DNS (Domain Name System)
- a protocol, part of the Internet Protocol (IP) Suite
- hierarchical and distributed naming system for computers, services, and other resources in the Internet
- naming database in which internet domain names are located and translated into Internet Protocol (IP) addresses
- translates domain names to IP addresses so browsers can load Internet resources
- helps Internet users and network devices discover websites using human-readable host names, instead of numeric IP addresses; For humans, domain names are a lot easier to remember than a sequence of numbers.
- DNS configuration settings of some website are what allows visitors to still access that website even after it gets moved to a new hosting provider (its IP address will change but domain name will not)
For a hosted web site we need to specify (usually 2) DNS servers. These could be provided by hosting provider but we can specify custom ones e.g. Cloudflare DNS servers. These DNS servers will be nodes in DNS distributed database system which will be providing DNS records about our domains for whoever queries about them. Let's see which DNS records we can set.
Common DNS Records
- A (A record, Address record, IPv4 address record)
- maps from an IPv4 address to a domain name
- used to point the domain name at one or multiple IP addresses
- also referred to as a host or hostname
- AAAA (IPv6 address record) maps domain name to IPv6 address
- CNAME (Canonical Name record)
- used to create an alias from one hostname to another
- maps one domain name (an alias) to another (the canonical name)
- Example: example.com has an A record which points to the IP address. If we say "www.example.com is a CNAME to example.com" and "ftp.example.com is a CNAME to example.com" that means that someone accessing www.example.com or ftp.example.com will be pointed to the same IP address that example.com points to. This is useful so that when your IP address changes, you only have to update example.com’s entry (DNS A record for example.com), and www.example.com and ftp.example.com automatically point to the right place.
- If you already have an A record, you will not use a CNAME
- CNAME record tells anyone visiting a subdomain to also use the same DNS records as another domain or subdomain.
- This sort of thing is convenient when running multiple services from a single IP address (e.g. FTP server and web server share the same IP address but different port)
- CNAME records only work for subdomains and must always point to another domain or subdomain and never directly to an IP address.
- When a DNS resolver encounters a CNAME record while looking for a regular resource record, it will restart the query using the canonical name instead of the original name.
- MX (Mail eXchanger)
- allows you to control the delivery of mail for a given domain or subdomain. In our context, MX records can be set on a host-by-host basis to point to other hosts on the Internet (usually with permanent connections) that are set up to accept and/or route mail for your hostname(s). Setting a backup MX makes the entry you specify a secondary mail exchanger. This means that delivery will be attempted to your host first, and then to the backup host you specify if that fails.
- TXT (TXT records)
- used to store information. Common uses include SPF, DKIM, etc.
CNAME vs A name
An A record points a hostname directly to an IP address, while a CNAME record points a hostname to another hostname.
Think of an A record like a physical street address, and a CNAME record like a nickname or a forwarding address. They are both parts of the Domain Name System (DNS), which acts like the internet's phonebook to help computers find websites.
Quick Comparison
Feature A Record (Address) CNAME Record (Canonical Name)
What it points to An IP address (e.g., 192.0.2.1) Another domain name (e.g., ://shopify.com)
Best used for The main root domain Subdomains and third-party services
(e.g., yourdomain.com) (e.g., ://yourdomain.com)
Speed Faster (resolves in one step) Slower (requires multiple lookup steps)
Coexistence Can live with MX, TXT, and Cannot share a name with any other records
other records
The A Record: The Direct Map
The "A" stands for Address. This is the most basic type of DNS record. It connects a name you can type (like a website) straight to the unique number of the computer hosting that site.
- The Analogy: You look up "The Central Library" in a phone book, and it gives you the exact physical location: 123 Main Street.
- Real-world Example: You want your root domain mywebsite.com to open your web server. You create an A record pointing to your server's IP address.
- Name: mywebsite.com
- Type: A
- Value: 192.0.2.23
The CNAME Record: The Alias
"CNAME" stands for Canonical Name. Instead of pointing to a number, it points to another name. It tells the computer, "Hey, I don't have the IP address, go look at this other website name to find it!"
- The Analogy: You look up "The City Book Place" in the phone book. The book says, "This is just another name for The Central Library. Go look up The Central Library instead."
- Real-world Example: You build an online shop using a service like Shopify. Shopify gives you a unique store address like ://myshopify.com. You want customers to see ://mywebsite.com instead. You create a CNAME record:
- Name: ://mywebsite.com
- Type: CNAME
- Value: ://myshopify.com
Example Scenario: What Happens Behind the Scenes?
Imagine a user types ://mywebsite.com into their browser. Here is how the internet figures out where to go using both records:
- The CNAME Step: The computer asks the DNS server for the location of ://mywebsite.com. The server replies: "That name is just an alias for ://myshopify.com."
- The A Record Step: The computer then asks the DNS server: "Okay, what is the address for ://myshopify.com?"
- The Final Destination: Shopify’s DNS server looks at its own A record and replies: "The IP address is 23.227.38.65."
- The website opens!
Why use a CNAME instead of an A Record?
If Shopify ever changes its server IP addresses, they only have to update their own A record. Because your CNAME points to their name and not their number, your shop keeps working perfectly without you changing a thing.
Can CNAME coexist with A name?
In the Domain Name System (DNS), a CNAME (Canonical Name) record cannot coexist with other DNS records that share the exact same hostname (Name).
Because a CNAME acts as a pointer or alias for another domain, it overrides all other records for that specific name. Standard DNS specifications explicitly prohibit mixing a CNAME with A, AAAA, MX, TXT, or NS records for the same host.
The Exceptions to the Rule
There are only two scenarios where a CNAME can be used alongside other data at the same name:
- DNSSEC: If your domain uses DNS security, cryptographic records (like RRSIG and NSEC) must exist alongside the CNAME.
- "CNAME-like" proprietary records: Many DNS providers (like DNSimple, Cloudflare, and others) offer custom ALIAS or ANAME records. These synthetic records allow you to alias a domain while still hosting other records like MX records for email alongside them.
Common DNS Conflicts
If you try to add a CNAME, you will usually get an error from your DNS provider if you already have these records for the same name:
A or AAAA records: CNAMEs cannot map to an IP address directly, so they conflict with address records.
MX records: If you need a CNAME for a web service, but also need MX records for email, you cannot put both on the same subdomain (e.g., you cannot have ://yourdomain.com be both a CNAME and an MX record).
TXT records: You cannot verify a domain with a TXT record if the hostname already has a CNAME.
How to Fix Coexistence Issues
If you need both types of records for the same purpose, consider these common workarounds:
- Use subdomains: You can create a CNAME on ://yourdomain.com and use your main yourdomain.com for your MX/TXT records.
- Use ALIAS/ANAME records: If your host allows it, switch to an ALIAS/ANAME record for the zone apex (the root domain) so that you can simultaneously maintain MX records for email.
- Use A/AAAA records: Instead of creating a CNAME, simply resolve the target domain to its IP address and create standard A/AAAA records, which can coexist with TXT or MX records.
DNS records for bojankomazec.com, my domain registered with GoDaddy:
=========================================================
Type Name Data TTL Delete Edit
=========================================================
A @ 216.58.213.115 600 seconds
NS @ ns31.domaincontrol.com. 1 Hour Can't delete Can't edit
NS @ ns32.domaincontrol.com. 1 Hour Can't delete Can't edit
CNAME email email.secureserver.net. 1 Hour
CNAME ftp bojankomazec.com. 1 Hour
CNAME ihXXXXXXXX6i gv-7sXXXXXXXXv3xr.dv.googlehosted.com. 1 Hour
CNAME www ghs.google.com. 1 Hour
CNAME _domainconnect _domainconnect.gd.domaincontrol.com. 1 Hour
SOA @ Primary nameserver: ns31.domaincontrol.com. 600 secs
MX @ smtp.secureserver.net. (Priority: 0) 1 Hour
MX @ mailstore1.secureserver.net. (Priority: 10) 1 Hour
=========================================================
CNAME records in blue are those that I had manually to set so that my bojan-komazec.blogspot.com gets redirected to bojankomazec.com. See Set up a custom domain - Blogger Help. Also, look at https://www.nslookup.io/domains/bojankomazec.com/webservers/.
Linux offers a DNS lookup tool which can be used to find out the nameservers and e.g. IP address of the domain:
$ host -t ns bojankomazec.com
bojankomazec.com name server ns31.domaincontrol.com.
bojankomazec.com name server ns32.domaincontrol.com.
$ host bojankomazec.com
bojankomazec.com has address 216.58.213.115
bojankomazec.com mail is handled by 10 mailstore1.secureserver.net.
bojankomazec.com mail is handled by 0 smtp.secureserver.net.
It can take up to 72 hours for setting new DNS records to take effect - while change is replicated across all DNS servers on the internet. (see DNS Propagation)
The network of DNS servers is hierarchical. Types of DNS servers are:
- Recursive resolvers (DNS recursors)
- clients first send to them DNS queries
- they are assigned by ISP but can be set manually:
- Cloudflare 1.1.1.1
- Google (8.8.8.8 and 8.8.4.4)
- they respond either with cached data or send the request to root, TDL and finally to Authoritative nameserver from which they receive IP address
- every recursive resolver knows about 13 (types of) DNS root nameservers
- Root nameservers
- when receive query about some domain name e.g. example.com they return the address of the TLD nameserver which contains information about the domain extension e.g. .com
- there are over 600 root nameservers which sync among themselves (anycast routing) and all contain the same data
- TLD (Top-Level Domain) nameservers
- they are domain extension-specific - each of them contains the list of authoritative servers for only a single domain e.g. .com or .ai.
- they return the address of authoritative servers
- Larger TLDs and registrars (like GoDaddy, Namcheap etc...) use an API call to notify the TLD operator of any new registrations and changes
- Authoritative nameserver
- resolver’s last step in the journey for an IP address
- they are domain-specific - each of them contains the list of IP addresses for a particular doman e.g. ftp.example.com or www.example.com
- they return the IP address for a given hostname or, if domain has a CNAME (alias domain name), resolver needs to repeat the whole process in order to get the IP address for that alias host name.
- when you register your web site, name servers you set for it are authoritative nameservers
To manage DNS records of domain e.g. example.com means setting DNS records for its root and subdomains. For each record we set:
- Type: A, CNAME, MX, ...
- Name: e.g. ftp (for ftp.example.com)
- Content: this is the value which depends on the type e.g. IPv4 address if A record, alias if CNAME etc....
- Proxy status: DNS only (proxy disabled) or Proxied (proxy enabled)
- TTL (Time to Live) - in minutes
NS Records
NS records (short for Name Server records) are a fundamental part of the Domain Name System (DNS). They tell the rest of the internet which DNS servers are the authoritative bosses for your domain.
In plain English: when someone types your website address into a browser, the NS records point them to the exact servers that hold the map (the IP addresses) for that domain.
How They Work (The Mailroom Analogy)
Think of the DNS process like looking up a physical business address:
- The Request: A user types example.com.
- The Registrar: The internet checks the global registry (like .com) to see where example.com is registered.
- The NS Record: The registry looks at your domain's NS records and says, "Go talk to ns1.nameserver.com—they have the official records for this site."
- The Resolution: The browser asks that specific name server for the actual website IP address (via an A record), and the site loads.
Crucial Rule: Without NS records, your domain is effectively lost. The internet will know you own the name, but it won't know which server to ask for directions to get there.
Why Do You Usually See Two or More?
You will almost never see just one NS record for a domain. They always come in clusters—usually at least two, sometimes four:
- ns1.provider.com
- ns2.provider.com
This is entirely for redundancy. If one name server goes down due to a hardware failure or a cyberattack, the other servers are there to instantly pick up the slack so your website, email, and cloud services don't go offline.
Changing NS Records
You typically edit NS records at your domain registrar (the place where you bought the domain).
You usually only change them when you are switching your DNS management to a new provider. For example, if you buy a domain at one company but want to route and protect your web traffic through a cloud platform like Cloudflare, you will replace the original registrar's NS records with Cloudflare's name servers.
Once you update them, it can take anywhere from a few minutes up to 48 hours for routers across the globe to learn the new directions—a period known as DNS propagation.
Resources:
How are DNS name-servers for a TLD updated when a new domain is registered? - Server Fault
DNS Lookup: How a Domain Name is Translated to an IP Address
DNS Lookup: How a Domain Name is Translated to an IP Address
