Reading a record
Every DNS record has the same shape: name TTL class type data. The TTL (seconds) says how long resolvers may cache it; the class is almost always IN; the type decides how to read the data. dig prints exactly this format in its ANSWER SECTION, so you can paste it straight in.
The email trio
SPF (a TXT record at the domain) lists which servers may send mail from the domain. It is evaluated left to right; the first matching mechanism decides, and the qualifier in front of it (- fail, ~ softfail, ? neutral, + pass) is the result. Only ten mechanisms that cause DNS lookups (include, a, mx, ptr, exists, redirect) are allowed in total, counting nested includes, and exceeding that gives a permanent error that makes the record useless. End with -all or ~all; +all authorises the whole internet.
DKIM publishes a public key at selector._domainkey.domain; the sending server signs each message with the private key. Keys should be 2048-bit RSA or Ed25519; many receivers now reject 1024-bit.
DMARC (_dmarc.domain) tells receivers what to do when neither SPF nor DKIM aligns with the From domain (p=none, quarantine, reject) and where to send aggregate reports (rua=). Start with p=none and reports, fix the sources that fail, then move to reject.
Other records worth knowing
- CAA: which certificate authorities may issue for the name.
0 issue "letsencrypt.org"blocks every other CA; a missing CAA record allows all. - SRV: priority, weight, port, target for a service such as
_sip._tcpor_xmpp-client._tcp. Lower priority wins; weight splits load among equals. - SOA: the zone's serial (bump it on every change for secondaries to notice), refresh/retry/expire timers for secondaries, and the negative-caching TTL for NXDOMAIN answers.
- HTTPS: tells browsers a site supports HTTP/3 (
alpn="h3,h2") and carries Encrypted ClientHello keys.
Questions
How do I get the records for my domain?
dig example.com ANY rarely works any more; query each type: dig example.com MX, dig TXT example.com, dig _dmarc.example.com TXT, dig +short example.com A. Paste the answer lines here.
Why does SPF say “too many DNS lookups”?
Every include:, a, mx, ptr, exists and redirect counts, including the ones inside the records you include. Google Workspace alone uses several. Flatten rarely used includes into ip4/ip6 ranges or drop unused services.
Why does my CNAME not work at the root domain?
A CNAME cannot coexist with other records at the same name, and the apex always has SOA and NS records. Use the provider’s ALIAS/ANAME/flattening feature or A/AAAA records.
What TTL should I use?
3600 (one hour) is a normal default. Lower it to 300 a day before you plan to change a record, then raise it again. Very low TTLs increase load on your authoritative servers and slow down lookups slightly.