DNS is the address book of the internet, and every hostname, mail server, and verification string your domain relies on lives in it as a record. This Ultra Web Hosting reference walks through every DNS record type you are likely to touch: A, AAAA, CNAME, MX, TXT, SRV, and CAA, plus the NS, SOA, and PTR records working behind the scenes. Each section explains what the record does, shows a concrete example value, and calls out the mistake that trips people up most often.
- How DNS Works and Where You Edit It
- The Anatomy of a DNS Record
- A Record (IPv4 Address)
- AAAA Record (IPv6 Address)
- CNAME Record (Alias to Another Name)
- MX Record (Mail Routing)
- TXT Record (SPF, DKIM, DMARC, Verification)
- SRV Record (Service Discovery)
- CAA Record (Certificate Authority Authorization)
- NS and SOA Records (Zone Authority)
- PTR Record (Reverse DNS)
- TTL, Propagation, and Reading Records
Seven Record Types Cover Almost Everything
Most of what you will ever do in DNS uses a handful of record types. Point a name at a server with A or AAAA, alias one name to another with CNAME, route mail with MX, carry text like SPF and DKIM with TXT, advertise a service with SRV, and lock down SSL issuance with CAA.
- A / AAAA map a name to an IP address (v4 and v6)
- CNAME aliases one name to another name
- MX sends mail to the right server by priority
- TXT holds SPF, DKIM, DMARC, and verification strings
- SRV and CAA handle service discovery and cert control
Your Zone Lives in cPanel Zone Editor
If your domain uses our nameservers (ns1.ultranameservers.com, ns2.ultranameservers.com, ns3.ultranameservers.com), every record in this guide is added or edited in cPanel under Zone Editor. If your DNS is at Cloudflare or another provider, you make the same changes there instead.
- cPanel > Zone Editor > Manage, then Add Record
- See our "Managing DNS in cPanel Zone Editor" guide for the walkthrough
- Not sure where your DNS lives? Check the nameservers first
01. How DNS Works and Where You Edit It
When someone types your domain into a browser, their computer asks a resolver (usually run by their ISP or a service like a public DNS provider) to find the answer. The resolver walks down from the root of DNS to your domain's authoritative nameservers, which for domains on our platform are ns1.ultranameservers.com, ns2.ultranameservers.com, and ns3.ultranameservers.com. Those nameservers hold your zone, which is simply the collection of records for your domain. The nameserver returns the matching record (an A record with an IP, say), the resolver caches it, and the browser connects. That entire round trip usually takes a few milliseconds.
Because your domain is on our nameservers, you manage the zone in cPanel Zone Editor. Every record type below is added the same way: open Zone Editor, click Manage next to the domain, then Add Record, and pick the type. For a full tour of the interface, see our Managing DNS in cPanel Zone Editor guide. If your DNS is hosted elsewhere, the record fields are the same even if the buttons look different.
Changing your domain's nameservers and editing records inside the zone are two different things. Nameservers are set at your registrar and decide who is authoritative. Records are edited wherever that authoritative DNS lives. This guide is about the records; if you need to change nameservers, that happens at the registrar, not in Zone Editor.
02. The Anatomy of a DNS Record
Every record, regardless of type, is built from the same four parts. Once you can read these four fields you can read any record.
- Name (Host): which name the record applies to, for example
www.example.comor the bare domainexample.com(the zone apex or root). - Type: what kind of record it is: A, AAAA, CNAME, MX, TXT, SRV, CAA, and so on.
- Value (Data): the answer the record returns: an IP address, a hostname, a text string, or a set of fields.
- TTL: Time To Live, in seconds, telling resolvers how long they may cache the answer before asking again.
A fully qualified domain name (FQDN) ends in a trailing dot, like mail.example.com. That final dot means "this is the complete name from the root, do not append anything." Without it, some DNS systems treat the value as relative and quietly append your zone, turning mail.example.com into mail.example.com.example.com. When a record's value is a hostname (CNAME, MX, SRV target), include the trailing dot. cPanel Zone Editor often adds it for you, but always confirm it is there.
03. A Record (IPv4 Address)
An A record maps a name to an IPv4 address. This is the workhorse of DNS and the record that actually points your domain at the server hosting your website. When you set up hosting with us, the A record for your domain points at your account's server IP.
Name: example.com.
Type: A
Value: 192.0.2.10
TTL: 3600You typically have an A record for the bare domain (example.com) and one for www, though www is often a CNAME instead (see section 05). Subdomains like shop.example.com each get their own A record pointing wherever that subdomain is served.
An A record's value must be an IPv4 address, never a hostname. If you want to point a name at another name rather than an IP, you want a CNAME. Pointing a bare domain (parked or add-on) at another site is a separate topic covered in our domain pointer and parked domain guide.
04. AAAA Record (IPv6 Address)
An AAAA record (spoken "quad-A") does exactly what an A record does but for an IPv6 address. IPv6 addresses are longer and written in hexadecimal groups separated by colons. If your server has IPv6 connectivity, adding an AAAA record lets IPv6-only clients reach you directly.
Name: example.com.
Type: AAAA
Value: 2001:db8:85a3::8a2e:370:7334
TTL: 3600You do not need an AAAA record for your site to work; the world still runs largely on IPv4, and an A record alone is fine. Add AAAA only if your server actually has a working IPv6 address. Publishing an AAAA record for an address that is not reachable causes intermittent failures for IPv6 clients that are hard to diagnose, because those clients try IPv6 first and only some of them fall back to IPv4.
05. CNAME Record (Alias to Another Name)
A CNAME (Canonical Name) record aliases one name to another name rather than to an IP. When a resolver looks up the alias, it is told "actually, go look up this other name instead," and it follows the chain. CNAMEs are ideal when you want several names to track a single target, so you update one A record and everything pointing at it moves with it.
Name: www.example.com.
Type: CNAME
Value: example.com.
TTL: 3600Here www aliases to the bare domain, so www automatically resolves to whatever IP the apex A record holds. CNAMEs are also how services like content delivery networks, verification tools, and email providers ask you to point a subdomain at their infrastructure.
First, a CNAME cannot coexist with any other record at the same name. If www has a CNAME, it cannot also have an A, MX, or TXT record. Second, you cannot put a CNAME at the zone apex (the bare example.com), because the apex must carry NS and SOA records, and a CNAME is not allowed to sit alongside them. For the root domain, use an A record. Some DNS providers offer a workaround called CNAME flattening or ALIAS, but standard DNS does not permit an apex CNAME.
A Record
You are pointing a name directly at a server you control, especially the bare domain at the zone apex.
- The zone apex (
example.com) must be an A record - You know the fixed IP of the destination
- The name also needs MX or TXT records alongside it
CNAME Record
You are pointing a subdomain at another hostname, especially one whose IP may change or is managed by someone else.
- Aliasing
wwwor a subdomain to another name - A provider gives you a target hostname, not an IP
- The name needs no other records beside it
06. MX Record (Mail Routing)
An MX (Mail Exchanger) record tells the rest of the internet where to deliver email for your domain. Unlike most records, MX carries a priority number: lower numbers are tried first, so a primary server sits at priority 10 and a backup at 20. Mail servers try the lowest priority first and only fall back to higher numbers if it is unreachable.
Name: example.com.
Type: MX
Priority: 10
Value: mail.example.com.
TTL: 3600An MX record must point to a hostname, never to an IP address. The hostname it points to then needs its own A (or AAAA) record resolving to the mail server's IP. Pointing an MX straight at an IP is invalid and mail will bounce. Also, use the exact hostname your mail provider gives you: for changing MX records or moving mail to a provider like Microsoft 365, see our "How to Set Up Microsoft 365 Email" guide, and read this article for the step-by-step on editing MX records.
07. TXT Record (SPF, DKIM, DMARC, Verification)
A TXT record holds free-form text. On its own it does nothing, but a whole ecosystem of services reads specific TXT records for specific purposes. The three you will meet most often are email authentication records, and the fourth is domain verification.
SPF lists which servers may send mail for your domain. A domain must have exactly one SPF record:
Name: example.com.
Type: TXT
Value: v=spf1 include:_spf.example.net -all
TTL: 3600DKIM publishes a public key (on a selector subdomain) used to verify message signatures, and DMARC (on _dmarc.example.com) tells receivers what to do with mail that fails SPF and DKIM:
Name: _dmarc.example.com.
Type: TXT
Value: v=DMARC1; p=none; rua=mailto:[email protected]
TTL: 3600Domain verification is the fourth common use: a provider asks you to publish a unique string as a TXT record to prove you control the domain, then checks for it.
The full picture on how these three authentication records work together is in our email authentication guide, and the SPF syntax in particular is broken down in our SPF article. The number one TXT mistake is having two SPF records; a domain may have only one, so merge the includes into a single v=spf1 ... -all string.
08. SRV Record (Service Discovery)
An SRV (Service) record advertises where a particular network service lives, so clients can find it automatically. It is used by protocols like SIP (voice), XMPP (chat), and Microsoft Teams or Skype for Business autodiscover. The name encodes the service and protocol, and the value packs several fields.
Name: _sip._tls.example.com.
Type: SRV
Value: 100 1 443 sipdir.online.lync.com.
(priority weight port target)
TTL: 3600Reading the value left to right: priority (100, lower tried first), weight (1, for load balancing across equal priorities), port (443, the TCP or UDP port the service listens on), and target (the hostname providing the service, with a trailing dot).
The name must include the underscore-prefixed service and protocol labels exactly as the provider specifies, for example _sip._tls or _sipfederationtls._tcp. Get one label wrong and clients will not find the service. cPanel Zone Editor has dedicated SRV fields for priority, weight, and port, so you do not paste all four into one box; fill each field with its own value and put only the target hostname in the target field.
09. CAA Record (Certificate Authority Authorization)
A CAA (Certification Authority Authorization) record names which certificate authorities are allowed to issue SSL certificates for your domain. Before a CA issues a certificate it checks your CAA record, and if the record exists and does not list that CA, issuance is refused. It is a guardrail against a rogue or mistaken CA handing someone else a valid cert for your domain.
Name: example.com.
Type: CAA
Value: 0 issue "letsencrypt.org"
TTL: 3600The value has three parts: a flag (0 for standard), a tag (issue for single certs, issuewild for wildcards, iodef for a reporting address), and the CA's domain in quotes. You can publish several CAA records to authorize multiple CAs.
A CAA record that omits the CA you actually use will block your own SSL from being issued or renewed. If you add CAA records, make sure every authority you rely on (including our free AutoSSL provider) is listed, or you will get renewal failures. Our "CAA Records and SSL Issuance" guide covers exactly which values to publish, and for SSL in general see our SSL and HTTPS article. Once a certificate is issued, force visitors onto it by following our HTTP to HTTPS redirect guide.
10. NS and SOA Records (Zone Authority)
Two record types sit at the top of every zone and are mostly managed for you. NS (Name Server) records list the authoritative nameservers for the domain: on our platform those are ns1.ultranameservers.com, ns2.ultranameservers.com, and ns3.ultranameservers.com. The SOA (Start of Authority) record holds administrative data about the zone: the primary nameserver, a contact address, a serial number that increments on each change, and timers governing refresh and expiry.
Name: example.com.
Type: NS
Value: ns1.ultranameservers.com.
TTL: 86400You rarely edit NS or SOA records by hand, and you should not remove the NS records pointing at our nameservers while your domain is hosted with us; doing so breaks resolution for the whole domain. The SOA serial number is bumped automatically each time you save a change in Zone Editor, which is how secondary nameservers know to pull the updated zone.
11. PTR Record (Reverse DNS)
A PTR (Pointer) record is the reverse of an A record: it maps an IP address back to a hostname. Forward DNS answers "what IP is example.com?"; reverse DNS answers "what hostname owns 192.0.2.10?". PTR records matter most for outbound mail, because receiving servers check that a sending IP has a matching reverse record before they trust it.
Unlike every other record here, you do not create a PTR record in your own zone. Reverse DNS lives in a special zone controlled by whoever owns the IP address, which is the hosting provider or network operator, not the domain owner. On our platform, PTR records for shared IPs are managed by us. Our "What Is a PTR Record" guide explains reverse DNS in full and how to request a PTR change on a dedicated IP.
12. TTL, Propagation, and Reading Records
Every record carries a TTL, the number of seconds resolvers are allowed to cache the answer. A TTL of 3600 means one hour of caching; 300 means five minutes. Lower TTLs mean changes take effect faster but generate more lookups. A useful trick before a planned change: lower the TTL a day ahead, make the change, then raise it again once things settle.
When people say DNS "propagation," they mean the delay while old cached answers age out around the world according to their TTL. There is no global push; each resolver simply refreshes on its own schedule. Our nameservers update within moments of you saving a record, but a resolver that cached the old value keeps serving it until its TTL expires. For why a change is not instant everywhere, see our DNS propagation guide.
To confirm what a record actually resolves to right now, run your domain through our DNS Lookup tool. You can query any record type, see the value returned by our authoritative nameservers, and confirm a change is live before you rely on it. It is the quickest way to catch a missing trailing dot, a duplicate SPF record, or an MX pointing at the wrong host.
Quick Reference Table
| Type | Maps a name to | Example value | Watch out for |
|---|---|---|---|
| A | An IPv4 address | 192.0.2.10 |
Value must be an IP, not a name |
| AAAA | An IPv6 address | 2001:db8::1 |
Only add if IPv6 actually works |
| CNAME | Another hostname | example.com. |
Never at the apex; no siblings |
| MX | A mail server hostname | mail.example.com. |
Hostname not IP; uses priority |
| TXT | Free-form text | v=spf1 ... -all |
Only one SPF record allowed |
| SRV | A service location | 100 1 443 host. |
Underscore service/protocol labels |
| CAA | An authorized CA | 0 issue "letsencrypt.org" |
List every CA you use, or SSL breaks |
Not Sure Which Record You Need?
If you are staring at a set of records a provider handed you and are not certain where each one goes, send them to us. We will publish the records in your zone, confirm they resolve, and flip anything in cPanel that needs flipping. DNS is included support on shared, VPS, and dedicated plans.
Open a Support TicketQuick Recap: DNS Records at a Glance
The essentials to carry away from this guide:
- Every record has four parts: name, type, value, and TTL. Learn to read those and you can read any record.
- A and AAAA point names at IPs (v4 and v6); CNAME points a name at another name and never sits at the zone apex.
- MX routes mail by priority and must point to a hostname, not an IP; a CNAME cannot share a name with other records.
- TXT carries SPF, DKIM, DMARC, and verification strings; keep exactly one SPF record per domain.
- SRV advertises services with priority, weight, port, and target; CAA controls which CAs may issue your SSL.
- Watch the trailing dot, TTL, and propagation, and confirm any change with our DNS Lookup tool before you rely on it.
Last updated July 2026 · Browse all DNS articles
