DNS Records Explained: A, AAAA, CNAME, TXT and More

DNS records are typed entries in an authoritative zone that map a name to data. An A record returns a 32-bit IPv4 address, an AAAA record a 128-bit IPv6 address, and a CNAME points one name at another. MX routes mail, TXT carries arbitrary strings, NS delegates a zone, and CAA limits which certificate authorities may issue for it. Every record has a TTL in seconds that controls how long resolvers cache it.

Moving a site behind a CDN in 2026 usually changes three Domain Name System record types: the CNAME, or apex A and AAAA records, that send traffic to the CDN; a TXT record that proves domain control; and the CAA record, which must allow the CDN's certificate authority. If you lower the TTL to 300 seconds at least one full old TTL before cutover, the rollback window shrinks to five minutes.

How DNS records actually resolve: flow, state and TTL

A stub resolver on the client sends one query to a recursive resolver. The recursive resolver walks the delegation chain: root, then TLD, then the NS set for your zone. It then asks your authoritative servers for the name and type. Each answer is cached for its TTL, so most lookups never leave the recursive resolver.

Three pieces of state matter in practice. The positive cache holds answers until the TTL expires. The negative cache holds NXDOMAIN and empty answers for the lesser of the SOA minimum field and the SOA record's own TTL (RFC 2308). That means a name queried before you create it can stay "missing" for that long. The third is delegation state: the parent zone's NS records carry their own TTL, commonly 172,800 seconds (48 hours) under large TLDs such as .com. That figure is the real source of the "DNS takes 48 hours" folklore.

A CNAME is chased by the recursive resolver, not by the client. The resolver follows the alias, resolves the target to A or AAAA, and returns the whole chain in one response. The added cost lands on cache misses at the resolver, where it is typically one extra authoritative lookup. It does not cost an extra client round trip.

DNS record types and what each one does

Most DNS-related outages during a CDN move come from the constraint column, not from the record's basic purpose.

What is a DNS A record versus an AAAA record in practice

A DNS A record and an AAAA record answer the same question for two address families. Dual-stack clients query both and race the connections under Happy Eyeballs (RFC 8305). That spec recommends waiting about 50 ms for the AAAA answer and staggering connection attempts by about 250 ms. If your AAAA record points at an old origin while the A record points at the CDN, IPv6 users quietly bypass the CDN.

Which DNS records change when moving to a CDN

A CDN cutover is a CNAME change plus three checks (TXT, CAA and HTTPS), and MX and NS should not move at all.

The TTL math decides your rollback speed. Say the CNAME currently has a TTL of 3,600 seconds. Lower it to 300, then wait at least 3,600 seconds so every cached copy of the long TTL has expired, then cut over. Worst-case staleness on rollback is now 300 seconds. With an old TTL of 86,400, the same procedure needs a 24-hour lead. Some resolvers enforce their own TTL floors, so treat 300 as a target, not a guarantee.

Weighted DNS is also how a second CDN gets introduced without a hard cutover. BlazingCDN can run behind DNS with a weighted multi-CDN traffic split, with custom domains and HTTPS certificates included on every plan. Zone onboarding takes about one hour with an engineer.

CNAME vs. neighbors that get confused with it

CNAME vs. ALIAS or ANAME: ALIAS and ANAME are not standard DNS record types. They are provider features, sometimes called CNAME flattening, in which the authoritative server resolves the target itself and serves synthesized A and AAAA records. That makes apex aliasing possible, but the answer reflects the authoritative server's view of the target, not the client's. That can affect geo-steered CDNs.

CNAME vs. HTTP redirect: a CNAME changes which server answers, while the browser's URL and the TLS hostname stay the same. A 301 or 308 changes the URL itself. Only the redirect affects caching keys, cookies and SEO canonicalization.

NS vs. SOA: NS records say who is authoritative for a zone. The SOA record describes the zone itself: serial, refresh timers and negative-caching TTL. Changing DNS providers touches NS at the parent. Debugging stale NXDOMAIN answers means reading the SOA.

Common misconceptions about DNS records

• "Propagation takes 48 hours." Record changes inside a zone are bounded by the old record's TTL. Only delegation changes at the parent inherit the long NS TTL.
• "TXT records max out at 255 characters." Each string does. A single TXT record can hold several strings that consumers concatenate, which is how long DKIM keys fit.
• "A CNAME costs the user an extra round trip." The recursive resolver chases it and returns the full chain in one response.
• "No CAA record means certificates fail." The opposite is true: with no CAA record, any certificate authority may issue. Failures start once someone adds a CAA record that omits the CDN's authority.

FAQ: DNS records, A and AAAA records, and CDN setup

What is a DNS A record?

A DNS A record maps a hostname to one 32-bit IPv4 address. It is record type 1 in the DNS specification. A name can hold several A records, which resolvers return as a set, and clients usually try them in order or rotation. Its TTL in seconds sets how long recursive resolvers cache the address before asking the authoritative server again.

Do I need an AAAA record when my site sits behind a CDN?

You need an AAAA record only if the CDN serves IPv6 and you want IPv6 clients to use it. If you use a CNAME to the CDN hostname, the CDN controls the AAAA answer for you. If you set apex addresses manually, keep A and AAAA records in sync, or dual-stack users will bypass the CDN.

Can I use a CNAME record at the root domain for a CDN?

No, the DNS standard forbids a CNAME at the zone apex. The apex must hold SOA and NS records, and a CNAME cannot coexist with other data at the same name. The workarounds are a DNS provider's ALIAS or flattening feature, or static A and AAAA records pointing at Anycast addresses the CDN publishes.

Which DNS record types change when moving to a CDN?

The CNAME or apex A and AAAA records change, because they direct traffic to the CDN. You also usually add a TXT validation record, confirm that CAA allows the CDN's certificate authority, and clean up any HTTPS record hints. MX and NS records stay untouched unless you are also moving mail or DNS hosting.

How long do DNS record changes take to apply?

A DNS record change applies as soon as cached copies expire, which takes at most the old record's TTL. A record with a 300-second TTL turns over within about five minutes. Nameserver changes at the registrar take longer, because parent NS records under large TLDs commonly carry 172,800-second TTLs, which is about 48 hours.

Audit your DNS records before the CDN cutover

This week, export your zone and list every record with its TTL. Flag four things: any CNAME you plan to move whose TTL is above 300 seconds, any apex served by hand-maintained A and AAAA records, any existing CAA record, and any HTTPS record carrying address hints. Query each public hostname from two different recursive resolvers and confirm that both address families point where you expect. That ten-minute audit catches most cutover surprises before they reach users.

If your audit points to a CDN cutover for video, software or large-file traffic, the BlazingCDN features overview lists what each zone includes, such as custom domains, HTTPS certificates, origin shield and purge through the REST API.