DNS Record Builder

An A record maps a hostname directly to an IPv4 address (e.g. example.com → 93.184.216.34). A CNAME record creates an alias that points to another hostname, which must itself resolve to an IP (e.g. www.example.com → example.com). You cannot use a CNAME at the root/apex domain (@ or example.com) because it would conflict with SOA/NS records. Use an A record there, or ALIAS/ANAME records if your DNS provider supports them.

TTL (Time To Live) is how long DNS resolvers cache your record before checking for updates. Low TTL (60-300s) = faster propagation of changes but more DNS queries. High TTL (3600-86400s) = faster lookups for clients, less DNS traffic, but slow propagation when you update. Before a planned migration, lower your TTL 24-48 hours in advance so the change takes effect quickly on cutover day.

SPF: add a TXT record at your root domain with 'v=spf1 include:_spf.yourprovider.com ~all'. DKIM: add a TXT record at 'selector._domainkey.yourdomain.com' with the public key from your email provider. DMARC: add a TXT record at '_dmarc.yourdomain.com' with 'v=DMARC1; p=quarantine; rua=mailto:[email protected]'. All three together protect your domain from email spoofing.

A trailing dot (e.g. example.com.) marks the domain as a fully qualified domain name (FQDN) — an absolute domain from the DNS root. Without the dot, some DNS servers treat it as relative to the current zone origin and may append the zone name, causing incorrect resolution. When entering target values for CNAME, MX, NS, and SRV records, always use the trailing dot for safety.

CAA (Certification Authority Authorization) records specify which Certificate Authorities (CAs) are allowed to issue SSL/TLS certificates for your domain. Without CAA records, any CA can issue a cert for your domain. With CAA records, if a CA sees it's not listed, it will refuse to issue — providing an extra layer of protection against mis-issuance. If you use Let's Encrypt, add: 0 issue 'letsencrypt.org'.

Run 'dig yourdomain.com A' to look up an A record. Add '+trace' for full recursive resolution. Use '@8.8.8.8' to query Google's DNS specifically (e.g. dig @8.8.8.8 yourdomain.com TXT). Use 'dig +short' for a clean one-line answer. DNS changes can take minutes to 48 hours to propagate worldwide — check multiple resolvers to confirm.