DNS Record Lookup

What each record type is for

A and AAAA point a hostname at an IPv4 and IPv6 address respectively. CNAME points one hostname at another, which is how most managed hosting and CDN setups are wired. MX names the servers that accept mail for the domain, in priority order. NS names the authoritative nameservers — the servers that decide all of the above.

TXT is the interesting one. It holds arbitrary text, and by convention it now carries most of the domain's security policy: the SPF record that says which servers may send mail as you, the DMARC record that says what to do when authentication fails, DKIM public keys, and the verification strings that prove domain ownership to a dozen different services.

There is no such thing as propagation

The word is misleading and it causes a lot of unnecessary waiting. Changing a DNS record is instantaneous at the authoritative nameserver. What takes time is the expiry of copies that resolvers around the world cached before you made the change.

How long that takes is set by you, in advance, through the record's TTL. A record with a 3600-second TTL can be served from a cache for up to an hour after you change it. Nothing is travelling anywhere, and no amount of refreshing accelerates it.

The practical technique: lower the TTL a day before a planned migration, make the change, then raise it again once the new value has settled. Doing it in the other order is the classic cause of a cutover that drags on all afternoon.

Why the TXT records deserve a second look

SPF has a hard limit of ten DNS lookups when it is evaluated. Every include: of a provider counts, and some providers' records contain includes of their own. Cross the limit and the whole record becomes a permanent error, which means it authorises nothing — and the failure is entirely silent until mail starts being rejected.

The limit is easy to cross by accretion, because each individual addition looks harmless. A record accumulated over three years, with a mail provider, a CRM, an invoicing tool and a helpdesk in it, is a record worth counting.

Two SPF records on one domain is also a permanent error rather than a merge, and it is a common result of two people each adding one.

Authoritative answers versus what you see

This lookup queries public resolvers, which is what your visitors' machines effectively do. That is usually what you want to know — the answer the internet is currently receiving.

It does mean a very recent change may not be visible yet, for the caching reasons above. If the answer here disagrees with your DNS provider's control panel, the change is probably correct and simply not expired from cache. If it still disagrees well past the TTL, check the NS records: DNS for the domain may be answered by nameservers other than the ones you are editing.

Records change when nobody meant them to

The reason DNS is worth monitoring rather than checking is that its failures are quiet. A record changes; the site keeps working for anyone with the old value cached; the person who changed it did so in a different tool for a different reason.

IT Watch fingerprints every record set on the first check, treats that as the baseline, and reports the difference when it changes — which record, what it was, what it is now.

Common questions