You bought a domain, you have a hosting account, and now you are staring at an empty DNS zone editor wondering which box to fill in. This guide shows you exactly how to set up DNS records for a brand new domain: the real values to type, where each field goes in a hosting control panel, which TTL to pick, and how to confirm everything resolved correctly using dig and nslookup.
No theory dump. Just the four record types that cover 95% of real-world setups (A, CNAME, MX, TXT), in the order you should create them.
What DNS records actually do (the 30 second version)
DNS is the phone book of the internet. Your domain name means nothing to a server until a DNS record tells the world where to send visitors, email and verification checks.
- A record = “this domain lives at this IPv4 address” (your web server).
- AAAA record = same thing, but for an IPv6 address.
- CNAME record = “this name is an alias of another name”.
- MX record = “send email for this domain to this mail server”.
- TXT record = free text used for ownership verification, SPF, DKIM and DMARC.
- NS record = which nameservers are authoritative for the zone.
A domain with only an A record will load a website but will silently drop email. A domain with only MX records will deliver mail but show nothing in a browser. You usually need several records working together.
Before you touch anything: check your nameservers
This is the step most beginners skip, and it is the reason “my DNS record is not working” happens so often. See hubspot.com for their take.
Your DNS records only take effect in the zone that your nameservers point to. If your domain is registered at one company, hosted at Kelio Host, and the nameservers still point to the registrar, then editing the zone inside your hosting panel does absolutely nothing.
You have two valid options:
- Use your host’s nameservers (recommended for beginners). At your registrar, set the nameservers to the ones listed in your hosting welcome email, for example
ns1.kelio-host.netandns2.kelio-host.net. Then manage every record inside your hosting control panel. - Keep the registrar’s or a third-party DNS (Cloudflare, etc.). In that case, add your records there instead, and simply copy the IP address from your hosting panel.
Check which nameservers are live right now:
dig NS example.com +short
nslookup -type=NS example.comNameserver changes can take a few hours to be picked up globally. Wait until the command above returns the expected nameservers before troubleshooting anything else.
Where to find the DNS zone editor in your hosting control panel
The menu name changes from panel to panel, but the screen is always the same: a table of records with an “Add record” button.
| Control panel | Where to click |
|---|---|
| cPanel | Domains > Zone Editor > Manage > Add Record |
| Plesk | Websites & Domains > your domain > DNS Settings > Add Record |
| DirectAdmin | Account Manager > DNS Management |
| Kelio Host panel | Domains > select domain > DNS Zone > Add a record |
| Registrar (GoDaddy, Namecheap, OVH…) | Domain list > Manage > DNS / Advanced DNS |
The five fields you will always see
| Field | Also called | What to put in it |
|---|---|---|
| Type | Record type | A, AAAA, CNAME, MX, TXT… |
| Name | Host, Hostname, Subdomain | @ for the root domain, or www, mail, shop… |
| Value | Points to, Data, Target, Content | IP address, hostname or text string |
| TTL | Time to live | Cache duration in seconds |
| Priority | Pref | MX records only (lower number = tried first) |
Two rules that save a lot of pain:
- In the Name field, most panels want the short name only. Type
www, notwww.example.com. If you type the full name, some panels will createwww.example.com.example.com. - In the Value field of CNAME and MX records, hostnames usually end with a trailing dot (
smtp.google.com.). Modern panels add it for you, so do not panic either way, but never leave a half-written name.
Step 1: Point your domain to your server with an A record
Grab the IPv4 address of your hosting account. In Kelio Host it is shown in the Hosting > Server details panel; in cPanel it appears in the right-hand “General Information” sidebar as “Shared IP Address” or “Dedicated IP”.
Then create these two records (replace 203.0.113.25 with your own IP):
| Type | Name | Value | TTL |
|---|---|---|---|
| A | @ | 203.0.113.25 | 3600 |
| A | www | 203.0.113.25 | 3600 |
The first record makes example.com work. The second makes www.example.com work. Both are needed, because www is technically a subdomain and does not inherit the root record.
A record or CNAME for www?
Both are valid:
- A record on www: simplest, but if your server IP changes you must edit two records.
- CNAME on www pointing to
example.com: change the IP once on the root record andwwwfollows automatically.
If your host gave you an IPv6 address too, add the same pair as AAAA records. IPv6 is increasingly expected in 2026 and costs you nothing to enable.
Important: never put a CNAME on the root domain
The DNS standard forbids a CNAME at @ when other records (MX, TXT, NS) exist on the same name. Some providers offer a workaround called ALIAS, ANAME or CNAME flattening. Use that if your platform only gave you a hostname to point to, otherwise stick to an A record at the root.
Step 2: Add CNAME records for subdomains and external services
A CNAME says “this name is really that other name”. Use it whenever a third-party service gives you a hostname instead of an IP address, because the provider can then change their infrastructure without breaking your site.
| Goal | Type | Name | Value |
|---|---|---|---|
| www follows the root domain | CNAME | www | example.com. |
| Webmail shortcut | CNAME | webmail | mail.kelio-host.net. |
| Landing pages on a SaaS tool | CNAME | go | proxy.saasprovider.com. |
| Docs on a static host | CNAME | docs | yourname.github.io. |
CNAME rules to remember:
- A name with a CNAME cannot have any other record. No A, no TXT, no MX on the same hostname.
- Never point a CNAME to an IP address. That is what an A record is for.
- Avoid chaining CNAMEs through three or four hops. Each hop adds lookup latency.
Step 3: Route email with MX records
MX records decide which server receives mail for your domain. The priority number sets the order: the lowest number is tried first, higher numbers are backups. There is more on it in How to set up DNS records for cloudflare.
Example A: mail hosted on your Kelio Host server
| Type | Name | Value | Priority | TTL |
|---|---|---|---|---|
| MX | @ | mail.example.com. | 10 | 3600 |
| A | 203.0.113.25 | 3600 |
The MX must point to a hostname that itself has an A record. Pointing an MX directly at an IP address is invalid and many senders will reject it.
Example B: Google Workspace
| Type | Name | Value | Priority |
|---|---|---|---|
| MX | @ | smtp.google.com. | 1 |
Example C: Microsoft 365
| Type | Name | Value | Priority |
|---|---|---|---|
| MX | @ | example-com.mail.protection.outlook.com. | 0 |
Delete the old MX records before saving the new ones. Leaving a leftover MX from your previous provider is the number one cause of “half my emails disappear”. Mail servers will happily deliver to whichever MX answers first.
Step 4: Verify ownership and secure email with TXT records
TXT records hold plain text. Four common uses:
1. Domain ownership verification
Google Search Console, Microsoft 365, Meta Business and most SaaS tools give you a string to publish:
| Type | Name | Value |
|---|---|---|
| TXT | @ | google-site-verification=aBcD1234ExampleToken |
Paste the token exactly as given, with no extra spaces and no added quotes (the panel adds them).
2. SPF: who is allowed to send email as you
| Setup | TXT value at @ |
|---|---|
| Mail on your hosting server | v=spf1 a mx ~all |
| Google Workspace | v=spf1 include:_spf.google.com ~all |
| Microsoft 365 | v=spf1 include:spf.protection.outlook.com -all |
| Host + newsletter tool | v=spf1 a mx include:spf.yournewsletter.com ~all |
Only one SPF record per domain. If you use several senders, merge them into a single line with multiple include: statements. Two SPF records equals a permanent error and failed authentication.
3. DKIM: the cryptographic signature
Your mail provider generates a public key and a selector. The record looks like this:
| Type | Name | Value |
|---|---|---|
| TXT | default._domainkey | v=DKIM1; k=rsa; p=MIIBIjANBgkqh… |
4. DMARC: what to do with fakes
| Type | Name | Value |
|---|---|---|
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:[email protected] |
Start with p=none to collect reports, then move to p=quarantine and finally p=reject once you are sure every legitimate sender passes. Gmail and Yahoo now require SPF, DKIM and DMARC for bulk senders, so treat these three records as mandatory, not optional.
TTL: which value should you choose?
TTL is how long resolvers around the world are allowed to cache your record before asking again. It is expressed in seconds.
| TTL | Equals | When to use it |
|---|---|---|
| 300 | 5 minutes | While building, testing or planning a migration |
| 3600 | 1 hour | Safe default for almost everything |
| 14400 | 4 hours | Stable production sites |
| 86400 | 24 hours | Records that never change (SPF, verification tokens) |
The migration trick: lower the TTL to 300 at least 24 hours before you change a server IP. Old caches expire quickly, the switch becomes nearly instant, and you raise the TTL back to 3600 once everything works. Understanding DNS Records: Types, Setup & Lookup tackles the same question from another angle.
Step 5: Confirm your records resolved correctly (dig and nslookup)
Never trust the panel’s green checkmark. Query the live DNS yourself.
With dig (Linux, macOS, WSL)
# Check the A record
dig example.com A +short
# Check www
dig www.example.com +short
# Check mail routing
dig example.com MX +short
# Check SPF, verification tokens and other TXT
dig example.com TXT +short
# Check DMARC and DKIM
dig _dmarc.example.com TXT +short
dig default._domainkey.example.com TXT +short
# Ask a public resolver instead of your ISP cache
dig @8.8.8.8 example.com +short
dig @1.1.1.1 example.com MX +short
# Ask the authoritative server directly (bypasses all caches)
dig @ns1.kelio-host.net example.com +short
# Follow the full delegation path
dig example.com +traceWith nslookup (Windows, and everywhere else)
nslookup example.com
nslookup -type=A www.example.com
nslookup -type=MX example.com
nslookup -type=TXT example.com
nslookup -type=NS example.com
# Force a specific resolver
nslookup -type=MX example.com 8.8.8.8How to read the result
- You see your IP: the record is live. If the browser still shows the old site, flush your local cache (
ipconfig /flushdnson Windows,sudo dscacheutil -flushcacheon macOS) or test in a private window. - NXDOMAIN: the name does not exist. Check for a typo in the Name field, or a missing subdomain record.
- Empty answer: the name exists but has no record of that type. You probably created an A record and are querying for CNAME, or vice versa.
- SERVFAIL: usually a nameserver or DNSSEC problem, not a record problem.
- Old value still returned: caching. Query the authoritative nameserver directly with
dig @ns1.yourhost.netto see the truth.
How long does propagation take?
Propagation is really just cache expiry. The rough timeline:
- Authoritative server: instant, as soon as you save.
- Most resolvers: within the TTL you set (so 5 minutes to 4 hours).
- Nameserver (NS) changes: up to 24 to 48 hours, because TLD registries use long TTLs.
If an authoritative query returns the new value but your machine does not, the record is fine. Be patient and flush your cache.
A complete zone, ready to copy
Here is what a typical small business domain looks like once fully configured, with website on your hosting server and mail on the same server:
| Type | Name | Value | Prio | TTL |
|---|---|---|---|---|
| A | @ | 203.0.113.25 | – | 3600 |
| A | 203.0.113.25 | – | 3600 | |
| AAAA | @ | 2001:db8::25 | – | 3600 |
| CNAME | www | example.com. | – | 3600 |
| CNAME | webmail | mail.kelio-host.net. | – | 14400 |
| MX | @ | mail.example.com. | 10 | 3600 |
| TXT | @ | v=spf1 a mx ~all | – | 86400 |
| TXT | default._domainkey | v=DKIM1; k=rsa; p=MIIBIjAN… | – | 86400 |
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:[email protected] | – | 86400 |
The 8 mistakes we see most often in support tickets
- Editing the zone at the wrong provider because the nameservers point somewhere else.
- Typing the full domain in the Name field, creating
www.example.com.example.com. - Two SPF records instead of one merged record.
- Leaving the old MX from the previous mail provider in place.
- A CNAME at the root domain, which breaks MX and TXT on the same name.
- Pointing an MX record at an IP address instead of a hostname.
- Panicking after 10 minutes. Check the TTL first, then the authoritative server.
- Forgetting the AAAA record when the server has IPv6, causing inconsistent behaviour for IPv6-first visitors.
Final checklist before you close the panel
- Nameservers point to the DNS provider you are actually editing.
- A record at
@and a record forwwwboth exist. - Exactly one set of MX records, pointing to a hostname with an A record.
- One SPF record, plus DKIM and DMARC.
- TTL at 3600 (or 300 if a migration is coming).
- Every record verified with
digornslookup, not just the panel. - SSL certificate issued after the A record resolves, otherwise validation fails.
FAQ
How do I find the DNS records of a domain?
Open your hosting control panel and go to the DNS Zone or Zone Editor section to see the records you own. To see what the rest of the world sees, run dig example.com ANY +short or query each type individually with dig / nslookup. Online lookup tools do the same thing from a browser.
How can I check the MX records for my domain?
Run dig example.com MX +short on Linux or macOS, or nslookup -type=MX example.com on Windows. You should see one line per mail server with its priority number. If you see more than one provider listed, delete the obsolete records.
What is a DNS record type A?
An A record maps a hostname to an IPv4 address. It is the record that tells browsers which server to contact when someone types your domain. The IPv6 equivalent is the AAAA record.
What does 8.8.8.8 DNS do?
8.8.8.8 is Google’s free public DNS resolver (1.1.1.1 is Cloudflare’s). It does not host your records, it simply looks them up on behalf of a client. Querying it with dig @8.8.8.8 example.com is a handy way to check whether a change is visible outside your own network and ISP cache.
How many DNS records can I create?
There is no practical limit for a normal website. You can have hundreds of subdomain records in the same zone. The only hard rules are: one CNAME per name with nothing else alongside it, and one SPF record per domain.
Do I need to restart anything after changing a DNS record?
No. DNS changes are live as soon as the zone is saved on the authoritative nameserver. Any delay you experience is caching, controlled by the TTL.
Why does my site work without www but not with it?
You are missing a record for the www name. Add either an A record for www pointing to your server IP, or a CNAME for www pointing to your root domain.
Can I set up DNS records from my phone?
Yes. Hosting control panels are responsive, so the same Zone Editor works in a mobile browser. Just be careful with long values such as DKIM keys, where copy and paste errors are easy to make on a small screen.
Need a hand? Every Kelio Host plan includes a visual DNS zone editor with preset templates for Google Workspace, Microsoft 365 and common SaaS tools, plus a support team that will review your zone before you go live. Open a ticket with your domain name and we will check the whole setup for you.