Point a domain at the right service
Understand address records, aliases and verification before changing traffic.
Content revised · English
- Guide type
- Operate & secure
- Examples
- Illustrative, environment-specific
- Integration scope
- No remote machine connected
Find the authoritative zone
The registrar chooses the domain’s nameservers; the authoritative DNS provider holds its records. Editing a zone at the previous provider after changing nameservers may have no public effect. Confirm the delegation before diagnosing propagation.
Publish the right record for the service
Use A for an IPv4 address and AAAA only when the service has working IPv6. A www CNAME can point to the main hostname; a standard CNAME should not share that same name with other record types. MX identifies a mail hostname and still requires the mail service’s authentication records.
| Name | Type | Value | Purpose |
|---|---|---|---|
| @ | A | 192.0.2.20 | IPv4 web origin |
| @ | AAAA | 2001:db8::20 | Only with a tested IPv6 listener |
| www | CNAME | example.com. | Alternate web name |
| @ | MX | 10 mail.example.com. | Mail destination; add its address separately |
Use a shorter TTL before a cutover
Lower the existing record’s TTL early enough for its previous cache lifetime to expire before the change. A new short TTL cannot force every resolver to forget an already cached long-lived value. Retain the old origin through the transition and rollback window.
Compare delegation, authoritative answers and caches
Query the nameservers and the intended records. Test the authoritative server directly when needed, then a recursive resolver. A stale local cache and a wrong authoritative record are different problems.
dig example.com NS +short
dig example.com A +short
dig example.com AAAA +short
dig example.com MX +short
# To query your actual authoritative server:
# dig @<authoritative-nameserver> example.com AKeep origin privacy in the design
If a reverse proxy is part of the model, review old DNS history, mail hostnames, unproxied subdomains and other services that can reveal the origin. DNS editing alone does not establish origin isolation or conceal historical records.
Leave with a verifiable result.
- Find the authoritative zone.
- Keep origin privacy in the design.
- Keep recovery information and secrets outside public files.