DNS Records and Email Authentication: A, AAAA, CNAME, MX, TXT, SPF, DKIM, and DMARC
Unit 3: Network Configuration. Lesson 12 of 41 in APlus Academy Core 1.
DNS is the internet's phone book, and its records are the entries. Core 1 asks which record does which job and how three of them keep a company's email from being forged.
How a lookup works
The browser asks the operating system for www.example.com. The OS checks its cache and the hosts file, then asks the configured DNS server. That server asks the root servers, then the .com servers, then example.com's own name servers, caches the answer for its time-to-live (TTL), and returns the address. A wrong DNS server address means every name fails while pings to IP addresses still work; the tool that shows what a lookup returns is nslookup.
The records
- A: a name to an IPv4 address. www.example.com to 203.0.113.10.
- AAAA: a name to an IPv6 address.
- CNAME (canonical name): an alias pointing at another name. shop.example.com is really store.hostingprovider.com; change the target and the alias follows.
- MX: the mail server for a domain, with a priority number where lower is tried first. Without an MX record, nobody can send mail to the domain.
- TXT: free-form text attached to a name. Used to prove domain ownership to services and, most importantly, to carry SPF, DKIM, and DMARC.
- Also seen: NS (the domain's name servers) and PTR (reverse lookup, address to name).
Email authentication and spam management, the three TXT records
Anyone can put any address in the From line of an email, so receiving servers check three records published by the sender's domain:
- SPF (sender policy framework) lists which servers are allowed to send mail for the domain. A message from a server not on the list fails SPF.
- DKIM (DomainKeys identified mail) is a cryptographic signature the sending server adds to each message; the public key lives in DNS. A receiver that verifies the signature knows the message came from the domain and was not altered in transit.
- DMARC (domain-based message authentication, reporting, and conformance) is the policy that tells receivers what to do when SPF or DKIM fails: none (just report), quarantine (spam folder), or reject, and where to send reports.
A company whose messages land in spam or whose domain is being spoofed needs these three records set up correctly.
Common tasks
- A new website: create an A record (and AAAA) for the domain and often a CNAME for www.
- Moving mail to a cloud provider: change the MX records to the provider's servers and add the provider's SPF and DKIM records.
- Verifying ownership of the domain with a service: add the TXT record it gives you.
- A change "not working yet": the old record is still cached somewhere until the TTL expires.
DNS Records and Email Authentication: A, AAAA, CNAME, MX, TXT, SPF, DKIM, and DMARC, explained slowly
The phone book and the three seals
DNS is the phone book: look up a name, get a number. Its records are the entry types: a home number (A), a mobile number (AAAA), a "see also" entry (CNAME), a mail room address (MX), and a notes field (TXT). The email authentication records are three seals a company puts on its outgoing mail: SPF says which post offices may send on its behalf, DKIM is a tamper-evident wax seal, and DMARC is the instruction card telling the receiving mail room what to do with letters whose seals are wrong.
The record types
record maps example note A name to IPv4 www.example.com -> 203.0.113.10 AAAA name to IPv6 www.example.com -> 2001:db8::10 CNAME name to another name (alias) shop.example.com -> store.provider.net the alias follows the target MX domain to its mail servers example.com -> 10 mail1.example.com, 20 mail2 lower priority number first TXT name to free text example.com -> "v=spf1 include:mailer.net -all" carries SPF, DKIM, DMARC, verifications NS domain to its name servers example.com -> ns1.dnshost.com PTR address to name (reverse) 10.113.0.203.in-addr.arpa -> www.example.com used by mail servers to check senders
Every record has a TTL, the number of seconds a resolver may cache it. Changing a record does not take effect until the old cached copies expire, which is the answer to "I changed the record and nothing happened."
How a lookup travels
- The application asks the OS for www.example.com.
- The OS checks its cache and the hosts file.
- It asks the configured DNS server (from DHCP or typed in).
- That server, if it does not have the answer cached, asks a root server ("who handles .com?"), then a .com server ("who handles example.com?"), then example.com's authoritative server ("what is www?").
- The answer comes back, is cached for its TTL, and is returned to the application.
The command-line check is nslookup www.example.com. If it returns an address but the browser still fails, DNS is not the problem. If the client cannot reach its DNS server, ping to an IP works but every name fails.
The three email seals
record full name what it proves how it fails SPF sender policy framework this server is allowed to send for us mail from an unlisted server DKIM DomainKeys identified mail the message is signed and unaltered signature missing or does not verify DMARC domain-based message authentication, reporting, and conformance what to do on failure (none, quarantine, reject) and where to report the receiver ignores it or the policy is none
All three are published as TXT records. SPF sits on the domain itself. DKIM's public key sits under a selector name, such as selector1._domainkey.example.com. DMARC sits at _dmarc.example.com.
Worked example: mail lands in spam
A company moves mail to a cloud provider. Suddenly customers find its messages in their junk folders. The MX records were changed, so inbound mail works, but the SPF record still lists only the old mail server; the provider's servers are not authorized, and DKIM was never set up. Fix: update the SPF TXT record to include the provider, publish the provider's DKIM key, and add a DMARC record starting at p=none to gather reports before tightening to quarantine.
Worked example: a new website
The marketing team buys example.com and hosts the site with a provider whose server is 203.0.113.10. Create an A record for example.com pointing to 203.0.113.10, a CNAME for www pointing to example.com (or an A record), and, if the provider supports IPv6, an AAAA record. Verification of ownership for the analytics service is a TXT record with the string they supply.
How the exam asks it
- "Which DNS record type resolves a hostname to an IPv6 address?" AAAA.
- "Which record directs mail for a domain to its mail server?" MX.
- "Which record creates an alias for another hostname?" CNAME.
- "Which record type carries SPF and DKIM information?" TXT.
- "Which mechanism lets a domain owner specify what receivers should do with messages that fail authentication?" DMARC.
- "A technician updated a DNS record but users still reach the old server." Cached records; wait for the TTL or flush the cache.
What to memorize
- A IPv4, AAAA IPv6, CNAME alias, MX mail (lowest number first), TXT text, NS name servers, PTR reverse.
- TTL caching; nslookup to test; DNS failure = names fail, addresses work.
- SPF who may send, DKIM signature, DMARC policy and reports; all TXT records.