A record

An A record is a name, a TTL and a 32-bit IPv4 address such as 203.0.113.10. An AAAA record is the same thing for a 128-bit IPv6 address. Every lookup that ends in a connection ends at one of these two types: a CNAME only renames the question, and eventually some name has to answer with an address.

Unlike a CNAME, an A record can share its name with anything. That is why the apex of a zone, which must also carry SOA and NS records, uses A and AAAA records for its website.

Publishing three A records at one name is legal and common. Resolvers return the whole set, usually in varying order, and clients try the addresses in turn. This spreads load a little and survives one dead address, but it is not health-checked load balancing: DNS keeps handing out an address after the server behind it goes down, until someone removes the record and the TTL runs out.

Two views of the same name can list the set in different orders and still agree. The DNS propagation checker compares answer sets, not orderings, for that reason.

Publish AAAA only if IPv6 actually works end to end. Clients that have IPv6 generally prefer it, so an AAAA pointing somewhere dead is worse than no AAAA at all: IPv6 users hit the dead address first and wait for a fallback. An absent AAAA record just means the name is IPv4-only.

For a subdomain, ask for a CNAME. It keeps your addresses yours to change. For an apex domain, a CNAME is not allowed, and an A record is the portable answer, but it has a real cost:

• Your IP addresses become a contract. Every connected customer's zone holds them. Changing them means asking every customer to edit DNS again, or leaving the old addresses answering forever.
• The addresses must be stable and yours. An anycast edge or reserved load-balancer addresses work. The ephemeral IP of a single VM does not.
• Verification pins the value. A connection verified against 203.0.113.10 stays verified only while that is what the name resolves to, which is exactly what drift monitoring should tell you about.

The apex-domain guide describes how DoDomain handles A and AAAA records at @ on each connect path, including one-click apply.

The new value is live at the authoritative nameservers within seconds. What takes time is caches letting go of the old value, bounded by the record's previous TTL. Lower the TTL a full TTL period before a planned move; the DNS propagation entry explains why that ordering matters.

• DNS propagation checker

  See the A or AAAA set at the source and at three public resolvers side by side.

• Apex domains (docs)

  When A records are the right answer for a customer's root domain.

• CNAME record

  The alias record, and why subdomains should prefer it.