What is the difference between an A record and a CNAME?

An A record points a name to an IPv4 address. A CNAME points a name to another name, and the resolver follows it until it reaches an IP. Use a CNAME when the target is a hostname and an A record when it is an IP.

What is an MX record for?

An MX record says which servers receive email for the domain. Each MX has a priority, and sending servers try the lowest value first.

Can I have two SPF records on the same domain?

No. RFC 7208 does not allow multiple SPF records on the same name, and it causes a verification error (permerror). Merge every authorized sender into a single TXT record that starts with v=spf1.

What is TTL in a DNS record?

It is the time, in seconds, that a resolver may cache the answer before asking again. A low TTL makes changes take effect sooner; a high TTL means fewer queries.

DNS records explained: A, CNAME, MX, TXT

When you type an address into a browser, DNS translates the name into something the network understands. That translation comes from a list of instructions stored for each domain: the DNS records.

Sooner or later anyone who owns a domain has to create a record, whether to publish a site, set up email or verify the domain with a service. Knowing the types helps you avoid the classic mistake of deleting the wrong record and taking everything down.

What is a DNS record?#

A DNS record is one line in the domain's zone, the set of data the domain publishes on its name servers. Every record has four parts:

Field	Meaning	Example
Name	Which name in the domain the record describes (`@` is the root)	`www`
Type	The record's function	`CNAME`
Value	The target or the content	`example.com.`
TTL	Seconds the result may stay cached	`3600`

A sample zone in the classic zone-file format (203.0.113.x and 2001:db8:: are reserved for documentation):

text

example.com.        3600 IN A      203.0.113.10
example.com.        3600 IN AAAA   2001:db8::10
www.example.com.    3600 IN CNAME  example.com.
example.com.        3600 IN MX     10 mail.example.com.
example.com.        3600 IN TXT    "v=spf1 include:_spf.example.net ~all"

Which record types are used most?#

A and AAAA#

An A record maps a name to an IPv4 address. AAAA does the same for IPv6. A name can have several A records, and each client picks one of the addresses, which spreads connections across them. It is the basic record of any website. For more on addresses, see IPv4, IPv6 and static IPs.

CNAME#

A CNAME makes one name an alias of another. A resolver looking up www.example.com learns it is an alias of example.com and keeps following the chain until it finds an IP. The upside: if the target changes IP, you do not have to edit anything.

The rule that causes the most errors: per RFC 2181, a name that has a CNAME may not have any other data. Since the domain root always has NS and SOA records, it cannot hold a CNAME. Some providers offer ALIAS, ANAME or CNAME flattening, proprietary features that emulate this behavior at the root.

MX#

An MX record defines which servers receive the domain's email. It carries a priority number, and RFC 1035 defines that lower values are preferred. With 10 mail1 and 20 mail2, the sender tries the first and uses the second only if the first fails. An MX target must be a name with an A or AAAA record, never a CNAME (RFC 2181, section 10.3).

TXT#

A TXT record stores free text and became the Swiss army knife of DNS. Common uses:

SPF: lists who may send email for the domain. Starts with v=spf1.
DKIM: publishes the public key that validates email signatures.
DMARC: policy for mail that fails SPF and DKIM, published at _dmarc.yourdomain.
Ownership verification: services ask for a TXT with a code to prove the domain is yours.

Two practical limits: each text chunk inside a TXT is at most 255 bytes (longer values are split into several chunks, which most panels do for you), and SPF allows at most 10 DNS-querying terms (include, a, mx and similar) and a single SPF record per name, according to RFC 7208. Going over invalidates the SPF.

NS, SOA and CAA#

NS: says which name servers answer for the zone. It is what delegates the domain to a DNS provider.
SOA: zone metadata (primary server, contact, serial number).
CAA: restricts which certificate authorities may issue certificates for the domain. Example: example.com. CAA 0 issue "letsencrypt.org". It is defined in RFC 8659.

Other types exist, such as SRV (locates services by port) and PTR (reverse lookup, from IP to name), but they come up less for people hosting a site or a bot.

How do I query DNS records?#

dig shows what DNS answers, without your browser's cache in the way:

bash

dig example.com A +short
dig example.com MX +short
dig example.com TXT +short
dig NS example.com +short

On Windows without dig, use nslookup:

bash

nslookup -type=MX example.com

To see what a specific public resolver returns, pass the server: dig @1.1.1.1 example.com A +short. If the answer differs from what you configured, it may be a stale cache: see DNS propagation.

What is TTL and why does it matter?#

TTL is the time, in seconds, that resolvers may keep the answer. With a TTL of 3600, anyone who already queried keeps seeing the old value for up to an hour after your change.

The safe practice before migrating a site: lower the TTL to 300, wait for the old TTL to expire, make the switch, then raise it again. Keeping the TTL very low all the time just increases query volume with no benefit.

Which mistakes cause the most trouble?#

CNAME plus another record on the same name: the panel refuses it or behavior becomes unpredictable. Remove the old A/AAAA first.
Two SPF records: the result is a verification error. Merge them into one.
MX pointing to a CNAME: RFC 2181 forbids it, and mail delivery may fail. Point it to a name with an A record.
Doubled name: typing app.example.com in a panel that already appends the domain produces app.example.com.example.com.
Editing in the wrong place: if the domain is delegated to another DNS provider, the registrar's records do not apply. Check with dig NS.
Trailing dot: in zone files, example.com. with a dot is an absolute name; without it, the domain is appended.

For the practical walkthrough of pointing a domain, see how to point a domain to your hosting.

How to do this on Square Cloud#

To connect your own domain to an application on Square Cloud, you use two of the types in this guide: a CNAME pointing to cname.squareweb.app and a TXT record for validation. The dashboard shows the exact values when you add the domain and tracks validation in real time. As soon as the records show up, TLS is issued automatically. Domains with accents (Punycode) are supported.

To use the root, your DNS provider must support a CNAME at the apex (flattening or ALIAS), because of the same CNAME rule covered above. And if the name you picked still has an old A or AAAA record, delete it before creating the CNAME.

The rest of the zone stays with you, at your registrar or DNS provider: MX, SPF, DKIM and any other TXT records do not change, and the domain stays registered in your name. Custom domains are available from the Standard plan (starting at R$44.99 per month). On every plan, each web application already answers on a *.squareweb.app subdomain with HTTPS, without you creating any record. See the steps in custom domains and compare plans on pricing.