DNS record types

This page provides reference information about the different types of DNS records. For guidance on adding DNS records, refer to Manage DNS records.

​​ IP address resolution

At least one IP address resolution record is required for each domain on Cloudflare. These records are the only ones you can proxy through Cloudflare.

​​ A and AAAA

A and AAAA records Open external link map a domain name to one or multiple IPv4 or IPv6 address(es).

These records include the following fields:

• Name: A subdomain or the root domain, which must:
  • Be 63 characters or less
  • Start with a letter and end with a letter or digit
  • Only contain letters, digits, or hyphens (underscores allowed but discouraged)
• IPv4/IPv6 address: Your origin server address (cannot be a Cloudflare IP Open external link )
• TTL: Time to live, which controls how long DNS resolvers should cache a response before revalidating it.
  • If the Proxy Status is Proxied, this value defaults to Auto, which is 300 seconds.
  • If the Proxy Status is DNS Only, you can customize the value.
• Proxy status: For more details, refer to Proxied DNS records.

​​ Example API call

When creating A or AAAA records using the API:

• The content of the records is an IP address (IPv4 for A or IPv6 for AAAA).
• The proxied field affects the record’s proxy status.

For field definitions, refer to our API documentation Open external link (visible once you select Show definitions).

Request
curl -sX POST "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/dns_records" \
-H 'x-auth-email: <EMAIL>' \
-H 'x-auth-key: <API_KEY>' \
-H "Content-Type: application/json" \
--data '{
  "type":"A",
  "name":"www.example.com",
  "content":"192.0.2.1",
  "ttl":3600,
  "proxied":false
  }'

Response
{
  "result": {
    "id": "<ID>",
    "zone_id": "<ZONE_ID>",
    "zone_name": "example.com",
    "name": "www.example.com",
    "type": "A",
    "content": "192.0.2.1",
    "proxiable": true,
    "proxied": false,
    "ttl": 1,
    "locked": false,
    "meta": {
      "auto_added": false,
      "managed_by_apps": false,
      "managed_by_argo_tunnel": false,
      "source": "primary"
    },
    "comment": null,
    "tags": [],
    "created_on": "2023-01-17T20:37:05.368097Z",
    "modified_on": "2023-01-17T20:37:05.368097Z"
  },
  "success": true,
  "errors": [],
  "messages": []
}

​​ CNAME

CNAME records Open external link map a domain name to another (canonical) domain name. Can be used to resolve other record types present on the target domain name.

These records include the following fields:

• Name: A subdomain or the root domain, which must:
  • Be 63 characters or less
  • Start with a letter and end with a letter or digit
  • Only contain letters, digits, or hyphens (underscores are allowed but discouraged)
• Target: The hostname where traffic should be directed (example.com).
• TTL: Time to live, which controls how long DNS resolvers should cache a response before revalidating it.
  • If the Proxy Status is Proxied, this value defaults to Auto, which is 300 seconds.
  • If the Proxy Status is DNS Only, you can customize the value.
• Proxy status: For more details, refer to Proxied DNS records.

You can use CNAME records to point to other CNAME records (www.example2.com –> www.example1.com –> www.example.com), but the final record must point to a hostname with a valid IP address (and therefore a valid A or AAAA record) if this hostname is meant to proxy traffic.

Cloudflare uses a process called CNAME flattening to deliver better performance. This process supports a few features and can interact with different setups that depend on CNAME records. Refer to the CNAME flattening section to learn more about this.

​​ Example API call

When creating CNAME records using the API:

• The content of the records is a fully qualified domain name Open external link .
• The proxied field affects the record’s proxy status

For field definitions, refer to our API documentation Open external link (visible once you select Show definitions).

Request
curl -sX POST "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/dns_records" \
-H 'x-auth-email: <EMAIL>' \
-H 'x-auth-key: <API_KEY>' \
-H "Content-Type: application/json" \
--data '{
  "type":"CNAME",
  "name":"www.example.com",
  "content":"www.another-example.com",
  "ttl":3600,
  "proxied":false
}'

Response
{
  "result": {
    "id": "<ID>",
    "zone_id": "<ZONE_ID>",
    "zone_name": "example.com",
    "name": "www.example.com",
    "type": "A",
    "content": "www.another-example.com",
    "proxiable": true,
    "proxied": false,
    "ttl": 1,
    "locked": false,
    "meta": {
      "auto_added": false,
      "managed_by_apps": false,
      "managed_by_argo_tunnel": false,
      "source": "primary"
    },
    "comment": null,
    "tags": [],
    "created_on": "2023-01-17T20:37:05.368097Z",
    "modified_on": "2023-01-17T20:37:05.368097Z"
  },
  "success": true,
  "errors": [],
  "messages": []
}

​​ Email authentication

These records are recommended regardless of whether your domain sends email messages. Creating secure email records Open external link can help protect your domain against email spoofing.

If your domain is not used to send email messages, learn more about creating recommended restrictive records Open external link .

​​ MX

A mail exchange (MX) record is required to deliver email to a mail server.

• MX record syntax Open external link
• Create an MX record

For field definitions, refer to our API documentation Open external link (visible once you select Show definitions).

​​ DKIM

A DomainKeys Identified Mail (DKIM) record ensures email authenticity by cryptographically signing emails:

• DKIM record syntax Open external link
• Create a DKIM record

For field definitions, refer to our API documentation Open external link (visible once you select Show definitions).

​​ SPF

A Sender Policy Framework (SPF) record lists authorized IP addresses and domains that can send email on behalf of your domain.

• SPF record syntax Open external link
• Create an SPF record

For field definitions, refer to our API documentation Open external link (visible once you select Show definitions).

​​ DMARC

A Domain-based Message Authentication Reporting and Conformance (DMARC) record helps generate aggregate reports about your email traffic and provide clear instructions for how email receivers should treat non-conforming emails.

• DMARC record syntax Open external link
• Create a DMARC record

For field definitions, refer to our API documentation Open external link (visible once you select Show definitions).

​​ Specialized records

​​ TXT

A text (TXT) record Open external link lets you enter text into the DNS system.

At Cloudflare, these are most commonly used to demonstrate domain ownership prior to issuing SSL/TLS certificates for your domain or an SSL for SaaS domain.

You could also use these to create email authentication records, but we recommend that you use our Email Security Wizard instead.

For field definitions, refer to our API documentation Open external link (visible once you select Show definitions).

​​ CAA

A Certificate Authority Authorization (CAA) record specifies which Certificate Authorities (CAs) are allowed to issue certificates for a domain.

For field definitions, refer to our API documentation Open external link (visible once you select Show definitions).

​​ SRV

A service record (SRV) Open external link specifies a host and port for specific services like voice over IP (VOIP), instant messaging, and more.

​​ Example API call

For field definitions, refer to our API documentation Open external link (visible once you select Show definitions).

Request
curl -sX POST "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/dns_records" \
-H 'x-auth-email: <EMAIL>' \
-H 'x-auth-key: <API_KEY>' \
-H "Content-Type: application/json" \
--data '{
  "type":"SRV", 
  "data": {
    "service":"_xmpp",
    "proto":"_tcp",
    "name":"example.com",
    "priority":10,
    "weight":5,
    "port":5223,
    "target":"server.example.com"
  }
}'

Response
{
  "result": {
    "id": "<ID>",
    "zone_id": "<ZONE_ID>",
    "zone_name": "example.com",
    "name": "xmpp.tcp.example.com",
    "type": "SRV",
    "content": "5\t5223\tserver.example.com",
    "priority": 10,
    "proxiable": false,
    "proxied": false,
    "ttl": 1,
    "locked": false,
    "data": {
      "name": "example.com",
      "port": 5223,       
      "priority": 10,       
      "proto": "_tcp",       
      "service": "_xmpp",       
      "target": "server.example.com",       
      "weight": 5     
    },
    "meta": {       
      "auto_added": false,       
      "managed_by_apps": false,       
      "managed_by_argo_tunnel": false,       
      "source": "primary"     
    },
    "comment": null,
    "tags": [],
    "created_on": "2022-11-08T15:57:39.585977Z",
    "modified_on": "2022-11-08T15:57:39.585977Z"
  },
  "success": true,
  "errors": [],
  "messages": []
}

​​ PTR

A pointer (PTR) record Open external link specifies the allowed hosts for a given IP address.

Within Cloudflare, PTR records are used for reverse DNS lookups and should preferably be added to reverse zones.

For field definitions, refer to our API documentation Open external link (visible once you select Show definitions).

​​ SOA

A start of authority (SOA) Open external link record stores information about your domain such as admin email address, when the domain was last updated, and more.

If you are using Cloudflare for your authoritative DNS, you do not need to create an SOA record. Cloudflare creates this record automatically when you start using Cloudflare’s authoritative nameservers.

For field definitions, refer to our API documentation Open external link (visible once you select Show definitions).

​​ NS

A nameserver (NS) record Open external link indicates which server should be used for authoritative DNS.

You only need to add NS records when you are creating custom or vanity nameservers or delegating subdomains outside of Cloudflare.

For field definitions, refer to our API documentation Open external link (visible once you select Show definitions).

​​ DS and DNSKEY

DS and DNSKEY Open external link records help implement DNSSEC, which cryptographically signs DNS records to prevent domain spoofing.

Most Cloudflare domains do not need to add these records and should instead follow our DNSSEC setup guide.

For field definitions, refer to our API documentation Open external link (visible once you select Show definitions).