Start with the hostname and purpose
Before editing a record, identify the exact hostname, service and record type involved. The zone apex, www, mail, selector._domainkey and _dmarc are different names. Record the current value and TTL so you can compare the result and roll back safely.
A and AAAA provide addresses
An A record maps a hostname to IPv4 and an AAAA record maps it to IPv6. Every published address should belong to the intended service and be reachable on the required ports. A stale or broken AAAA can create a partial outage even when all IPv4 tests pass.
CNAME creates an alias, not a redirect
A CNAME makes one hostname resolve through another hostname; it does not change a browser URL. Follow the alias until it reaches usable address records and check for stale provider targets. A standard CNAME normally cannot coexist with other records at the same name, so do not place A or MX beside it.
MX controls inbound mail routing
MX records list mail hostnames and priorities; lower numbers are preferred. Each target should resolve to A or AAAA and should not be an IP literal or ordinary CNAME. An MX record only identifies a destination; verify SMTP availability, mailbox configuration and spam controls separately.
TXT carries policies and verification
TXT records can contain SPF, DKIM public keys, DMARC policies, provider verification tokens and other text. Publish one effective SPF record, preserve long values exactly as the provider specifies and check whether multiple TXT strings are joined by the receiving protocol. Never put private keys or secrets in public TXT data.
NS and SOA describe authority
NS records delegate a zone or subdomain to authoritative nameservers. SOA contains the primary server, responsible-party field, serial and timing values. Compare parent delegation with child-zone records, and use the serial to confirm whether an authoritative change reached the expected server.
CAA controls certificate issuance
CAA lets a domain owner state which certificate authorities may issue certificates. Check issue and issuewild separately, understand inheritance through the DNS hierarchy and keep an emergency renewal path documented. CAA affects certificate issuance, not ordinary browser access after a certificate already exists.
Use a controlled record-change workflow
Export or copy the old value, confirm the name and type, make one change, query the authoritative server and more than one recursive resolver, then test the dependent website or mail service. Wait for relevant caches before making another change. Avoid changing web, mail and security records in one untracked batch.
Common conflicts and diagnostic limits
Do not publish multiple SPF records, put an IP in an MX field, combine CNAME with A or MX at one name, leave an unreachable AAAA or assume a DNS response proves the application is healthy. Public DNS results can be cached or incomplete; confirm critical changes with the authoritative provider.
Check real data now
Use the live IIPP tool to inspect the domain or IP address you are working with.
DNS Record Lookup →