Set an A Record: Fields, Zone File Syntax and dig Checks

An A record is the simplest thing in DNS, and it still goes wrong surprisingly often on the first try. The record itself is rarely the problem. The name field is, or a leftover parking record, or a zone that isn’t actually the one the internet is reading.

What an A record is

An A (address) record, defined in RFC 1035, maps a hostname to one IPv4 address. Its IPv6 sibling is the AAAA record. Every A record has four fields:

In zone file syntax:

$ORIGIN example.com.
@      3600  IN  A  192.0.2.10
www    3600  IN  A  192.0.2.10
api     300  IN  A  198.51.100.20

How to set an A record without the usual mistakes

First, make sure you’re editing the live zone

dig NS example.com +short

The answer tells you who serves your DNS. If the nameservers belong to your registrar, edit the records there. At betadomain that’s in the customer area under the domain’s DNS records. If they point to a DNS host or CDN, edit it there instead. Records saved anywhere else do nothing.

The name field

Panels interpret this field differently:

• @ or blank means the domain itself, example.com.
• www means www.example.com. Type www.example.com into a panel that expects a relative name and you get www.example.com.example.com.
• In zone files, a trailing dot (www.example.com.) marks a fully qualified name. Without it the origin is appended.

After saving, look at how the panel displays the record. If in doubt, check with dig.

The value

Only the bare IPv4 address. No http://, no :8080, no spaces. On providers that use NAT, ip addr on the server shows a private address, and the public one is in the control panel.

The TTL

3600 seconds is a sensible default for a server whose address rarely changes. If you plan to move the site next week, use 300 now. The DNS TTL guide explains why lowering it at the last minute doesn’t help.

Check that the A record is live

Ask the authoritative server first so no cache is involved:

dig @ns1.example-dns.net example.com A +noall +answer

example.com.		3600	IN	A	192.0.2.10

Then a public resolver:

dig @8.8.8.8 example.com A +short
host www.example.com

www.example.com has address 192.0.2.10

If the authoritative server has the new address and the public resolver still has the old one, the record is correct. The TTL in the resolver’s answer counts down and tells you how many seconds are left before it asks again. See DNS propagation time for the details.

Common A record problems

Two A records for one name.

dig example.com A +short

192.0.2.10
198.51.100.7

Usually a default parking record from the registrar. Visitors land on either one. Delete the record you didn’t create.

A record and CNAME on the same name. Not allowed. If www is a CNAME, it can’t also have an A record. Which one to use is covered in CNAME vs A record.

The wildcard doesn’t apply. A * record only answers for names that don’t exist in any form. Create a TXT record on api and the wildcard no longer covers api, so api.example.com has no A record at all.

Mail stops arriving. Your MX record probably points at the bare domain (MX 10 example.com.), so moving the A record moved your mail too. Check with dig MX example.com +short before you change anything, and read MX record setup for a cleaner layout.

Subdomains, wildcards and multiple IPs

Each subdomain that lives on a different machine gets its own record:

api       3600  IN  A  198.51.100.20
*.preview 3600  IN  A  192.0.2.10

*.preview catches pr-142.preview.example.com and anything else at that level, which is handy for preview deployments that a reverse proxy routes. The matching certificate needs a DNS challenge, explained in the wildcard certificate guide.

Several A records with the same name give you DNS round robin. Load is spread, but nothing notices when one server dies. It’s a stopgap for two servers, not a load balancer.

A records vs a floating IP

If you rebuild servers often, constantly editing A records gets tedious and every change waits on a TTL. Many VPS providers sell an extra address that you can move between servers through their panel or API (it goes by names like floating IP, reserved IP or failover IP). The A record points at that address permanently and a cutover takes seconds. You do have to configure the extra address on the server’s network interface, or packets arrive and are dropped.

For a single server that moves once every few years, it’s not worth the cost. For anything you redeploy monthly, it usually is.

Checklist after setting the record

• The authoritative server returns the new IP.
• A public resolver returns exactly one line.
• curl -sI http://example.com reaches your server (check the Server header).
• dig MX example.com +short still points where your mail should go.
• The TTL suits the next few weeks.

Once the A record resolves, move on to the web server and certificate, in the order shown in point a domain to your server.

Need another domain for a side project? You can check whether a name is free and look at the full price list of roughly 490 extensions, all with the same price on renewal. A .net domain is €16.99 a year, and the A record goes into the same customer area.

Step by step

1. Find where the zone is hostedRun dig NS example.com +short and open the DNS panel of the provider those nameservers belong to.
2. Enter the nameUse @ or leave it blank for the bare domain, or enter just the label such as www or api without appending the domain.
3. Choose type A and enter the IPv4 addressSelect A and paste the server's public IPv4 address, for example 192.0.2.10, with no protocol or port.
4. Pick a TTLUse 3600 seconds for a stable server, or 300 if you plan to change the value soon.
5. Verify with digRun dig against the authoritative nameserver and a public resolver and make sure exactly one address comes back.