DNS records in cPanel

DNS (Domain Name System) is a distributed system that translates domain names into IP addresses and other information. The Zone Editor in cPanel lets you manage the DNS records of your domains.

What is a DNS zone

A DNS zone is the set of DNS records for a particular domain. It defines:

• Where the website is hosted (A and AAAA records)
• Where email is delivered (MX records)
• Additional services (SRV and TXT records)
• Aliases and redirects (CNAME records)

Every domain has its own DNS zone with its own set of records.

Accessing the Zone Editor

Simple mode (Simple Zone Editor)

For basic tasks:

1. Log in to cPanel
2. In the DOMAINS section, select Zone Editor
3. A list of domains with quick actions is displayed

The quick actions available are:

• +A Record — add an A record
• +CNAME Record — add a CNAME record
• +MX Record — add a mail record

Advanced mode (Advanced Zone Editor)

For full control:

1. In the Zone Editor, click Manage next to the domain
2. The full zone editor opens
3. All record types and advanced features are available

DNS zone structure

A typical DNS zone contains:

example.com.    14400   IN  SOA     ns1.hosting.com. hostmaster.example.com. (
                                    2024012701 ; Serial
                                    3600       ; Refresh
                                    1800       ; Retry
                                    1209600    ; Expire
                                    86400 )    ; Minimum TTL

example.com.    14400   IN  NS      ns1.hosting.com.
example.com.    14400   IN  NS      ns2.hosting.com.

example.com.    14400   IN  A       192.0.2.1
www.example.com. 14400  IN  A       192.0.2.1

example.com.    14400   IN  MX  0   mail.example.com.
mail.example.com. 14400 IN  A       192.0.2.2

ftp.example.com.  14400 IN  CNAME   example.com.

DNS record types

SOA (Start of Authority)

Description: The first record in a zone. It holds information about who is authoritative for the zone.

SOA parameters:

• Primary nameserver — the main DNS server
• Email — the administrator’s address (a dot replaces the @)
• Serial — the zone version (format: YYYYMMDDNN)
• Refresh — how often secondary servers check for updates
• Retry — how long to wait before retrying after an error
• Expire — how long a secondary server keeps serving the zone
• Minimum TTL — the minimum caching time

NS (Name Server)

Description: Specifies the authoritative DNS servers for the domain.

Example:

example.com.  IN  NS  ns1.hosting.com.
example.com.  IN  NS  ns2.hosting.com.

Where NS records are kept:

• In the domain’s zone (authoritative)
• At the domain registrar (delegation)

A (Address Record)

Description: Links a domain name to an IPv4 address.

Creating an A record:

1. In the Zone Editor, click +A Record
2. Or, in the Advanced Editor, click Add Record → A
3. Fill in the fields:

1. Click Add Record

Usage examples:

Domain root:

example.com.  14400  IN  A  192.0.2.1

Subdomain:

blog.example.com.  14400  IN  A  192.0.2.10

WWW:

www.example.com.  14400  IN  A  192.0.2.1

Wildcard (all subdomains):

*.example.com.  14400  IN  A  192.0.2.1

AAAA (IPv6 Address)

Description: Links a domain name to an IPv6 address.

Creating one: The same as an A record, but you enter an IPv6 address.

Example:

example.com.  14400  IN  AAAA  2001:0db8:85a3:0000:0000:8a2e:0370:7334

Shortened form:

example.com.  14400  IN  AAAA  2001:db8:85a3::8a2e:370:7334

CNAME (Canonical Name)

Description: Creates an alias for another domain name.

CNAME rules:

• Cannot be used for the domain root (@)
• Cannot coexist with other records for the same name
• Points to a domain name, not an IP address
• Can point to a record outside the zone

Creating one:

1. Click +CNAME Record
2. Fill in:
   • Name: the alias name (for example www or ftp)
   • Record: the target domain name (for example example.com.)
   • TTL: time to live

Examples:

WWW as an alias:

www.example.com.  14400  IN  CNAME  example.com.

FTP pointing to the main domain:

ftp.example.com.  14400  IN  CNAME  example.com.

An external service (CDN):

cdn.example.com.  14400  IN  CNAME  cdn-provider.net.

A subdomain on another host:

shop.example.com.  14400  IN  CNAME  myshop.shopify.com.

MX (Mail Exchanger)

Description: Specifies the mail servers that receive email for the domain.

Parameters:

• Priority — priority (lower number = higher priority)
• Mail Server — the FQDN of the mail server

Creating an MX record:

1. Click +MX Record
2. Fill in:
   • Priority: 0 (primary), 10 (backup), 20 (additional)
   • Destination: the FQDN of the mail server

Example configurations:

A single mail server:

example.com.  14400  IN  MX  0  mail.example.com.
mail.example.com.  14400  IN  A  192.0.2.2

With a backup server:

example.com.  14400  IN  MX  0   mail.example.com.
example.com.  14400  IN  MX  10  mail2.example.com.
mail.example.com.  14400  IN  A  192.0.2.2
mail2.example.com.  14400  IN  A  192.0.2.3

An external mail service (Google Workspace):

example.com.  14400  IN  MX  1   aspmx.l.google.com.
example.com.  14400  IN  MX  5   alt1.aspmx.l.google.com.
example.com.  14400  IN  MX  5   alt2.aspmx.l.google.com.
example.com.  14400  IN  MX  10  alt3.aspmx.l.google.com.
example.com.  14400  IN  MX  10  alt4.aspmx.l.google.com.

Microsoft 365:

example.com.  14400  IN  MX  0  example-com.mail.protection.outlook.com.

TXT (Text Record)

Description: Holds arbitrary text information.

Uses:

• SPF (Sender Policy Framework) — protection against spoofing
• DKIM (DomainKeys Identified Mail) — signing email
• DMARC (Domain-based Message Authentication) — an authentication policy
• Domain verification (Google, Microsoft and others)
• Site verification
• Other metadata

SPF (Sender Policy Framework)

Purpose: Specifies which servers may send mail from your domain.

Syntax:

v=spf1 mechanisms modifiers

Mechanisms:

• a — the IPs from the domain’s A record
• mx — the IPs from the MX records
• ip4:IP — a specific IPv4 address
• ip6:IP — a specific IPv6 address
• include:domain — include another domain’s SPF
• all — everything else

Qualifiers:

• + (pass) — allow
• - (fail) — reject
• ~ (softfail) — soft reject (usually marked as spam)
• ? (neutral) — no opinion

SPF examples:

Basic configuration:

example.com.  IN  TXT  "v=spf1 a mx ~all"

Allows the servers in the A and MX records; everything else is a softfail.

With specific IPs:

example.com.  IN  TXT  "v=spf1 +a +mx +ip4:192.0.2.1 +ip4:203.0.113.0/24 ~all"

With external services:

example.com.  IN  TXT  "v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all"

Strict policy:

example.com.  IN  TXT  "v=spf1 +a +mx -all"

Only A and MX are allowed; everything else is a hard fail.

DKIM (DomainKeys Identified Mail)

Purpose: A digital signature on email that proves it is genuine.

Record format:

selector._domainkey.example.com.  IN  TXT  "v=DKIM1; k=rsa; p=public_key"

Example:

default._domainkey.example.com.  IN  TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC..."

Parameters:

• v=DKIM1 — protocol version
• k=rsa — key type (RSA)
• p=key — the public key in base64
• t=s — strict mode (optional)
• s=email — service type (optional)

Generating DKIM in cPanel:

1. Go to Email Deliverability
2. Click Manage next to the domain
3. In the DKIM section, click Install the DKIM Keys
4. The keys are created and installed automatically

DMARC (Domain-based Message Authentication)

Purpose: Defines what happens to messages that fail the SPF/DKIM checks.

Format:

_dmarc.example.com.  IN  TXT  "v=DMARC1; p=policy; parameters"

Policies:

• p=none — monitoring only (recommended to start with)
• p=quarantine — put in spam
• p=reject — reject the messages

DMARC examples:

Basic (monitoring):

_dmarc.example.com.  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

Quarantine with reports:

_dmarc.example.com.  IN  TXT  "v=DMARC1; p=quarantine; pct=50; rua=mailto:dmarc@example.com; ruf=mailto:forensics@example.com"

Strict policy:

_dmarc.example.com.  IN  TXT  "v=DMARC1; p=reject; adkim=s; aspf=s; rua=mailto:dmarc@example.com"

DMARC parameters:

• rua — address for aggregate reports
• ruf — address for forensic reports
• pct — percentage of messages the policy applies to (0–100)
• adkim — DKIM alignment mode (r=relaxed, s=strict)
• aspf — SPF alignment mode (r=relaxed, s=strict)
• fo — report generation options

Domain verification

Google Search Console:

example.com.  IN  TXT  "google-site-verification=verification_code"

Microsoft (Bing Webmaster Tools):

example.com.  IN  TXT  "ms=MS12345678"

Facebook Domain Verification:

example.com.  IN  TXT  "facebook-domain-verification=code"

SRV (Service Record)

Description: Defines where a service is located (protocol, priority, port).

Format:

_service._protocol.domain.  TTL  IN  SRV  priority weight port target

Parameters:

• Service — the service name (for example _sip, _xmpp)
• Protocol — the protocol (_tcp or _udp)
• Priority — priority (lower = higher)
• Weight — weight (for load balancing)
• Port — the service port
• Target — the FQDN of the server

SRV record examples:

SIP (VoIP):

_sip._tcp.example.com.  14400  IN  SRV  10  60  5060  sipserver.example.com.
_sip._udp.example.com.  14400  IN  SRV  10  60  5060  sipserver.example.com.

XMPP (Jabber):

_xmpp-client._tcp.example.com.  14400  IN  SRV  5  0  5222  xmpp.example.com.
_xmpp-server._tcp.example.com.  14400  IN  SRV  5  0  5269  xmpp.example.com.

Minecraft server:

_minecraft._tcp.example.com.  14400  IN  SRV  0  5  25565  mc.example.com.

Microsoft Teams:

_sip._tls.example.com.  14400  IN  SRV  100  1  443  sipdir.online.lync.com.
_sipfederationtls._tcp.example.com.  14400  IN  SRV  100  1  5061  sipfed.online.lync.com.

CAA (Certification Authority Authorization)

Description: Specifies which certificate authorities (CAs) may issue SSL certificates for the domain.

Format:

example.com.  IN  CAA  flags  tag  "value"

Tags:

• issue — allow certificates to be issued
• issuewild — allow wildcard certificates
• iodef — a URL for violation notifications

Flags:

• 0 — non-critical record
• 128 — critical record (the CA must understand it)

CAA examples:

Allow Let’s Encrypt:

example.com.  IN  CAA  0  issue  "letsencrypt.org"
example.com.  IN  CAA  0  issuewild  "letsencrypt.org"

Several CAs:

example.com.  IN  CAA  0  issue  "letsencrypt.org"
example.com.  IN  CAA  0  issue  "digicert.com"
example.com.  IN  CAA  0  issuewild  "letsencrypt.org"

Forbid issuing:

example.com.  IN  CAA  0  issue  ";"

With notifications:

example.com.  IN  CAA  0  issue  "letsencrypt.org"
example.com.  IN  CAA  0  iodef  "mailto:security@example.com"

PTR (Pointer Record)

Description: A reverse DNS record that links an IP address to a domain name.

Uses:

• Reverse DNS checks for mail servers
• Better email deliverability
• Identifying hosts

Example:

1.2.0.192.in-addr.arpa.  IN  PTR  mail.example.com.

NAPTR (Naming Authority Pointer)

Description: Complex rewriting rules for telephony and other services.

Uses:

• ENUM (telephony)
• Dynamic delegation
• Specialised protocols

TTL (Time To Live)

What TTL is: The time (in seconds) for which a DNS record is cached.

Typical values:

TTL strategy:

1. Before a migration: lower the TTL to 300–600 seconds 24–48 hours ahead
2. During the migration: change the records
3. After the migration: raise the TTL back after 24–48 hours

Advanced zone management

Exporting a DNS zone

For backup or transfer:

1. Advanced Zone Editor
2. Scroll down to Actions
3. Click DNSSEC or use the export button (if available)

Alternatively, over SSH:

# Export the zone in BIND format
named-checkzone example.com /var/named/example.com.db

Importing DNS records

Bulk-adding records through the API or WHM (requires root access).

DNSSEC (DNS Security Extensions)

Description: Cryptographic protection of DNS against forgery.

Enabling DNSSEC in cPanel:

1. Advanced Zone Editor
2. The DNSSEC section
3. Click Enable DNSSEC
4. Copy the DS records
5. Add the DS records at your domain registrar

DS record example:

example.com. 3600 IN DS 12345 13 2 ABC123...

Multiple IP addresses (Round-Robin DNS)

To spread the load, add several A records:

example.com.  14400  IN  A  192.0.2.1
example.com.  14400  IN  A  192.0.2.2
example.com.  14400  IN  A  192.0.2.3

The DNS server returns the IPs in random order.

Checking DNS records

Checking tools

Using cPanel (Track DNS)

1. Go to Track DNS
2. Enter the domain
3. View all the DNS records
4. Check that the records are correct

Online tools

• WhatsMyDNS.net — global propagation check
• MXToolbox — comprehensive DNS, MX and SPF checks
• DNS Checker — checks all record types
• Dig Web Interface — detailed analysis

Command line

nslookup:

# Basic query
nslookup example.com

# A specific record type
nslookup -type=mx example.com
nslookup -type=txt example.com
nslookup -type=ns example.com

# Using a specific DNS server
nslookup example.com 8.8.8.8

dig (recommended):

# All records
dig example.com ANY

# A specific type
dig example.com A
dig example.com MX
dig example.com TXT
dig example.com NS

# With a trace
dig example.com +trace

# Check DNSSEC
dig example.com +dnssec

# Short output
dig example.com +short

# Reverse DNS
dig -x 192.0.2.1

host:

# Simple query
host example.com

# Detailed information
host -a example.com

# MX records
host -t mx example.com

PowerShell (Windows)

# A record
Resolve-DnsName example.com -Type A

# MX records
Resolve-DnsName example.com -Type MX

# All records
Resolve-DnsName example.com -Type ALL

# Using a specific DNS server
Resolve-DnsName example.com -Server 8.8.8.8

DNS propagation time

Factors that affect propagation:

• The TTL of the previous record
• The cache of DNS resolvers
• Your ISP’s cache
• Geographical distribution

Typical times:

• Locally: immediately (after clearing the cache)
• At your ISP: 1–4 hours
• Globally: 24–48 hours

Speeding up propagation:

1. Lower the TTL to 300 seconds in advance
2. Wait for the old TTL to expire before making the change
3. Change the records
4. Check through different DNS servers (8.8.8.8, 1.1.1.1)

Troubleshooting

The domain does not resolve

Check that:

1. The NS records at the registrar match cPanel
2. The SOA record exists and is correct
3. An A record exists for the domain
4. Your hosting provider’s DNS servers are reachable

# Check the NS records
dig example.com NS

# Check that the DNS server is reachable
dig @ns1.hosting.com example.com

Email is not delivered

Check that:

1. The MX records are set up correctly
2. The MX points to an A record (not a CNAME)
3. The SPF record is correct
4. DKIM is installed
5. Reverse DNS (PTR) is set up

# Check MX
dig example.com MX

# Check SPF
dig example.com TXT | grep spf

# Full mail test
mxtoolbox.com/SuperTool.aspx

DNS changes are not applied

Causes:

1. The old TTL has not expired yet
2. The changes were made in the wrong zone
3. The DNS cache has not been cleared
4. The changes were made at the registrar rather than in cPanel

Solution:

# Clear the DNS cache
# Windows
ipconfig /flushdns

# macOS
sudo dscacheutil -flushcache
sudo killall -HUP mDNSResponder

# Linux
sudo systemd-resolve --flush-caches

# Or restart your browser

The “SERVFAIL” error

Causes:

• DNSSEC is set up incorrectly
• NS records are missing
• The DNS server is unreachable
• A circular CNAME dependency

Solution:

1. Check DNSSEC at your registrar
2. Make sure the NS records are correct
3. Check the CNAME chain (maximum 10 levels)

Wildcard SSL does not work with a wildcard A record

The problem:

*.example.com  IN  A  192.0.2.1

A wildcard A record covers all subdomains, but wildcard SSL needs specific records.

Solution: Create an A record for each subdomain that needs SSL:

blog.example.com  IN  A  192.0.2.1
shop.example.com  IN  A  192.0.2.1

DNS security

Recommendations

1. Use CAA records
   • Restrict who can issue SSL certificates
2. Set up SPF, DKIM and DMARC
   • Protection against email spoofing
3. Enable DNSSEC
   • Protection against DNS forgery
4. Restrict access to the Zone Editor
   • Use strong passwords
   • Turn on 2FA for cPanel
5. Monitor changes
   • Check your DNS records regularly
   • Set up notifications for changes
6. Document your configuration
   • Keep a changelog
   • Export your zones regularly

DNS attacks

DNS spoofing (forgery):

• Protection: DNSSEC

DNS amplification (DDoS amplification):

• Protection: rate limiting on the DNS servers (set up by the hosting provider)

Cache poisoning:

• Protection: DNSSEC, keeping the DNS server up to date

Subdomain takeover:

• Delete CNAME records that point to services you no longer use

Best practices

1. Plan your changes
   • Lower the TTL 24–48 hours ahead
   • Make changes at off-peak times
   • Test on a test subdomain
2. Back up
   • Export the zone before making changes
   • Keep a history of changes
3. Document
   • Write down the purpose of each record
   • Keep a changelog
4. Test
   • Check changes with dig or nslookup
   • Use online tools
   • Test from different locations
5. Monitor
   • Set up alerts for changes
   • Check your configuration regularly
   • Monitor DNS availability

DNS configuration templates

Standard website

example.com.              14400  IN  A      192.0.2.1
www.example.com.          14400  IN  A      192.0.2.1
example.com.              14400  IN  MX  0  mail.example.com.
mail.example.com.         14400  IN  A      192.0.2.2
example.com.              14400  IN  TXT    "v=spf1 a mx ~all"
default._domainkey        14400  IN  TXT    "v=DKIM1; k=rsa; p=..."
_dmarc.example.com.       14400  IN  TXT    "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

With a CDN (Cloudflare)

example.com.              300    IN  A      104.17.x.x
www.example.com.          300    IN  A      104.17.x.x
ftp.example.com.          14400  IN  A      192.0.2.1  ; direct access
example.com.              14400  IN  MX  0  mail.example.com.
mail.example.com.         14400  IN  A      192.0.2.2

Microservices architecture

example.com.              14400  IN  A      192.0.2.1
www.example.com.          14400  IN  CNAME  example.com.
api.example.com.          14400  IN  A      192.0.2.10
cdn.example.com.          14400  IN  CNAME  cdn-provider.net.
app.example.com.          14400  IN  A      192.0.2.11
admin.example.com.        14400  IN  A      192.0.2.12

With external services

example.com.              14400  IN  A      192.0.2.1
www.example.com.          14400  IN  A      192.0.2.1
shop.example.com.         14400  IN  CNAME  shops.myshopify.com.
blog.example.com.         14400  IN  CNAME  domains.tumblr.com.
example.com.              14400  IN  MX  1  aspmx.l.google.com.

See also

• Managing domains
• Setting up SPF, DKIM and DMARC
• SSL and CAA records
• Migrating DNS without downtime

External links

• IANA Root Zone Database
• DNS Checker
• MXToolbox - DNS & Email Tools
• Cloudflare DNS Learning Center
• Wikipedia: DNS Record Types