DNS Records That Matter: A, AAAA, CNAME, MX, TXT

Most VPS outages that look like the server is down are DNS. The box is running, nginx is listening, and the certificate file is still valid, but the name points at last week's IP, or a CNAME sits on the apex and silently drops MX. Before you run certbot, you need a zone that answers the five questions the internet actually asks: where is this host, what is this alias, where is mail, and what extra text proves policy. A, AAAA, CNAME, MX, and TXT cover almost every failure you will debug in the first year of running a site.

Treat the zone as a contract, not a form you fill once at a registrar. Every HTTPS issuance, every mail delivery, and every "why is this still the old site" ticket starts with one of those five types.

A and AAAA records send the packets

An A record maps a hostname to an IPv4 address. An AAAA record maps the same name to an IPv6 address. Clients look them up independently. If you publish AAAA and the VPS has no working IPv6 path, some networks try v6 first, stall, and then fail over. That looks like a slow site even when IPv4 is healthy.

On a single VPS you almost always start with one A at the apex (example.com) and one at www. Point both at the public IPv4 in the panel. Do not add a second A on the same name unless a second IP actually answers. Extra A records become round-robin, which is not failover and not a load balancer.

If the instance has IPv6 and you can reach it with curl -6 from another network, add AAAA. If you cannot, omit AAAA until you can. A missing AAAA is safer than a broken one. ACME HTTP-01 follows the same addresses browsers use, so a stale A is also a failed certificate.

dig +short A example.com
dig +short AAAA example.com
dig +short A www.example.com
curl -4 -I --max-time 5 http://example.com/
curl -6 -I --max-time 5 http://example.com/

Run those queries from a laptop or another VPS, not only from the machine you just changed. The local stub resolver on the box can cache the old answer and lie to you.

CNAME is an alias, never an IP

A CNAME says this name is an alias of that name. Resolvers chase the alias and then use the A or AAAA of the target. It is useful for www.example.com pointing at example.com, or for a vendor hostname you do not control. It is not a shortcut for typing an IP.

Never put a CNAME on the apex if you also need MX, TXT, or CAA at that name. The DNS protocol does not let a CNAME coexist with other data on the same node. Some registrars offer ALIAS or ANAME flattening. That is a vendor rewrite, not a CNAME, and it behaves differently at each provider. For a VPS, keep the apex as A and AAAA. Either CNAME www to the apex or give www its own A record. Mixing a CNAME at the apex with mail is a classic way to lose inbound mail for a weekend.

CNAMEs also add a lookup. Deep chains (www to host to lb to yet another name) slow first connection and multiply failure points. Keep the chain to one hop.

MX is a different lookup than the website

MX records name the hosts that accept mail for the domain. The value is a hostname, not an IP, and that hostname must itself resolve with A or AAAA. If a provider hosts your mail, copy their MX names exactly, including the trailing policy they document. If you do not send or receive mail on this domain yet, do not publish MX that points at the web VPS just because the box exists. An open port 25 on a web instance attracts scanners and does not deliver mail you expect.

Priority numbers are relative. 10 then 20 means try 10 first. Two records at 10 are equal cost. Leave the numbers alone unless you have a real secondary. Changing MX without changing SPF (a TXT) is how you pass the website cutover and fail every outbound message the same afternoon.

TXT holds SPF, keys, and ACME proofs

TXT is a bag of strings. Three uses matter on a VPS. SPF (v=spf1 ...) tells receivers which IPs may send mail as you. DKIM publishes a public key for your mail stack. ACME DNS-01 puts a token on _acme-challenge.example.com so a certificate authority can prove you control the zone.

You may have multiple TXT records on the same name. Do not mash SPF into one giant quoted string unless you know the 255-byte chunking rules. Add a second TXT instead. DNS-01 tokens live on the _acme-challenge label, not on the apex, so they should not collide with SPF if you name them correctly.

A zone that does not fight itself

Here is a minimal set of records that will not collide. Replace the IP with the public address of the VPS.

# apex and www for the site
example.com.          300  IN  A      203.0.113.40
www.example.com.      300  IN  CNAME  example.com.

# mail at a provider, not on the web box
example.com.          300  IN  MX     10 mx.provider.net.

# send policy; skip this line if you send no mail
example.com.          300  IN  TXT    "v=spf1 include:provider.net -all"

Query the authoritative nameservers, not only 8.8.8.8. If A for the apex matches the VPS, www either CNAMEs or shares that A, MX does not point at a web-only host unless you intend that, and TXT for SPF exists only if you send mail, you are ready for certificates. CAA is a later post in this series. Certbot cannot rescue a zone that points at the wrong machine.

The takeaway is boring on purpose. A and AAAA send browsers and HTTP-01. CNAME is an alias. MX is mail. TXT is policy and proofs. Get those five right on a Lucknow DC01 VPS and HTTPS becomes a follow-on step instead of a rescue mission. You can spin up an Ubuntu 24.04 instance on Netbay in Lucknow (DC01) in under 60 seconds, put an A record on the public IP, and follow along — netbayhosts.in.