VerigrityVERIGRITY GUIDE
DNS Records Explained: A, AAAA, MX, NS and More
Every domain name has a set of DNS records that tell the internet how to route traffic, deliver mail, and verify ownership. They're invisible in normal use, but they show up in almost every trust-checking tool. Here's what the main record types do, in plain language, and what they can — and can't — tell you about a domain.
What DNS is, in one paragraph
The Domain Name System (DNS) is the internet's phone book. When you type example.com into a browser, the browser sends a DNS query to a resolver, which eventually reaches the domain's authoritative nameservers. Those nameservers return a set of records that describe where to route traffic, where to deliver mail, and other metadata. All of this happens in milliseconds, usually before the page starts loading.
DNS records are public. Anyone can query them for any domain. That's why they show up in trust-checking tools — they're a source of information the site itself doesn't control at the moment of the query.
A records — IPv4 addresses
Format: example.com. 3600 IN A 93.184.216.34
An A record maps a domain name to an IPv4 address. When your browser looks up example.com, the A record is what returns the numeric address your computer actually connects to.
What A records can tell you:
- Where the site is hosted. The IP address often maps to a known hosting provider (Cloudflare, AWS, Google Cloud, DigitalOcean, etc.). You can look up the IP's owner with a WHOIS IP lookup.
- How many servers serve the site. Multiple A records indicate load balancing. A single A record suggests a small or simple setup.
- Residential vs. commercial hosting. An IP in a residential block serving a "business" site is unusual. Legitimate commercial sites almost always use data-center hosting.
AAAA records — IPv6 addresses
Format: example.com. 3600 IN AAAA 2606:2800:220:1:248:1893:25c8:1946
AAAA records (pronounced "quad-A") do the same thing as A records, but for IPv6 addresses. IPv6 is the newer version of the internet protocol, designed to replace IPv4 because IPv4 addresses are running out.
What AAAA records can tell you:
- How modern the infrastructure is. A site with both A and AAAA records supports both protocols — generally a sign of current setup.
- IPv6-only hosting. Rare today, but a site with only AAAA records (no A) is either IPv6-forward or misconfigured.
Many sites still have no AAAA records at all. That's not a red flag — it just means they only serve IPv4.
MX records — mail servers
Format: example.com. 3600 IN MX 10 mail.example.com.
MX records specify which servers receive email for the domain. The number before the hostname is the priority — lower numbers are tried first.
What MX records can tell you:
- Whether the domain can receive email. No MX records means no email. A domain claiming to be a real business but with no MX records is worth noting.
- Which mail provider is used. MX records often reveal Google Workspace (
aspmx.l.google.com), Microsoft 365 (*.mail.protection.outlook.com), ProtonMail, Zoho, or a self-hosted solution. - Consistency with the brand. A site claiming to be a large company but using a cheap shared host's mail servers is a signal worth investigating.
Note: the absence of MX records is not automatically suspicious. Some domains don't need email at all (static sites, for example). But for a site that says it's a business, no MX records is unusual.
NS records — nameservers
Format: example.com. 172800 IN NS ns1.example.com.
NS records identify the authoritative nameservers for the domain — the servers that other DNS servers ask when they need to resolve a hostname. Every domain has at least two NS records for redundancy.
What NS records can tell you:
- Where the domain's DNS is managed. Common providers include Cloudflare, Route 53 (AWS), Google Cloud DNS, and registrar-managed nameservers.
- Whether the domain uses a CDN. Cloudflare nameservers, for example, usually indicate the site is behind Cloudflare's CDN and firewall.
- How sophisticated the setup is. Enterprise-grade DNS (Route 53, Google Cloud DNS) is more common on established business sites than on personal projects.
TXT records — arbitrary text
Format: example.com. 3600 IN TXT "v=spf1 include:_spf.google.com ~all"
TXT records hold arbitrary text. They were originally designed for human-readable notes, but they're now used for a wide range of machine-readable metadata. The most common uses are:
- SPF — specifies which servers are authorized to send email for the domain. Helps prevent spoofing.
- DKIM — publishes a public key used to verify the signature on outgoing emails.
- DMARC — specifies how receivers should handle emails that fail SPF or DKIM checks.
- Domain verification — Google, Microsoft, and other services use TXT records to prove you control a domain.
What TXT records can tell you:
- How well email is configured. SPF, DKIM, and DMARC records indicate a domain takes email authentication seriously. Missing records don't prove anything malicious, but they mean the domain is easier to spoof.
- What services the domain uses. Verification records often reveal Google Search Console, Microsoft 365, Atlassian, or similar.
CNAME records — aliases
Format: www.example.com. 3600 IN CNAME example.com.
A CNAME record points one hostname to another. Instead of resolving www.example.com directly, DNS resolves example.com and returns the same answer. CNAMEs are used for aliasing — you'll often see www aliased to the root domain, or a subdomain aliased to a CDN.
What CNAME records can tell you:
- Whether a subdomain is on a third-party platform. A CNAME pointing to a Shopify, GitHub Pages, or Heroku hostname, for example.
- Subdomain structure. Which subdomains exist and how they're wired up.
Other record types you may encounter
- SOA — the "start of authority" record, present on every domain. Contains metadata about the zone.
- CAA — specifies which Certificate Authorities may issue certificates for the domain. A security-hardening feature.
- SRV — service location records, used by services like SIP and Microsoft Teams.
- PTR — reverse DNS, used mostly for email reputation checks.
What DNS records can and cannot tell you
DNS is a technical layer. It shows how a domain is configured right now, but it doesn't directly tell you anything about the operator's intent.
What DNS can show:
- Where the site is hosted
- Whether it can receive email
- Which mail and DNS providers it uses
- Whether it uses a CDN
- Whether it's set up with modern infrastructure
- Whether email authentication (SPF, DKIM, DMARC) is in place
What DNS cannot show:
- Whether the business is legitimate
- Whether the site is malicious
- Who registered the domain (that's WHOIS, a separate system)
- How old the domain is (also WHOIS)
- Whether the site will be online tomorrow
DNS is one signal among many. It's useful for context, especially when combined with WHOIS, TLS certificate details, and the site's own content. On its own, it's rarely decisive.
How to look up DNS records
Two common ways:
- Command line: on any Mac or Linux system, run
dig example.com ANYornslookup -type=MX example.com. On Windows, usenslookupwith the-typeflag. - Browser tools: the Verigrity DNS Checker displays A, AAAA, MX and NS records for any domain in a single view.
For most trust-checking purposes, the browser approach is faster.
Frequently asked questions
Why does a domain have no MX records?
Two reasons: either it doesn't receive email (common for static sites or developer projects), or it's misconfigured. For a site presenting itself as a business, no MX records is unusual and worth investigating.
What does an xn-- prefix mean in DNS?
It indicates Punycode — a domain containing non-ASCII characters (Cyrillic, Arabic, Chinese, etc.). Some are legitimate; some are used in homograph attacks that visually mimic well-known brands.
Can DNS records change frequently?
Yes. DNS is a live system. Records change when hosting changes, mail providers migrate, or certificates are reissued. Frequent changes are not inherently suspicious, but they can indicate churn behind a domain.
Are multiple A records suspicious?
No. Multiple A records usually mean the site is load-balanced or distributed across multiple servers — this is normal, and often a sign of a well-run infrastructure.
What's the difference between DNS and WHOIS?
DNS describes how a domain routes traffic right now. WHOIS describes who registered the domain and when. They're complementary — useful together, not separately.