Supported Record Types
NexDNS supports 14 DNS record types. All types except SOA can be created and edited by users. SOA records are managed automatically by the system when a zone is created.
| Type | Purpose | User-creatable |
|---|---|---|
A | Maps a name to an IPv4 address | Yes |
AAAA | Maps a name to an IPv6 address | Yes |
CNAME | Creates an alias to another hostname | Yes |
MX | Routes email to a mail server | Yes |
TXT | Stores arbitrary text (SPF, DKIM, verification, etc.) | Yes |
NS | Delegates a subdomain to other nameservers | Subdomains only (apex NS is system-managed) |
SRV | Locates a service (host + port) | Yes |
CAA | Controls which CAs may issue certificates | Yes |
PTR | Reverse DNS – maps an IP to a hostname | Yes |
ALIAS | Like CNAME but allowed at the zone apex | Yes |
DNAME | Redirects an entire DNS subtree to another domain | Yes |
DS | DNSSEC Delegation Signer – links child zone to parent | Yes |
TLSA | Associates a TLS certificate with a domain (DANE) | Yes |
SOA | Start of Authority – zone metadata (serial, refresh, retry, etc.) | System-managed (read-only) |
Common Fields
Every DNS record has the following common fields in addition to its type-specific fields.
Name
The record name (hostname). Use @ or leave empty to refer to the zone apex (e.g., example.com itself). Enter a subdomain like www to create www.example.com. A trailing dot is appended automatically.
Type
The record type. Once a record is created, the type cannot be changed – you need to delete and re-create the record.
TTL (Time to Live)
How long (in seconds) resolvers should cache this record. Default is 3600 (1 hour). Valid range: 0 to 2,147,483,647. Quick presets are available in the panel: 5 minutes (300), 1 hour (3600), and 1 day (86400).
A Record
An A record maps a domain name to an IPv4 address. This is the most common record type – it tells browsers and other clients which server to connect to.
Fields
| Field | Description | Validation |
|---|---|---|
address |
The IPv4 address this name should resolve to. | Must be a valid IPv4 address (e.g., 203.0.113.50) |
Example
| Name | TTL | Type | Value |
|---|---|---|---|
| @ | 3600 | A | 203.0.113.50 |
| www | 3600 | A | 203.0.113.50 |
AAAA Record
An AAAA record maps a domain name to an IPv6 address. It works identically to an A record but for IPv6 networks.
Fields
| Field | Description | Validation |
|---|---|---|
address |
The IPv6 address this name should resolve to. | Must be a valid IPv6 address (e.g., 2001:db8::1) |
Example
| Name | TTL | Type | Value |
|---|---|---|---|
| @ | 3600 | AAAA | 2001:db8::1 |
CNAME Record
A CNAME (Canonical Name) record creates an alias from one name to another. When a resolver looks up a CNAME, it follows the alias and returns the target’s records instead.
Restrictions
- CNAME records cannot be created at the zone apex (@). Use an ALIAS record instead for apex aliasing.
- Per RFC 1035, a CNAME cannot coexist with any other record type at the same name. If you have an A record at www, you cannot add a CNAME at www – and vice versa.
Fields
| Field | Description | Validation |
|---|---|---|
hostname |
The target hostname this alias points to. | Valid hostname (alphanumeric and hyphens, max 253 characters total, labels 1-63 characters each) |
Example
| Name | TTL | Type | Value |
|---|---|---|---|
| www | 3600 | CNAME | example.com. |
| blog | 3600 | CNAME | mysite.hosting.com. |
MX Record
An MX (Mail Exchange) record specifies which mail server is responsible for accepting email on behalf of the domain. Multiple MX records with different priorities provide failover.
Fields
| Field | Description | Validation |
|---|---|---|
priority |
Determines the order in which mail servers are tried. Lower values are tried first. | Integer, 0-65535 |
host |
The hostname of the mail server. | Valid hostname, or . (dot) for a Null MX with priority 0 (RFC 7505) |
Example
| Name | TTL | Type | Value |
|---|---|---|---|
| @ | 3600 | MX | 10 mail.example.com. |
| @ | 3600 | MX | 20 mail2.example.com. |
A Null MX (host set to . with priority 0) indicates that the domain does not accept email, per RFC 7505.
TXT Record
A TXT record stores arbitrary text data. It is commonly used for email authentication (SPF, DKIM, DMARC), domain ownership verification, and other metadata.
Fields
| Field | Description | Validation |
|---|---|---|
value |
The text content of the record. | Must not be empty. Quoting is handled automatically – you do not need to add surrounding double quotes. |
Example
| Name | TTL | Type | Value |
|---|---|---|---|
| @ | 3600 | TXT | "v=spf1 include:_spf.google.com ~all" |
| _dmarc | 3600 | TXT | "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com" |
The system automatically wraps TXT values in double quotes for DNS storage. If your value is already quoted, it will not be double-quoted.
NS Record
An NS (Name Server) record delegates a subdomain to a different set of nameservers. This is used when a subdomain is managed by a different DNS provider.
Restriction
NS records at the zone apex are created and managed automatically by the system based on your NS Server Group. You can only create NS records for subdomains.
Fields
| Field | Description | Validation |
|---|---|---|
hostname |
The hostname of the nameserver for this delegation. | Valid hostname (alphanumeric and hyphens, max 253 characters total, labels 1-63 characters each) |
Example
| Name | TTL | Type | Value |
|---|---|---|---|
| subdomain | 86400 | NS | ns1.other-provider.com. |
SRV Record
An SRV (Service) record specifies the location (hostname and port) of a particular service. It is used by applications like SIP, XMPP, and game servers to discover services.
Fields
| Field | Description | Validation |
|---|---|---|
priority |
Order in which servers are tried (lower = first). | Integer, 0-65535 |
weight |
Relative weight for load balancing among records with equal priority. | Integer, 0-65535 |
port |
The TCP or UDP port number of the service. | Integer, 0-65535 |
target |
The hostname of the machine providing the service. | Valid hostname, or . (dot) to indicate the service is not available |
Example
| Name | TTL | Type | Value |
|---|---|---|---|
| _sip._tcp | 3600 | SRV | 10 60 5060 sip.example.com. |
| _minecraft._tcp | 3600 | SRV | 0 5 25565 mc.example.com. |
The record name for SRV records must follow the _service._protocol convention (e.g., _sip._tcp, _minecraft._tcp, _ldap._tcp).
CAA Record
A CAA (Certificate Authority Authorization) record specifies which Certificate Authorities (CAs) are allowed to issue SSL/TLS certificates for the domain. This prevents unauthorized certificate issuance.
Fields
| Field | Description | Validation |
|---|---|---|
flags |
Usually 0. Set to 128 to mark this property as critical (CA must understand it or refuse to issue). | Integer, 0-255 |
tag |
The property type. | Must be one of: issue, issuewild, or iodef |
value |
The CA domain name (for issue/issuewild) or a reporting URL (for iodef). | Must not be empty |
Example
| Name | TTL | Type | Value |
|---|---|---|---|
| @ | 3600 | CAA | 0 issue "letsencrypt.org" |
| @ | 3600 | CAA | 0 issuewild ";" |
| @ | 3600 | CAA | 0 iodef "mailto:security@example.com" |
PTR Record
A PTR (Pointer) record maps an IP address back to a hostname. It is used for reverse DNS lookups – for example, verifying that a server IP address resolves back to its claimed hostname.
Fields
| Field | Description | Validation |
|---|---|---|
hostname |
The forward hostname this IP address should resolve to. | Valid hostname (alphanumeric and hyphens, max 253 characters total, labels 1-63 characters each) |
Example
| Name | TTL | Type | Value |
|---|---|---|---|
| 50 | 3600 | PTR | server.example.com. |
ALIAS Record
An ALIAS record works like a CNAME but can be used at the zone apex (@). The DNS server resolves the target internally and returns the resulting A/AAAA records. Use ALIAS when you need apex-level aliasing (e.g., pointing example.com to a load balancer hostname).
Fields
| Field | Description | Validation |
|---|---|---|
hostname |
The target hostname to resolve and return records for. | Valid hostname (alphanumeric and hyphens, max 253 characters total, labels 1-63 characters each) |
Example
| Name | TTL | Type | Value |
|---|---|---|---|
| @ | 3600 | ALIAS | myapp.herokuapp.com. |
DNAME Record
A DNAME record redirects an entire subtree of the DNS namespace to another domain. Unlike CNAME (which aliases a single name), DNAME aliases all names under the specified node. Useful for domain migrations and organizational restructuring.
Fields
| Field | Description | Validation |
|---|---|---|
hostname |
The target domain that this subtree should be mapped to. | Valid hostname (alphanumeric and hyphens, max 253 characters total, labels 1-63 characters each) |
Example
| Name | TTL | Type | Value |
|---|---|---|---|
| legacy | 3600 | DNAME | new-domain.com. |
DS Record
A DS (Delegation Signer) record is used in DNSSEC to link a child zone to its parent zone. It contains a hash of the child zone’s DNSKEY record, establishing a chain of trust.
Fields
| Field | Description | Validation |
|---|---|---|
keytag |
A numeric identifier that helps resolvers find the matching DNSKEY record quickly. | Integer, 0-65535 |
algorithm |
The DNSSEC signing algorithm number (e.g., 8 for RSA/SHA-256, 13 for ECDSA P-256). | Integer, 0-255 |
digest_type |
The hash algorithm used to create the digest (e.g., 2 for SHA-256). | Integer, 0-255 |
digest |
The hexadecimal hash of the child zone’s DNSKEY record. | Must not be empty (hexadecimal string) |
Example
| Name | TTL | Type | Value |
|---|---|---|---|
| @ | 3600 | DS | 12345 8 2 49FD46E6C4B45C55D4AC69CBD...A9BE1B |
TLSA Record
A TLSA record associates a TLS/SSL certificate or public key with a domain name, enabling DNS-based Authentication of Named Entities (DANE). It allows clients to verify TLS certificates without relying solely on CAs.
Fields
| Field | Description | Validation |
|---|---|---|
usage |
How to verify the certificate. | Integer, 0-3 (0 = CA constraint, 1 = service certificate, 2 = trust anchor, 3 = domain-issued) |
selector |
Which part of the certificate to match. | Integer, 0-1 (0 = full certificate, 1 = public key only) |
matching_type |
How to compare the certificate data. | Integer, 0-2 (0 = exact match, 1 = SHA-256 hash, 2 = SHA-512 hash) |
certificate |
The certificate data or its hash in hexadecimal. | Must not be empty |
Example
| Name | TTL | Type | Value |
|---|---|---|---|
| _443._tcp | 3600 | TLSA | 3 1 1 2BB183AF2B...9FA0925A |
SOA Record
The SOA (Start of Authority) record contains administrative information about the zone, including the primary nameserver, the responsible party’s email, the zone serial number, and timing parameters for zone transfers.
Information
SOA records are created and managed automatically when a zone is created. They cannot be created, edited, or deleted by users. The serial number is incremented automatically whenever zone records change.
Example
ns1.nexdns.tech. hostmaster.example.com. 2024010101 10800 3600 604800 3600Common DNS Setups
Pointing a Domain to a Web Server
To point your domain to a web server, create A and AAAA records for the root domain, and optionally a CNAME for the www subdomain.
Recommended records
| Name | Type | Value | Purpose |
|---|---|---|---|
| @ | A | 203.0.113.50 | Root domain via IPv4 |
| @ | AAAA | 2001:db8::1 | Root domain via IPv6 |
| www | CNAME | example.com. | www redirects to root |
If your hosting provider gives you a hostname instead of an IP address (e.g., myapp.herokuapp.com), you cannot use a CNAME at the apex. Use an ALIAS record at @ instead.
Setting Up Email
A complete email setup requires MX records (mail routing) plus TXT records for authentication (SPF, DKIM, DMARC). Your email provider will supply the exact values.
MX records (mail routing)
| Name | Type | Value |
|---|---|---|
| @ | MX | 10 mail.example.com. |
| @ | MX | 20 mail-backup.example.com. |
SPF (Sender Policy Framework)
SPF defines which servers are allowed to send email on behalf of your domain. It is a TXT record at the zone apex.
| Name | Type | Value |
|---|---|---|
| @ | TXT | "v=spf1 mx a include:_spf.google.com ~all" |
DKIM (DomainKeys Identified Mail)
DKIM adds a digital signature to outgoing emails. The public key is published as a TXT record. Your email provider will give you the exact name and value.
| Name | Type | Value |
|---|---|---|
| default._domainkey | TXT | "v=DKIM1; k=rsa; p=MIGfMA0GCS..." |
DMARC (Domain-based Message Authentication)
DMARC tells receiving mail servers what to do with emails that fail SPF or DKIM checks. It is a TXT record at _dmarc.
| Name | Type | Value |
|---|---|---|
| _dmarc | TXT | "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com" |
Setting Up Subdomains
Create subdomains by adding records with the subdomain name in the Name field.
| Name | Type | Value | Purpose |
|---|---|---|---|
| blog | CNAME | mysite.wordpress.com. | Hosted on external platform |
| shop | A | 198.51.100.10 | Direct to IP address |
| api | CNAME | api-gateway.cloud.com. | Cloud service endpoint |
SSL Certificate Verification
SSL/TLS certificate authorities often require DNS-based domain verification. They will ask you to create a specific TXT or CNAME record.
TXT verification (e.g., Let's Encrypt)
| Name | Type | Value |
|---|---|---|
| _acme-challenge | TXT | "gfj9Xq...Rg85nM" |
CNAME verification (e.g., AWS ACM, DigiCert)
| Name | Type | Value |
|---|---|---|
| _acme-challenge | CNAME | dcv.example-ca.com. |
Use a low TTL (300 seconds) for verification records so they propagate quickly. You can delete them after the certificate is issued.
Troubleshooting
DNS Propagation Delay
After creating or changing a DNS record, it may take time for the change to be visible worldwide. This is because DNS resolvers around the world cache records based on the TTL value.
For urgent changes, lower the TTL to 300 seconds (5 minutes) before making the change, wait for the old TTL to expire, then make your change. You can raise the TTL back afterward.
Understanding TTL
TTL (Time to Live) controls how long DNS resolvers cache a record before querying the authoritative server again. Lower TTL means changes propagate faster but increases query load. Higher TTL reduces load but makes changes take longer to take effect.
| TTL Value | Duration | Use Case |
|---|---|---|
300 | 5 minutes | Records that change frequently, testing, migrations |
3600 | 1 hour | Default – good balance of performance and flexibility |
86400 | 1 day | Stable records that rarely change (MX, NS) |
NexDNS accepts TTL values from 0 to 2,147,483,647 seconds. The default for new records is 3600 (1 hour).
CNAME Conflicts
CNAME records have strict rules defined by RFC 1035 that NexDNS enforces automatically:
- A CNAME cannot be created at the zone apex (@). The system will reject this with an error. Use an ALIAS record instead.
- A CNAME cannot coexist with any other record at the same name. If you already have an A or TXT record at www, you cannot add a CNAME at www until you remove the existing records.
- If you need CNAME-like behavior at the apex, use an ALIAS record. It resolves server-side and returns A/AAAA records transparently.
Cannot Create NS Records at Zone Apex
NS records at the zone apex (@ or the bare domain) are managed automatically by the system based on your NS Server Group. You can create NS records only for subdomains – this is used for delegating a subdomain to a different DNS provider.
Record Limit Reached
Each subscription plan has a maximum number of records per zone. If you receive a quota error, you have reached this limit. You can upgrade your plan for a higher limit, or remove unused records. Even unlimited plans have a maximum of 10,000 records per zone.
Hostname Validation Errors
Hostnames used in CNAME, NS, PTR, ALIAS, DNAME, MX, and SRV records must comply with DNS standards:
- Maximum total length of 253 characters (excluding the trailing dot).
- Each label (part between dots) must be 1 to 63 characters long.
- Labels must start and end with an alphanumeric character (a-z, 0-9).
- Labels may only contain alphanumeric characters and hyphens (-).