DNS Masterclass: CNAMEs, A Records, and TTLs Explained

Stop guessing with your DNS settings. Understand the difference between A and CNAME records, the impact of TTL, and what the Cloudflare 'Orange Cloud' actually does.

DNS Masterclass: Understanding the Backbone of the Web

Domain Name System (DNS) is the phonebook of the internet. When you type google.com, DNS turns that human-readable name into a machine-readable IP address like 142.250.190.46.

For MailGuard users, understanding DNS is vital because you are essentially becoming your own ISP administrator. This guide covers the core concepts you will encounter.

The Record Types

A Record (Address)

The most basic record. It points a name directly to an IPv4 address.

  • example.com -> 93.184.216.34

AAAA Record

The modern version of the A record, pointing to an IPv6 address.

  • example.com -> 2606:2800:220:1:248:1893:25c8:1946

CNAME (Canonical Name)

Think of this as an Alias or "See Also". It points one domain name to another domain name, not an IP address.

  • www.example.com -> example.com
  • blog.example.com -> hashnode.network

Crucial Rule: You cannot have a CNAME at the "Root" (apex) of your domain (example.com). It must be a subdomain (www, mail, blog). Note: Cloudflare uses a trick called "CNAME Flattening" to allow this at the root, effectively converting it to an A record behind the scenes.

MX Record (Mail Exchange)

Tells the world "Send email for this domain to THIS server."

  • example.com -> route1.mx.cloudflare.net (Priority 10)
  • example.com -> route2.mx.cloudflare.net (Priority 20) Priority determines the order. If server 1 is down, try server 2.

The Cloudflare Proxy (Orange vs. Grey Cloud)

This is specific to Cloudflare and often confusing.

🟧 Orange Cloud (Proxied)

  • Traffic: Goes through Cloudflare's network first.
  • Benefits: DDoS protection, caching (CDN), IP masking (your server IP is hidden), and free SSL.
  • Use for: Your website (A, CNAME, AAAA).

⬜ Grey Cloud (DNS Only)

  • Traffic: Goes DIRECTLY to your server. Cloudflare just acts as the phonebook and steps aside.
  • Use for: specialized services like SSH, FTP, or sometimes Email verification records that need to see the origin directly.
  • Warning: Your origin IP is exposed to the public.

TTL (Time To Live)

TTL tells the internet: "How long should you remember this information?"

  • High TTL (e.g., 86400s = 24 hours): Good for static records that never change. Reduces traffic to your DNS server. Downside: If you change servers, you have to wait 24 hours for everyone to notice.
  • Low TTL (e.g., 300s = 5 minutes): Good for testing or records you plan to change soon.
  • Auto: Cloudflare's default. Since Cloudflare's propagation is nearly instant globally, "Auto" is usually best.

Why this matters for MailGuard

When you set up MailGuard:

  1. MX Records: Must be correct to route mail to us.
  2. TXT (SPF/DKIM): Must be exactly as specified to authorize us.
  3. TTL: Keep it on "Auto" so any security updates we push propagate immediately to your domain configuration.

Understanding these knobs and dials turns you from a passive user into a proficient admin of your own digital territory.