What an A Record Does
An A (Address) record maps a hostname directly to an IPv4 address. It’s the record everything else in DNS ultimately resolves down to – a CNAME chain, an MX lookup, whatever the path, it ends at an A (or AAAA) record pointing at an actual IP.
A Basic Example
example.com. A 203.0.113.10
www.example.com. A 203.0.113.10
api.example.com. A 203.0.113.25A lookup for example.com returns 203.0.113.10 directly – no aliasing, no intermediate hops, just a straight mapping from name to address.
TTL: How Long the Answer Gets Cached
Every A record has a TTL (Time To Live), in seconds, telling resolvers how long they’re allowed to cache the answer before asking again:
example.com. 300 IN A 203.0.113.10Here the TTL is 300 seconds (5 minutes). A short TTL means changes propagate fast but generates more lookup traffic; a long TTL (say, 86400 – a day) reduces load but means an IP change takes longer to reach everyone. The common pattern is to drop the TTL low in advance of a planned migration, make the change, confirm it’s propagated, then raise it back up once things are stable.
Multiple A Records: Round Robin
A hostname can have more than one A record, and most resolvers will rotate through them:
example.com. A 203.0.113.10
example.com. A 203.0.113.11
example.com. A 203.0.113.12This is DNS round robin – a crude form of load balancing where different clients get different IPs on different lookups. It’s not health-aware (DNS has no idea if 203.0.113.11 is actually up), so it’s a basic distribution mechanism rather than a real load balancer, but it’s cheap and works fine for simple cases.
A vs AAAA
A records are IPv4 only. IPv6 addresses use a separate record type, AAAA:
example.com. A 203.0.113.10
example.com. AAAA 2001:db8::1A dual-stack setup publishes both, and modern clients generally prefer the AAAA (IPv6) result when both are available and working, falling back to the A record otherwise.
A Records vs Everything Else in This Series
Looking back across this series, it’s worth noting how much of it depends on the humble A record existing correctly in the first place. MTA-STS’s policy file is fetched from a host that itself resolves via an A record. DNSSEC signs the A record among everything else in the zone. CAA governs who can get a certificate for the name that A record points at. Even a CNAME is just deferring the question – eventually, something in the chain has to be an A record pointing at a real, reachable IP.
It’s the plainest entry in the zone file, and also the one nothing else works without.
That wraps up this series on DNS records – DMARC, SPF, CNAME, DNSSEC, MTA-STS, CAA, and the A record itself. Between them they cover authentication, aliasing, integrity, transport security, certificate issuance, and basic resolution – the core of how a domain actually functions on the modern internet.
Leave a Reply
You must be logged in to post a comment.