DNS

DNS records for a site and mail — examples

Which records to add for a website (A, AAAA, CNAME) and mail (MX, SPF, DKIM, DMARC) in a ZRAZU DNS zone, with ready examples and a note on every field.

Add these records in the zone editor on your domain's DNS tab. How to turn the zone on and use the editor is described in the DNS zone on ZRAZU servers. The examples below use example.com: put your own domain in, and take addresses and server names from your hosting provider or mail service.

How to read the examples: the Name @ means the domain itself, www means www.example.com.

Website

The address of the server where the site lives comes from your hosting.

Name   Type   Value
@      A      203.0.113.10
www    CNAME  example.com
  • A points a name to an IPv4 address.
  • AAAA does the same for IPv6. If your hosting did not give an IPv6 address, you do not need this record.
  • CNAME is an alias: a name points to another name (for example www to a site builder). Do not put CNAME on @ or next to other records of the same name.

For GitHub Pages and Vercel the editor has ready templates under Quick setup → Website. If you turn on domain forwarding, it replaces your A, AAAA and CNAME records for @ and www.

Mail

MX: where mail is delivered

Name   Type  Priority  Value
@      MX    10        mx1.example.com
@      MX    20        mx2.example.com

A lower priority wins: mail goes to the server with 10 first, and to the one with 20 if it is unavailable. Your mail service gives the exact server names. For Google Workspace and Microsoft 365 there are templates under Quick setup → Mail.

SPF: who may send on your behalf

SPF is a TXT record on @. It lists the services allowed to send mail from your domain:

Name  Type  Value
@     TXT   v=spf1 include:_spf.google.com ~all

Keep only one SPF record on a domain and combine all services in it. The part after include: comes from your mail service.

DKIM: signing messages

The mail service gives you a record name (like selector._domainkey) and a long key. Add them as TXT, copying the key in full:

Name                 Type  Value
selector._domainkey  TXT   v=DKIM1; k=rsa; p=...your_key...

Do not put quotes around the value: they are not needed and not accepted.

DMARC: what to do with forged messages

Name    Type  Value
_dmarc  TXT   v=DMARC1; p=none; rua=mailto:dmarc@example.com

p=none means "just observe": nothing is blocked, and you receive reports. This is the record the DMARC: monitor only template adds. Turn on stricter rules once you are sure your legitimate mail passes the checks.

Other useful records

  • CAA limits which certificate authorities may issue SSL for the domain. Example value: 0 issue "letsencrypt.org". Without CAA, any may.
  • TXT is also used to confirm domain ownership for Google, Meta and other services.
  • SRV describes a service: the value looks like "weight port server", for example 5 5060 sip.example.com, with a name like _service._protocol.
  • NS hands a subdomain to other name servers. Not needed for the domain itself (@).

If it didn't work

  • "A: an IPv4 address is needed". The A record got something that is not an IPv4 address (for example a site name). Use CNAME for a name.
  • "TXT: quotes inside the value are not supported". Remove quotes and backslashes.
  • "CAA: flag, tag issue/issuewild/iodef and value". Use the form 0 issue "letsencrypt.org".
  • "SRV: weight port target". Check that the value has three parts.
  • The name is outside the zone. A record name must belong to your domain.
  • Mail stops or the site does not open after a change. The editor checks this itself and offers Roll back the change. Also wait for the TTL: old values are still cached.

This page in Markdown