DNS record types, fields, and configuration risks

DNS records connect a domain to servers, email, certificates, and other services. The catalogue below and the DNS editor use the same backend capability data, so newly supported or changed types stay aligned.

Fields and basic rules

• Name: use @ for the zone apex and a label such as www for a subdomain. Do not append the current domain twice. The UI identifies fields that require a fully qualified name.
• Value: enter an IP address, hostname, or structured parameters as required by the type. A hostname target is normally not a URL.
• TTL: controls how long recursive resolvers may cache a record. Lowering it does not purge existing caches or promise worldwide propagation within a fixed time.
• Priority: MX, SRV, HTTPS, SVCB, URI, and similar types include priority or ordering data. Follow the semantics shown for that record type.
• Proxy: enable acceleration only for records marked proxy eligible. Email, verification, and DNSSEC records must remain DNS only.

Before making a change

• A CNAME cannot coexist with A, AAAA, MX, TXT, or another type at the same name. Apex CNAME support depends on the DNS provider's flattening feature.
• A wildcard matches only names without a more specific record. It does not cover the apex and should not replace email or verification records.
• Review MX, SPF, DKIM, and DMARC together, and keep all mail records DNS only.
• DNSKEY, DS, TLSA, and related records depend on a correct DNSSEC delegation. A mismatch can make the entire domain fail validation.
• The console does not publish comments or tags as DNS data. Record the reason for a change in the DNS change log or a support item.

Add, edit, delete, and troubleshoot

• Add or edit records on the domain's DNS records page. Verify name, value, TTL, priority, and proxy state before saving.
• Before deleting a record, confirm that no certificate, mail flow, verification, or production traffic depends on it. Recursive caches may retain the old answer until its original TTL expires.
• After saving, inspect the DNS change log, then compare authoritative and public-recursive queries. Differences usually point to TTL, a same-name conflict, delegation, or DNSSEC.
• If the cause remains unclear, open a support channel from the Help Center and include the domain, record type, query output, and change time. Never include private keys or full credentials.