DNS record types: which records your domain needs

A domain that serves a website and sends email through a provider like Google Workspace needs six DNS records: an A record for the domain, a CNAME for www, an MX record, a TXT record each for SPF and DMARC, and a DKIM record (TXT or CNAME, as your mail provider gives it). NS records come with the zone. SRV does one job, and you can ignore it until that job shows up.

Which DNS records do I need?

Start from what the domain does, not from the list of types.

DNS records example

Here's that domain as you'd enter it in the DNS Manager's form. @ is the domain itself, and every other Hostname is relative to it: type www, because www.example.com would make www.example.com.example.com. The server's address is a placeholder, the MX and SPF values are Google Workspace's, and the DMARC value is the example from RFC 7489, the DMARC standard.

[ Who reads which record ]

[email protected]MX example.comsmtp.google.comA receiver checks mail sent as example.comTXT SPFTXT DKIMTXT DMARC

Your mail provider gives you the DKIM selector and its record, a TXT or a CNAME. On another provider, swap in its MX and SPF values. p=none asks receivers to report on your mail without acting on failures. Start there, read the reports, then tighten the policy.

DNS record types list

Our DNS Manager supports these seven types.

Every zone also has an SOA record, with its primary name server, serial number and timers. You never touch it, and the DNS Manager leaves it out of the record list.

PTR records, for reverse DNS, live in the zone of whoever owns the IP address, not in yours. For an American Cloud IP, we set it on request once your account passes KYC verification.

Three rules that break DNS records

Each of these looks fine in your DNS host and still fails in practice.

Put an A record at the root, and the CNAME on www. A name with a CNAME can't hold any other record, and the root of a zone always holds its NS and SOA records.

[ Root and www ]

Keep one SPF record, with at most 10 lookups. Publish two TXT records that start with v=spf1 and a receiver's SPF check fails with a permanent error. So does an SPF record that needs more than 10 DNS lookups, counting each include, a, mx, ptr, exists and redirect. When a second service sends mail for you, add it to the one record: v=spf1 include:_spf.google.com include:amazonses.com ~all.

Point MX at a mail server's name, never an IP address or a CNAME. The MX value is a host name, and that name needs its own A or AAAA record, not an alias. With several MX records, senders try the lowest number first.

How do I check my DNS records?

Run the domain through our DNS lookup. It shows the records Cloudflare and Google return for each type except SRV, so you see what the rest of the internet sees. DKIM and DMARC sit on their own names, so look up _dmarc.example.com and <selector>._domainkey.example.com too. Check after every change, and before you move the domain's name servers.

What happens if I delete all my DNS records?

Lookups for the domain fail, so the website, email and anything else on that name stop working until the records come back or the registrar points at name servers that have them. Resolvers that already looked up a record keep their copy until its TTL runs out, so the failure spreads out as those copies expire rather than hitting everyone at once.

Add DNS records in American Cloud

DNS on American Cloud is free, with unlimited zones, records and queries, and when a record won't resolve, you reach people who know DNS. Add every record your domain uses before you point the registrar at ns1.americancloud.org and ns2.americancloud.org, so nothing goes dark during the switch. DNS management has the steps.