What is the difference between an A record and an AAAA record?

An A record maps a hostname to a 32-bit IPv4 address (e.g. 192.0.2.1), while an AAAA record maps a hostname to a 128-bit IPv6 address (e.g. 2001:db8::1). Dual-stack web servers publish both to serve IPv4 and IPv6 clients.

Can a CNAME record be created at the zone apex (root domain)?

According to RFC 1034, a CNAME record cannot coexist with any other record for the same name, which conflicts with mandatory SOA and NS records at the apex (e.g. example.com). Modern DNS providers use CNAME Flattening or ANAME/ALIAS records to overcome this.

How do TXT records power SPF, DKIM, and DMARC email authentication?

TXT records store arbitrary text strings used by email security protocols: SPF defines authorized sending mail servers, DKIM publishes public cryptographic keys to verify message signatures, and DMARC specifies enforcement policies (none, quarantine, reject) for failing emails.

RFC 1034 & RFC 1035 Authoritative Resolver

Authoritative DNS Record Lookup

Query global root and authoritative name servers for A, AAAA, MX, TXT (SPF/DKIM/DMARC), NS, CNAME, and SOA zone entries in real time. Inspect TTL caching timers and authoritative delegation with zero third-party latency.

Target FQDN / Domain Name e.g. apex or subdomain

Query Record Type

Presets: tech100.top (ALL) cloudflare.com (A) google.com (MX) github.com (TXT)

Domain Name System Architecture Guide

How Global DNS Resolution, Root Servers & Record Types Work

The Domain Name System (DNS) is the distributed, hierarchical database translating human-readable hostnames into binary IP addresses. Learn how recursive resolvers, authoritative nameservers, Anycast routing, and anti-spoofing security policies function.

RFC Standards Reference

Comprehensive DNS Resource Record (RR) Types Reference

Every internet protocol relies on specific DNS resource record types defined by the Internet Engineering Task Force (IETF).

A Record RFC 1035

Maps a fully qualified domain name to a 32-bit IPv4 address (e.g., 104.21.48.21). The foundational record of web browsing.

AAAA Record RFC 3596

Maps a domain name to a 128-bit IPv6 address (e.g., 2606:4700:3036::6815:3015), enabling next-generation internet routing.

CNAME Record RFC 1034

Canonical Name alias pointing one subdomain to another hostname. Cannot coexist with other records at zone apex.

MX Record RFC 1035

Mail Exchange record routing incoming SMTP email to receiving mail servers, ranked by numerical priority (lower priority = primary).

TXT Record RFC 1035

Holds arbitrary text strings for SPF email security policies, DKIM cryptographic signatures, DMARC compliance, and domain ownership tokens.

NS Record RFC 1035

Authoritative Name Server delegation indicating which nameservers hold the zone file and handle queries for the domain.

SOA Record RFC 1035

Start of Authority specifying primary master nameserver, admin email, zone serial number, refresh/retry timers, and negative caching TTL.

CAA Record RFC 8659

Certification Authority Authorization specifying which CAs (Let's Encrypt, DigiCert) are legally permitted to issue SSL certificates.

PTR Record RFC 1035

Pointer record for Reverse DNS lookups (in-addr.arpa or ip6.arpa), mapping an IP address back to a hostname. Essential for SMTP deliverability.

Query Resolution Flow

The 4 Stages of Iterative DNS Resolution

When a client browser queries a domain name, the request navigates 4 distinct server tiers before retrieving the authoritative IP address:

Recursive Resolver

Operated by your ISP, Cloudflare (1.1.1.1), or Google (8.8.8.8). Checks local cache before initiating iterative queries.

Root Nameservers (.)

13 global root server IP addresses (A through M root) operated by ICANN, NASA, VeriSign, and RIPE NCC directing to TLD servers.

TLD Nameservers

Top-Level Domain servers (.com, .net, .top, .org) that maintain the authoritative nameserver delegations for all registered domains.

Authoritative Server

The final nameserver hosting the actual zone file. Returns the A/AAAA record with its Time-to-Live (TTL) value.

SPF Policy

Sender Policy Framework

Published in a TXT record (e.g. v=spf1 include:_spf.google.com ~all), SPF tells receiving mail servers which IP addresses are authorized to send email on behalf of your domain.

Prevents forged envelope senders

DKIM Signatures

DomainKeys Identified Mail

Uses asymmetric public key cryptography published in a subdomain TXT record (selector._domainkey.domain) to cryptographically sign outbound emails and verify they were not tampered in transit.

Ensures email message integrity

DMARC Enforcement

DMARC Alignment

Published at _dmarc.domain, DMARC specifies how receiving mail systems should treat unaligned emails (p=none, p=quarantine, or p=reject).

Mandated by Google & Yahoo

Sysadmin DNS Knowledge Base

Frequently Asked Questions: DNS Records, TTL & Propagation

DNS propagation delays are governed by the Time-to-Live (TTL) configured on the prior DNS record. Recursive DNS resolvers cache the old record until that timer counts down to zero. If your previous TTL was 86,400 seconds (24 hours), worldwide ISP resolvers will continue returning the cached IP address until the TTL expires.

Under RFC 1034 section 3.6.2, a CNAME record cannot coexist with any other record for the same hostname. Because the zone root (apex) requires mandatory SOA and NS records, standard CNAMEs are illegal at the root. CNAME Flattening (or ALIAS/ANAME records) resolves the CNAME target at the authoritative nameserver and returns an A record directly to the client.

Anycast routes queries to the topologically nearest datacenter using BGP routing announcements. Instead of all queries routing to a single physical server, hundreds of worldwide PoPs share the exact same IP address. This distributes DDoS traffic across multiple points of presence and slashes roundtrip resolution latency down to single-digit milliseconds.