What Are DNS Records? (Expert-Led Beginner Guide)

Introduction

If you want to understand how the internet actually works in practice, not just in theory you need to understand DNS records.

Domain Name System is an index of all website names registered and its corresponding locations on the internet. It acts as a translation and distribution mechanism to route human readable site or domain names to IP addresses mapped to them for ease of navigation and user experience.

If you strip the internet down to its fundamentals, it runs on one simple idea, we as humans use names and computers use numbers. DNS records are the translation layer that keeps these names matching to its respective IP numbers and thus routing traffic so everything works smoothly.

In this guide we oversimplify DNS beyond “domain names and IP addresses.”
In real-world systems, DNS is not just a lookup tool, it's a control panel for traffic, reliability, and trust.

From an expert perspective, DNS records are not just configuration details. They are live routing rules in a globally distributed system and every change you make has real consequences.

As someone who has worked with production systems, migrations, outages, and performance tuning, I’ll tell you this upfront: DNS looks simple on the surface but small mistakes here can take entire businesses offline.

Let’s break it down properly.

## What is DNS - DNS as the Internet’s Routing Layer

Think of DNS (Domain Name System) as a distributed database or the yellow pages of the internet that answers one question:

“Where should this request go?”

When someone types your domain into a browser, DNS records tell the internet:

• Which server to connect to
• Which service handles email
• How subdomains behave
• What security rules apply

Every domain has a set of DNS records stored on authoritative name servers, often managed through providers like Cloudflare DNS or Amazon Route 53 or Hostinger.

## What Does a DNS Record Contain?

A DNS record is a structured rule that tells the internet how to handle a specific query.

It is a set of instructions stored in your domain’s DNS configuration that maps a domain name to an IP address, server, or service.

The Core DNS Record Types (Explained Like an Operator)

1. A Record (Address Record)

Address Record (A Record) is the most common type used that links a domain to a physical IPv4 address. In common terms we say connecting the domain to a server. A records only support 32-bit IPv4 addresses.

Example: example.com → 192.158.1.38

In production, you rarely point directly to a single server unless it's a very simple setup. Address records are often used behind load balancers or CDNs.

Multiple Address records can be used for one domain, making it point to different servers in case of failover, it is used to create a redundancy layer for if one goes down, traffic is directed to the other.

2. AAAA Record (Quad A Record)

Similar to A record, but AAAA record links a domain to an IPv6 address.
AAAA records are only used when a domain has an IPv6 address in addition to an IPv4 address, and when the client device in question is configured to use IPv6.

IPv4 vs IPv6

IPv6 - Internet Protocol Version 6 - These are the new standards of global networks that drive traffic. IPv4 and IPv6 are internet protocols to identify addresses on the internet, IPv4 has a limitation of 4.3 billion addresses using 32 bit and IPv6 is a more secure, faster and unlimited supply of address, in practice a dual stack approach is used for global connectivity and performance.

In 2026 the adoption of IPv6 is no longer optional in many regions. Ignoring AAAA can create inconsistent performance globally.

3. CNAME Record (Canonical Name)

Canonical Name Record also known as alias record. Points one domain to another domain. It is usually used to point a sub domain to the main domain and consolidate traffic and authority.

Example: www.example.com → example.com

CNAMEs are heavily used with SaaS tools (like hosting, analytics, CDNs). But they come with a key limitation:

You cannot place a CNAME at the root domain (apex) in standard DNS. Providers work around this with “flattening” or “ANAME” features.

4. MX Record (Mail Exchange)

Mail Exchange server defines where emails for your domain should be delivered and sets priority between mail servers. These records authenticate and deliver emails securely matching records to flag security and spam.

Example: example.com → mail.example.com (priority 10)

If your MX records are wrong, email simply won’t arrive, no warning, no fallback.

It is recommended to keep the MX records active in DNS when changing hosting providers as the DNS propagation takes 2-24 hrs and accidentally wiping MX records can have your email service down.

You can delete the records once the migration is completed and test your emails by sending and receiving to ensure your transition is done correctly.

5. TXT Record

Text records are parts of DNS that store text data, often used for verification and email security (SPF, DKIM, DMARC). TXT records are critical for email deliverability, security and email spoofing.

Domain Verification

If you own the domain and can place the code snippet to validate this ownership.

Email Security (SPF, DKIM, DMARC)

DNS based email authentication protocols that check for email spoofing, phishing and other forms of email attacks.

SPF - Sender Policy Framework

Allows for the sender to be identified by the DNS TXT record listing for IP addresses authorized to send email for a domain. This validates the email is sent from a reliable source and the rightful owner of the domain.

DKIM - Domain Keys Identified Mail

DKIM is the encryption layer that does after the validation and before sending the email it ensures the package was not altered during transit and thus adding further security to email.

It uses cryptography to identify a unique public key provided by the email solution provider to authenticate records in DNS to validate a private key signature, reducing chances of phishing and email spoofing.

DMARC - Domain-based Message Authentication, Reporting, and Conformance

DMARC is the framework that uses the above to function to verify and report to the receiving server that the email is checked and pass instruction on how to deliver the email.

A DMARC mismatch runs a high chance of emails landing in spam. This is controlled by setting policy and rule strictness to treat email with ‘none’, ‘quarantine’ or ‘reject’ for those emails that don't pass DMARC.
Third-Party Integrations

TXT records also come handy when integrating services like Google Workspace, Microsoft 365 or Shopify, it's used for domain verification and SSL authentication in DNS-01 challenge to verify ownership for issuing SSL certificates.

Most DNS “clutter” comes from TXT records. Good teams document what each one is for, otherwise debugging becomes painful.

6. NS Record (Name Server)

Name Server Record is a DNS record that identifies which servers are responsible for handling traffic to your domain and directs it accordingly. It specifies which servers contain the actual DNS records (A, CNAME, MX) for a domain.

It is used in pairs to reduce redundancy and failover and you would see 2 IP addresses in some cases like Hostinger and 2 Names in case of Cloud flare relevant to their naming conventions.

NS Record acts as the control layer. If NS records are wrong, nothing else matters. These records improve accessibility and affect email delivery. Always check and use the name server that is handling your traffic and routing it to your hosting provider.

Example of Hosting + CDN Setup

If your website files are hosted on Hostinger or Hostgator and you are using a CDN Content Delivery Network like Cloudflare, you will need to add the A, CNAME, MX into Cloudflare for it to understand where to send the traffic.

In this example the website sits with Hostinger (A Name), a domain that will receive all the traffic when clicked on a URL (CNAME) and MX is your email solution provider (Google).

7. SRV Record

Service Record specifies the location and settings of specific services like email or VoIP services and ports for specific protocols to their endpoint.

Its used for mapping services such as:

• VoIP
• Instant Messaging Systems
• Enterprise tools

Key Components of an SRV Record

• Service - The name of the service
• Protocol - The transport protocol, typically TCP or UDP
• Name - The domain name for which this record is valid
• Priority - Lower numbers indicate higher preference (0-65535)
• Weight - Relative weight for records with the same priority
• Port - The port number on the server where the service is running
• Target - The canonical hostname of the machine providing the service

Note: You may never touch these unless working with specialized systems.

8. CAA Record

A Certification Authority Authorization (CAA) specifies which certificate authorities can issue SSL certificates for your domain.

CAA is a small record with big impact, it helps prevent unauthorized SSL issuance that could be used for exploits.

When using the earlier example of Hosting and CDN of different providers you will have an option to input either one or both, in the scenario when only one is used your hosting provider helps with SSL across your domain and when using it in conjunction it leverages 2 layers of security one as usual for the hosted files and furthermore to the traffic and caching mechanisms.

9. PTR Record

Pointer Record is used for reverse lookups (rDNS), just like the A record is used to map an IP address to a domain, PTR record maps a domain name back to an IP address.

The PTR record is not available on shared servers where many sites share a common IP address but can be used on a VPS.

To mitigate this you can request for a static or dedicated IP address from an ISP and request your host to create a PTR record also known as reverse DNS (rDNS).

This further proofs your email and improves linking on the internet increasing trust.

Forward-Confirmed Reverse DNS (FCrDNS)

Important: The PTR record should point to a hostname (example.com), and that hostname should have an A record pointing back to the same IP, this is called Forward-Confirmed Reverse DNS or FCrDNS.

10. DNSSEC

Domain Name System Security Extensions is a validation protocol that adds security to the Domain Name System (DNS), it uses a cryptographic signature to validate the origin and transfer to ensure they match and are not tempered with in transit.

This prevents users being redirected to fake websites and prevents DOS attacks like man in the middle and prevents corruption or cache poisoning.
DNSSEC is not another encryption layer it reports if there is a situation where the DNS may have been tampered during the routing by matching them to check if its origin and destination match.

It is important to note that DNSSEC does not protect against all forms of cyberattacks and does not ensure confidentiality.

Implementing DNSSEC can be complex with the management of public keys to sync real time with the delegated signer when mismatched, it can crash the website.

What Happens During a DNSSEC Check?

Upon DNSSEC implementation the existing DNS records (e.g., A, MX, AAAA) are assigned and paired with cryptographic signatures which are solved by recursive resolvers.

DNSSEC Components

• RRSIG (Resource Record Signature): Cryptographic signatures
• DNSKEY: Public keys used to verify signatures
• DS (Delegation Signer)

Now we understand the technical mechanism used by DNS and how each record within works in tandem to communicate with the property. Let's dive into how that is perceived by us.

How DNS Works in Real Life (Step-by-Step)

When someone visits your site:

1. Browser checks cache
2. OS checks cache
3. Request goes to a recursive resolver (often your ISP or public DNS)
4. Resolver queries authoritative name servers
5. DNS records are returned
6. Browser connects to the server

This entire process usually happens in milliseconds but depends heavily on how your DNS is configured.

TTL (Time To Live)

TTL (Time To Live) defines how long a DNS record is cached.

Example:

• TTL = 300 seconds → updates propagate quickly
• TTL = 86400 seconds → slower updates, but better performance

Expert rule of thumb: Lower TTL before planned changes this helps to refresh content and clear older files with newer versions and increase TTL for stability afterward the changes that give better performance.
Common outage scenario when teams forget TTL, make a change, and wonder why nothing updates for hours.

How Professionals Actually Use DNS

1. Traffic Control & Failover

DNS can route traffic based on:

• Geography
• Health checks
• Load balancing

This enables instant automatic failover if a server goes down.

1. Multi-Service Integration

Modern websites rely on multiple services:

• Hosting
• CDN
• Email provider
• Analytics tools

Each one adds DNS records. Managing them cleanly is a real skill.

1. Security Layer

DNS plays a role in:

• Preventing spoofed emails (SPF, DKIM, DMARC)
• SSL control (CAA)
• DDoS mitigation (via DNS providers)

Common DNS Mistakes to Avoid

1. Deleting Records During Migrations

Switching hosting and wiping out:

• MX records (email breaks) → Keep MX records active until the migration is complete to avoid email disruption, you can always come back to update or delete them.
• TXT records (verifications fail) → TXT records work alongside MX records to validate the origin servers and deleting them early can confuse delivery and cause unnecessary conflict.

1. Misusing CNAMEs

Adding multiple conflicting records for instance trying to use CNAME at root without provider support.

1. Ignoring Propagation Delays

DNS is not instant. Changes take time.

1. No Documentation

Teams forget:

• Why records exist
• Which service added them

1. Overcomplicated Setups

More records doesn't mean better architecture. Simplicity improves reliability.

Best Practices for Keeping and Maintaining DNS from Real-World Experience

• Keep a DNS inventory document
• Use a reliable provider like Cloudflare DNS
• Set low TTL before major changes
• Always backup records before editing
• Regularly audit unused entries
• Separate staging and production domains

DNS records are deceptively simple but they sit at the foundation of everything online.
From an expert perspective, the goal isn’t just to “make it work.” It’s to:

• Make it predictable
• Make it debuggable
• Make it resilient

If DNS is configured well, nobody notices.
If it’s configured poorly, everything breaks and fast.

Frequently Asked Questions

1. What is the Domain Name System (DNS)?

DNS is a system that connects domain names (like websites) to IP addresses. It works like as the yellow pages for the internet translating human-friendly names into machine-readable numbers.

1. What is DNS Resolution?

DNS resolution is the process of converting a domain name into its IP address so a browser can load the correct website.

The Four Types of DNS Servers

1. Recursive Resolver – Receives the request and starts the lookup process
2. Root Servers – Direct the request to the correct top-level domain (like .com or .org)
3. TLD Servers – Point to the domain’s authoritative servers

4. Authoritative Servers – Provide the final DNS records (actual answer)

5. How Does DNS Work Step by Step?

When you open a website:

1. Your browser sends a request to a DNS resolver (usually from your ISP)
2. The resolver checks its cache
3. If not found, it queries root servers
4. Root servers point to TLD servers
5. TLD servers point to authoritative servers
6. Authoritative servers return the correct DNS records
7. The resolver caches the result and sends it back to your browser

What is DNS Propagation?
DNS propagation is the time it takes for DNS changes to update across the internet.

This can take anywhere from a few minutes up to 48 hours globally.

Why Does DNS Propagation Take Time?

1. Because of caching.

ISPs and DNS servers store old records temporarily
They only fetch new data after the TTL (Time To Live) expires

This means some users may still see the old version while others see the updated one.

Why Are My DNS Changes Not Updating?

Possible reasons:

Cached data hasn’t expired yet
Different ISPs update at different times
Your local system is still using old cache

What You Can Do

Wait for TTL to expire
Clear your DNS cache
Run a DNS health check

What Happens If a Domain Doesn’t Exist?

The DNS server returns an NXDOMAIN error, meaning the domain cannot be found.

Which Port Does DNS Use?
DNS uses:

UDP Port 53 (most common, faster)
TCP Port 53 (used for large queries and zone transfers)

What is a DNS Failure?

A DNS failure happens when a domain cannot be translated into an IP address. This means the website cannot be reached.

Popular Public DNS Servers

Google Public DNS

• 8.8.8.8
• 8.8.4.4

Cloudflare DNS

• 1.1.1.1
• 1.0.0.1

OpenDNS

• 208.67.222.222
• 208.67.220.220

Quad9 (Security-Focused)

• 9.9.9.9
• 149.112.112.112

Author: Sherin Mathew
Founder - PerformX Performance Marketing Exodos

I lead digital growth initiatives focused on helping startups and small businesses maximize the opportunities within the modern digital ecosystem. As a full-stack digital agency our approach works across web design and development, SEO, search advertising, social media advertising, and video advertising to build and scalable digital performance strategies.