What each DNS record does
| Record | Purpose | Example |
|---|---|---|
| A | Points a name to an IPv4 address | 93.184.215.14 |
| AAAA | Points a name to an IPv6 address | 2606:2800:21f:cb07::1 |
| CNAME | Alias to another name (not allowed at the root domain) | www → shops.myshopify.com |
| MX | Mail servers, with priority (lower = preferred) | 1 smtp.google.com |
| NS | The authoritative name servers for the zone | ns1.cloudflare.com |
| TXT | Free text: SPF, domain verification, DKIM, DMARC | v=spf1 include:_spf.google.com -all |
| SOA | Zone metadata: primary server, admin, serial, timers | |
| CAA | Which certificate authorities may issue SSL certificates | 0 issue "letsencrypt.org" |
| PTR | Reverse DNS: IP → name. Important for mail servers | 8.8.8.8 → dns.google |
| HTTPS / SVCB | Tells browsers about HTTP/3, ECH and alternative endpoints |
SPF, DKIM and DMARC: stop people spoofing your email
Anyone can put your domain in the “From” line of an email. These three DNS records let receiving mail servers tell the real thing from a forgery. Since 2024, Gmail and Yahoo require them for bulk senders, and missing records are a top reason business emails land in spam.
- SPF (TXT at your domain) lists the servers allowed to send your mail. It must start with
v=spf1, stay under 10 DNS lookups, and end with-allor~all. You can have only one SPF record. - DKIM (TXT at
selector._domainkey.yourdomain) publishes a public key so receivers can verify a cryptographic signature on each message. We automatically try the common selectors used by Google Workspace, Microsoft 365, Zoho, Mailchimp and others. - DMARC (TXT at
_dmarc.yourdomain) tells receivers what to do when SPF/DKIM fail (p=none,quarantineorreject) and where to send reports. Start withnoneto monitor, then tighten.
Quick win: if you have no DMARC record, add a TXT record at _dmarc with v=DMARC1; p=none; rua=mailto:[email protected]. You’ll start receiving reports on who is sending mail as your domain. Move to p=quarantine once your legitimate senders pass.
Why compare two resolvers?
Resolvers cache records for the TTL (time to live) shown in the results. Right after you change DNS, one resolver may still hold the old answer while another already has the new one. Compare mode queries Cloudflare and Google side by side, which is a quick way to see whether a change has spread. The DNSSEC badge shows when the resolver cryptographically validated the answer.