What is the difference between an A record and a CNAME?

An A record maps a name straight to an IPv4 address. A CNAME makes one name an alias of another name, and the resolver continues the lookup at the target.

Can a CNAME and an A record use the same name?

Usually no. A standard CNAME owner cannot also hold A, AAAA, MX, TXT, or other data. Split the jobs onto different names, or confirm whether the DNS host offers ALIAS, ANAME, or CNAME flattening.

Can the zone apex use a CNAME?

Standard DNS cannot put a plain CNAME at the apex because that name must keep SOA and NS. Some hosts synthesize a similar alias with ALIAS, ANAME, or CNAME flattening; TTL, DNSSEC, and failure behavior follow that host's docs.

Why is a DNS change not live yet?

Recursive resolvers and clients may still hold the old answer or a negative cache until the original TTL expires. A local proxy, hosts file, or browser Secure DNS can also make two queries disagree.

Is a CAA record required?

No. CAA only limits which certificate authorities may issue for the name. After you publish it, every CA you actually use must be allowed, or issuance and renewal fail.

DNS Record Types: A, AAAA, CNAME, TXT, and CAA

DNS record types A, AAAA, CNAME, TXT, and CAA store different answers. A and AAAA hold the server address. CNAME holds another name so a CDN or host can keep the later addresses. TXT holds ownership proofs and mail policy. CAA names which certificate authorities may issue.

When the hostname should reach a server you control, publish A or AAAA. When the platform issues a hostname instead of a stable IP, publish CNAME. TXT and CAA do not send traffic; they only constrain verification and issuance.

How DNS record types A, AAAA, CNAME, TXT, and CAA split between traffic routing and stored policy — A, AAAA, and CNAME decide where traffic goes. TXT and CAA store verification, policy, or certificate limits.

How DNS record types A, AAAA, CNAME, TXT, and CAA differ

Record	Value	Common job	Usual failure
A	IPv4 address	Point a name at an IPv4 server	The server IP changed and the record did not
AAAA	IPv6 address	Point a name at an IPv6 server	IPv6-capable networks try an address the service cannot serve
CNAME	Another name	CDN, hosted platform, object storage	The same owner also has A, TXT, or MX
TXT	A text string	Domain ownership, SPF, DKIM, DMARC	The console appended the zone, or the copied value gained a space
CAA	A CA identifier	Limit which issuers may mint certificates	The CA already in use is missing, so renewal fails

Consoles label the DNS name as Host, Name, or Record name. Each record still has a name, a type, a value, and a TTL. Google Cloud DNS records overview(opens in a new tab) lists common uses. A and CNAME semantics are in RFC 1034(opens in a new tab). AAAA is RFC 3596(opens in a new tab). CAA is RFC 8659(opens in a new tab).

A records store an IPv4 address

An A record fits a server with a stable public IPv4 address:

example.com.      300  IN  A  203.0.113.10
www.example.com.  300  IN  A  203.0.113.10

203.0.113.10 is a documentation address. Replace it with the real entry IP. Check the published answer:

dig +short example.com A

If the public IP changes often, do not keep editing A by hand. A fixed load-balancer hostname, a vendor alias, or a reliable dynamic DNS updater should own that address.

AAAA records store an IPv6 address

AAAA holds an IPv6 address (RFC 3596(opens in a new tab)):

example.com.  300  IN  AAAA  2001:db8::10

Publish AAAA only when the entry service, firewall, reverse proxy, and monitoring all handle IPv6. A wrong AAAA fails on IPv6-capable clients while IPv4-only clients still succeed.

dig +short example.com AAAA
curl -6 -I https://example.com/

CNAME records leave later addresses with the provider

A CNAME value is another name, not an IP. After a CDN assigns example.cdn-provider.net, the alias looks like this:

images.example.com.  300  IN  CNAME  example.cdn-provider.net.

A lookup for images.example.com continues at the provider name. Later edge-IP changes stay on the provider side.

RFC 1034(opens in a new tab) states the occupancy rule: if a CNAME is present at a node, no other data should be present. RFC 2181(opens in a new tab) repeats that the CNAME owner may not hold other data aside from DNSSEC records.

CNAME mixed with A and TXT on one name, then the same jobs split onto images, verification, and the apex — When CNAME, TXT, and mail records must all exist, give each job a different name.

Why the zone apex cannot hold a plain CNAME

The apex example.com must keep SOA and NS. A plain CNAME cannot share a name with those records, so standard DNS forbids a CNAME at the apex.

Some hosts offer ALIAS, ANAME, or CNAME flattening so the apex can follow another hostname while answers still look like A or AAAA. Cloudflare CNAME flattening(opens in a new tab) resolves the target and returns addresses. Amazon Route 53 alias records(opens in a new tab) do the same for selected AWS targets. Google Cloud DNS(opens in a new tab) documents an ALIAS type as ANAME or CNAME flattening, configurable through gcloud or the API, not the Cloud DNS console. ALIAS, ANAME, and CNAME flattening are implemented by the DNS host, not by RFC 1034. TTL, DNSSEC, and failure behavior follow that host’s documentation.

TXT records hold ownership proofs and mail policy

A third-party platform that needs domain ownership usually gives an exact TXT:

verification.example.com.  300  IN  TXT  "verify_abc123"

SPF, DKIM, and DMARC also use TXT. One name may have several TXT strings; each value must stay complete.

dig +short verification.example.com TXT
dig +short _dmarc.example.com TXT

If the platform still reports failure, query the final DNS answer and check these branches:

The console already appended the zone, so the owner became verification.example.com.example.com.
The copied value gained a space, curly quotes, or a line break.
The type was set to CNAME instead of TXT.
The queried name does not match the name the platform asked for.
An earlier NXDOMAIN is still in negative cache.

CAA records limit who may issue certificates

CAA can allow a CA to issue for exact names, and a separate issuewild property can cover wildcards:

example.com.  300  IN  CAA  0 issue "letsencrypt.org"
example.com.  300  IN  CAA  0 issuewild "letsencrypt.org"

With no CAA, any CA that validates the domain may issue. After CAA exists, the CA must confirm it is allowed before issuance. Let’s Encrypt’s CAA identifier is letsencrypt.org (Let’s Encrypt CAA(opens in a new tab)). issue already covers wildcards unless issuewild is present; add issuewild when wildcard permission should be stated on its own.

dig +short example.com CAA

Before publishing CAA, list the current certificate, any backup certificate, and any CDN-managed certificate. Omitting a CA that already issues for the name blocks the next issuance or renewal.

Lowering TTL does not flush caches that already exist

TTL is how long a resolver may cache an answer. If the old record had TTL 3600, changing it to 300 does not shorten answers that are already cached; those copies can remain until the original 3600 seconds end.

Before moving an entry, lower TTL by at least one old TTL period, wait for that cache to expire, then change the record. After the cut looks stable, raise TTL again. An old TTL of 3600 seconds means lower it at least one hour before the cut. Lowering it only at cutover leaves the previous cache in place.

Different networks returning different addresses is not always “global propagation.” Recursive DNS, a local proxy, browser Secure DNS, a hosts file, and the operator network all change what a query sees. NXDOMAIN and empty answers can also be cached; RFC 2308(opens in a new tab) is the negative-cache rule.

Confirm the published answer after a change

# Who is authoritative for this name
dig +short example.com NS

# What this machine and two public resolvers see
dig example.com A
dig @1.1.1.1 example.com A
dig @8.8.8.8 example.com A

# Whether a CDN or host alias is in place
dig +short images.example.com CNAME

# Whether TXT and CAA returned the stored strings
dig +short verification.example.com TXT
dig +short example.com CAA

Once those DNS record types answer as intended, HTTPS, the response body, and cache headers still decide whether the site opens.