What each DNS record type does

A handful of record types cover almost everything, and one number — the TTL — explains most of the confusion around changes.

The types you will meet

• A — an IPv4 address for a name.
• AAAA — an IPv6 address. Absence is normal; plenty of domains are still IPv4 only.
• CNAME — an alias pointing at another name. A name with a CNAME cannot have other records alongside it, which is why you cannot put one at the root of a domain.
• MX — which servers accept mail, with a priority. Lower numbers are tried first.
• TXT — free text, which is where SPF, DMARC, DKIM and every service verification token live.
• NS — which nameservers are authoritative for the zone.
• SOA — administrative details about the zone, including the serial number that secondaries watch for changes.
• CAA — which certificate authorities may issue certificates for the domain. It is checked at issuance, so it constrains new certificates rather than existing ones.

TTL is what makes changes slow

Every record carries a time to live: how long a resolver may keep the answer before asking again. A record with a 24-hour TTL can be served from caches for a full day after you change it.

The clock starts when each resolver cached its copy, not when you made the change. That is why a change appears instantly for you, in an hour for a colleague, and tomorrow for a customer.

Before a migration, lower the TTL to a few minutes and wait for the old TTL to expire everywhere. Then make the change, confirm it, and raise the TTL again. Lowering it on the day achieves nothing, because the caches already holding the old value are still holding it for the old duration.

Why two lookup tools disagree

They asked different resolvers, and each caches independently. One may still be within the TTL of an answer it fetched before your change.

This is all "DNS propagation" is. Nothing is being pushed anywhere — caches are simply expiring at different times, which is why the process is so difficult to observe and so easy to worry about.

NXDOMAIN is not the same as no records

NXDOMAIN means the name does not exist at all.

An empty NOERROR means the name exists but has no record of the type you asked for — what you get asking for AAAA on an IPv4-only domain. Tools that render both as "not found" hide a distinction worth having when something is broken.

Frequently asked questions

How long does a DNS change take?

Up to the old TTL of the record, counted from when each resolver last cached it. Lower the TTL well before a migration and wait for the old value to expire, or the reduction does nothing.

Why can I not put a CNAME at the root of my domain?

A name with a CNAME cannot have other records, and a domain root must have NS and SOA records. Providers offer ALIAS or ANAME records that work around it.

What is the difference between NXDOMAIN and an empty answer?

NXDOMAIN means the name does not exist. An empty NOERROR means it exists with no record of the type you asked for.

Why do two DNS checkers show different answers?

They asked different resolvers, and each caches independently. One is still within the TTL of an older answer.

Does a missing DNSSEC signature mean something is wrong?

No. It usually means the domain is not signed, which most still are not.