a proxy status, the orange or grey cloud. See Proxied or DNS only.
The common record types
| Type | What it does | Example content |
|---|---|---|
| A | Points a name to an IPv4 address | 203.0.113.10 |
| AAAA | Points a name to an IPv6 address | 2001:db8::10 |
| CNAME | Makes a name an alias of another name | shops.example.net |
| MX | Says which server receives email, with a priority | 10 mail.example.net |
| TXT | Holds text: verification codes, SPF and more | v=spf1 include:example.net ~all |
| CAA | Lists who may issue certificates for the domain | 0 issue "letsencrypt.org" |
The addresses and names above are documentation examples, not values to use.
A and AAAA
These point a name at the real address of the server, such as the server that hosts your website. Your website's A record at Oogle points at our hosting server.
CNAME
A CNAME makes one name follow another, for example shop.example.com following a hosted shop platform. The target must be a full name like shops.example.net, not an address. Normally a CNAME can't sit on the bare domain, but Cloudflare flattens one there automatically, so it works.
MX
MX records name the servers that accept email for your domain, each with a priority number (lower is tried first). Your email provider tells you which to use. MX records are never proxied, and the hostname an MX record points to must be DNS only too. See Email DNS records.
TXT
TXT records hold text. Services use them to prove you control a domain (Google, Microsoft, payment and marketing tools), and email uses them for SPF, DKIM and DMARC. Cloudflare adds the quotation marks for you, and each TXT record can hold up to 4,096 bytes.
CAA
A CAA record lists which certificate authorities may issue certificates for your domain. When any CAA record is added, Cloudflare also adds hidden CAA records for the authorities it uses, so the certificate that protects your proxied website keeps renewing. Ask us before adding one.
Look up a record yourself
On a computer with dig:
dig a example.com +short
dig mx example.com +short
dig txt example.com +short
dig example.com caa +shortReplace example.com with your domain. Each line prints the current answer for that type. For a proxied website you'll see Cloudflare addresses, not our server's, which is expected. Without a command line, enter the name at Google Public DNS, select Resolve, and choose the record type.
You'll know a record is right when
A lookup returns the value you expect, from more than one resolver, and the service that asked for the record (your email provider, a verification page) reports success.
Troubleshooting
- A verification keeps failing. The record may be on the wrong name (for example
@instead of a specific subdomain the service gave you), or still spreading. Check the exact name the service asked for. - Two SPF records. A domain should have only one TXT record starting
v=spf1. Ask us to merge them. - A CNAME and another record on the same name. Not allowed. One has to go; tell us which service needs the name.
- A certificate won't issue after adding CAA. The CAA record may exclude the authority you need. Ask us to check.
Next steps
- How to ask us to change a DNS record
- Email DNS records: MX, SPF, DKIM and DMARC
Frequently asked questions
What does @ mean in a DNS record?
It's shorthand for the domain itself (the "apex" or "root"), for example example.com rather than www.example.com.
Can I have a CNAME on my bare domain?
Strictly, DNS doesn't allow it, but Cloudflare flattens a CNAME at the apex automatically, so it works.
A service gave me a TXT record to add. Is that safe?
Verification records are routine and don't give the service access to anything. Send it to us in a ticket and we'll add it. If you don't recognize the service, ask us first.