DNS records explained, from A to CAA

Every record at a glance

Each record has a name (which host it's for), a type, a value and a TTL (how long others may cache it). In the name column, @ means the domain itself, yourdomain.in; anything else is a subdomain, so www means www.yourdomain.in.

Written out in zone-file form, the same fields appear on one line each. This is also how our DNS lookup tool and the dig command show them:

; name   TTL    class  type   value
@        3600   IN     A      203.0.113.24
www      3600   IN     CNAME  yourdomain.in.
@        3600   IN     MX     0 mail.yourdomain.in.
@        3600   IN     TXT    "v=spf1 +a +mx ~all"

Website: A and AAAA: where your site lives

An A record maps a name to an IPv4 address; an AAAA record does the same for IPv6. Browsers look these up first, so they decide which server answers when someone types your domain.

@      3600  IN  A     203.0.113.24
@      3600  IN  AAAA  2001:db8::24
shop   3600  IN  A     198.51.100.7   ; a subdomain on another server

• One address per name is what you want almost every time. Two A records on the same name split visitors between both servers at random.
• Add an AAAA record only if your server has an IPv6 address listed in your welcome email or control panel. If you're moving hosts, delete the old AAAA record: visitors on IPv6 will otherwise keep reaching the old server.
• To move a whole site to us, follow Point your domain to VirtualCloud.

CNAME: one name pointing at another

A CNAME says "this name is an alias; look up that other name instead". It's the usual way to point www at your main domain, or a subdomain at a hosted service that gives you a hostname rather than an IP address.

www     3600  IN  CNAME  yourdomain.in.
shop    3600  IN  CNAME  yourstore.provider.example.
status  3600  IN  CNAME  yourbrand.statuspage.example.

Some DNS providers offer "ALIAS", "ANAME" or "CNAME flattening" to work around this. The cPanel Zone Editor offers A, AAAA, CAA, CNAME, MX, SRV and TXT records, so on our nameservers use an A record at the root. A CNAME value is always a hostname: never an IP address, and never a URL with https:// or a path.

Email: MX: who receives your email

MX records name the servers that accept mail for your domain. Each has a priority: senders try the lowest number first and fall back to higher numbers only if it's unreachable. An MX value must be a hostname with its own A record, not an IP address or a CNAME.

Use only one provider's MX records at a time; mixing them sends some mail to a server that has no mailbox for it. With mail on our hosting, create an email account in cPanel for each address before you point MX at it. Take the exact Microsoft 365 value from its admin centre, because it's built from your domain name.

Email: TXT records: SPF, DKIM, DMARC and verification

TXT records hold text that other systems read. Three of them decide whether your mail is trusted: Gmail and Yahoo require all three from bulk senders, and mail without them is far more likely to land in spam for everyone else too. cPanelEmailEmail Deliverability shows whether SPF and DKIM are valid for each domain and can repair them in one click when your DNS is with us.

SPF: which servers may send as you

One TXT record on @ that starts with v=spf1. List every service that sends mail for the domain, then end with ~all (soft fail) or -all (hard fail).

; mail sent from your VirtualCloud hosting only
@   3600  IN  TXT  "v=spf1 +a +mx +ip4:203.0.113.24 ~all"
; hosting plus Google Workspace, merged into ONE record
@   3600  IN  TXT  "v=spf1 +a +mx +ip4:203.0.113.24 include:_spf.google.com ~all"

A domain must have exactly one SPF record. Two separate v=spf1 records make both invalid, so merge the include: parts into one line. SPF also allows at most 10 DNS lookups, so remove services you no longer use.

DKIM: a signature on every message

DKIM publishes a public key under a selector, and the sending server signs each message with the matching private key. cPanel creates the key for you; Google Workspace and Microsoft 365 give you their own records in their admin consoles.

default._domainkey  3600  IN  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…"

Copy the whole value in one go. Some DNS panels split long keys into several quoted strings; that's fine as long as no characters are lost.

DMARC: what to do when checks fail

DMARC tells receivers what to do with mail that fails SPF and DKIM, and where to send reports. Start by only monitoring, then tighten once the reports show your real mail passing.

; week 1: monitor only
_dmarc  3600  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.in"
; later: quarantine, then reject
_dmarc  3600  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.in"

Verification records

Google Search Console, Microsoft 365, payment gateways and other services ask you to add a TXT record such as google-site-verification=abc123 to prove you own the domain. You can have as many of these on @ as you need, next to your SPF record. Keep them: some services check again later.

SSL: CAA: who may issue your SSL certificates

A CAA record lists the certificate authorities allowed to issue certificates for your domain. With no CAA records at all, any authority may, which is the default and works fine. Add them only if your security policy asks for it, and then include every authority you use.

@  3600  IN  CAA  0 issue "letsencrypt.org"
@  3600  IN  CAA  0 issue "sectigo.com"
@  3600  IN  CAA  0 issuewild "sectigo.com"
@  3600  IN  CAA  0 iodef "mailto:security@yourdomain.in"

Free AutoSSL in cPanel uses Let's Encrypt or Sectigo depending on the server, so allow both. If you buy a certificate from our SSL certificates range, add the authority named on your order before you request it.

TTL and propagation

The TTL (time to live) is how many seconds other resolvers may keep a cached copy of a record. "Propagation" is simply those caches expiring around the world, so a change can be visible to you and invisible to a customer for up to one TTL.

Lowering a TTL only helps once the old, longer TTL has run out, so do it a day ahead. Nameserver changes, such as when you set up private nameservers, take longest: the registries behind extensions such as .com publish their NS records with TTLs of up to two days, which is why we say to allow up to 48 hours. Check progress with our DNS lookup tool, which asks two public resolvers at once.

How to: Edit records in the cPanel Zone Editor

This works when your domain uses VirtualCloud nameservers. If it doesn't, the same fields exist at your registrar or DNS provider under a name such as DNS records or Manage DNS.

1. Open the zone for your domain

   Log in to cPanel and go to DomainsZone Editor. Click Manage next to the domain. The table lists every record, with a filter for each type.

2. Add the record

   Click the arrow beside + Add Record and choose the type. Fill in Name, TTL and Record (the value). cPanel adds your domain to the name for you, so for www.yourdomain.in you can type just www.

   cPanel›Zone Editor›yourdomain.in

   Manage zoneFilter: All

   NameTTLTypeRecord

   yourdomain.in.14400A203.0.113.24

   www.yourdomain.in.14400CNAMEyourdomain.in

   yourdomain.in.14400MX0 mail.yourdomain.in

   _dmarc.yourdomain.in.3600TXTv=DMARC1; p=none; rua=…

   Save RecordCancel

3. Save, then check it from outside

   Click Save Record. Our nameservers serve the change straight away; other resolvers pick it up as their cached copies expire. Confirm it with the lookup tool or from a terminal:

   dig +short TXT _dmarc.yourdomain.in @1.1.1.1
   dig +short MX yourdomain.in @8.8.8.8

Common DNS record mistakes