How to add DNS records: A, CNAME, MX and TXT step by step

Sooner or later every domain owner gets the same instruction: "add this TXT record to verify your domain" or "point a CNAME to us". The change itself is small. What goes wrong is editing DNS in the wrong place, typing the name in the wrong format, or checking too early and assuming it failed.

This guide walks through the whole process for any provider.

Step 1: Find where your DNS is hosted

Your registrar (where you bought the domain) and your DNS host (where the records live) are often the same company, but not always. If you edit records at the registrar while the domain uses Cloudflare's nameservers, nothing happens.

Look up the nameservers:

dig NS example.com +short

On Windows:

nslookup -type=NS example.com

The answer tells you where to log in:

If you see your web host's name, the records are managed in that host's control panel.

Step 2: Open the DNS zone editor

The menu names differ, but every provider has a table of records with an "Add record" button:

• Cloudflare: select the domain, then DNS → Records → Add record.
• AWS Route 53: Hosted zones, select the domain, then Create record.
• GoDaddy: Domain Portfolio, select the domain, then DNS → Add New Record.
• Namecheap: Domain List → Manage → Advanced DNS → Add New Record.

Step 3: Fill in the fields

Every record has the same four parts:

The Name field is relative

This is the most common mistake. Most providers add your domain to whatever you type. To create www.example.com, type www, not www.example.com. Otherwise you end up with www.example.com.example.com.

Route 53 is the exception: it shows the domain suffix next to the field, so you type only the part in front of it.

The record types you will add most often

A and AAAA: point a name to an IP address

An A record maps a name to an IPv4 address, an AAAA record to an IPv6 address.

example.com.      A     203.0.113.10
www.example.com.  AAAA  2001:db8::10

Use them when your hosting gives you an IP address.

CNAME: point a name to another name

A CNAME makes one name an alias of another. The value is a hostname, never an IP address.

www.example.com.   CNAME  example.netlify.app.
shop.example.com.  CNAME  shops.myshopify.com.

Two rules to remember:

1. No CNAME on the root domain. example.com itself cannot be a CNAME, because it must also hold NS, SOA, MX and TXT records. Use an A record, or the provider's flattening feature (Cloudflare's CNAME flattening, Route 53's alias record).
2. A CNAME cannot share its name with any other record. If mail.example.com has a CNAME, it cannot also have a TXT or MX record.

MX: route email

MX records tell other servers where to deliver mail for your domain. Each has a priority; lower numbers are tried first.

example.com.  MX  1   aspmx.l.google.com.
example.com.  MX  5   alt1.aspmx.l.google.com.

The value must be a hostname with its own A or AAAA record, not an IP address and not a CNAME. When you switch email providers, delete the old MX records, or some mail will keep going to the old service.

TXT: verification, SPF, DKIM and DMARC

TXT records hold free text. Services use them to prove you own a domain and to publish email security policy.

example.com.                 TXT  "google-site-verification=abc123"
example.com.                 TXT  "v=spf1 include:_spf.google.com -all"
_dmarc.example.com.          TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
selector1._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."

Things that trip people up:

• Quotes. Some panels add them for you, others expect you to type them. If your provider shows the value with quotes after saving, don't add a second pair.
• One SPF record only. A domain may have many TXT records, but only one starting with v=spf1. Two SPF records make SPF fail entirely. Merge them into one record with several include: entries.
• Long DKIM keys. A single TXT string is limited to 255 characters. Good panels split longer keys automatically; if yours rejects the value, split it into several quoted strings in the same record.

Other types you may meet

• CAA limits which certificate authorities may issue certificates for your domain.
• SRV points a service, such as SIP or Microsoft 365 autodiscover, to a host and port.
• NS delegates a subdomain to different nameservers.

Step 4: Choose a TTL

TTL is how long resolvers keep the old answer. The trade-off is simple: a short TTL makes changes visible quickly, a long one means fewer lookups and more tolerance for an outage at your DNS provider.

• Planning a change? Lower the TTL of the existing record to 300 seconds a day before, make the change, then raise it again.
• Normal records: 3600 seconds (one hour) is a sensible default.
• "Auto" in Cloudflare means 300 seconds.

Step 5: Check that the record works

Query the record directly:

dig TXT example.com +short
dig CNAME www.example.com +short
dig MX example.com +short

To skip your local cache and ask a public resolver:

dig @1.1.1.1 TXT _dmarc.example.com +short

On Windows:

nslookup -type=TXT example.com 1.1.1.1

A new record usually shows up within minutes. "Propagation can take 48 hours" applies mainly to nameserver changes and to records that already existed with a long TTL. If a brand new record is missing after 15 minutes, look for a typo before you wait any longer.

Common mistakes

Why it matters for security

DNS records outlive the services they point to. A CNAME to a deleted cloud app or an expired SaaS account is an open invitation for subdomain takeover, and a forgotten SPF include: lets a former provider send mail as you. Every time you add a record, note why it exists, and remove it when the service goes away.

Check your domain

Offensly checks the DNS records attackers look at first: SPF, DKIM, DMARC, MX, CAA and DNSSEC, together with dangling records that point to services you no longer use. The basic email check on the homepage needs no sign-up.

Check your domain for free