DNS
Intermediate 12 min read DNS

Record Types and Hosted Zones

Authoritative records under one namespace

A hosted zone is the container for all your records under a domain; record types (A, AAAA, CNAME, MX, TXT, SRV, alias) each solve a specific mapping. Getting the apex/CNAME/alias behavior right is the fine art.

hosted zoneCNAMEaliasA recordMXTXTapex
Prerequisites: DNS Fundamentals
Before we start

What you will learn

  • Create public/private hosted zones
  • Choose A vs AAAA vs CNAME vs alias
  • Manage apex CNAME constraints
In 60 seconds

A hosted zone holds your zone's NS/SOA plus records (A, CNAME, alias, MX/SPF/TXT...). Alias records let the apex point at cloud resources despite the 'no CNAME at apex' rule, and stay current when the resource IP changes.

Introduction

What is this?

Hosted zones: public (global, resolvable) or private (inside a VPC/VNet scope). Record types: A/AAAA (address), CNAME (alias to another name), alias records (AWS Route 53 alias → LB/S3/CloudFront, always current), MX (mail), TXT (SPF/DKIM/verification), SRV. Apex behavior: a CNAME can't sit at the zone apex (zone apex example.com), but an ALIAS/A-record to the LB resource solves it. NS delegation: the parent registry points example.com at your zone's NS records.

Motivation

Why do you need it?

  • Zones are where you centralize 'which hostname serves what' for an app estate.
  • Alias records eliminate IP-drift ops: the record always resolves the current LB IP.
  • TXT is the workhorse of verification (SPF, DKIM, TLS-ALPN, ownership) for services.
  • Private zones give internal microservice names without public exposure.
Think about it

Mental model

Imagine

A building's directory listing all offices by name and function

Think of

A hosted zone

Each office (hostname) has a listing (record): Jay in sales (CNAME to his desk's extension, which Moves), the front desk at the street address (A record), the fire-escape notice (TXT) — all stored on one board (the zone) that the building's phone network (NS delegation) can find.

Mechanics

How it works

  • Create a hosted zone → the provider gives NS records; register the domain's NS in the registrar.
  • Records added via UI/CLI/IaC; propagation is instant at the authoritative server.
  • Alias records (Route 53) route to AWS resources without knowing the IP and auto-update on changes.
  • Private zones replicate names within the VNC/Vnet scope used by apps.
  • TTL per record controls cache life; lower for frequently-changed, higher for stable.

Zone record layout.

example.com zone
app A / alias
www CNAME
mail MX + TXT
Internal names
Hands-on

Examples

Create a zonally correct record set

Create a zonally correct record set
# Route 53 alias at apex to an ALB
aws route53 change-resource-record-sets --hosted-zone-id ZONE \
  --change-batch '{"Changes":[{"Action":"UPSERT","ResourceRecordSet":{
     "Name":"example.com","Type":"A","AliasTarget":{
       "HostedZoneId":"Z35SXDOTRQ7X7K",
       "DNSName":"<alb-dns>","EvaluateTargetHealth":true}}}]}'
# CNAME + verification TXT
aws route53 change-resource-record-sets --hosted-zone-id ZONE \
  --change-batch '{"Changes":[
    {"Action":"UPSERT","ResourceRecordSet":{"Name":"www.example.com","Type":"CNAME","TTL":60,"ResourceRecords":[{"Value":"example.com"}]}},
    {"Action":"UPSERT","ResourceRecordSet":{"Name":"_acme-challenge.example.com","Type":"TXT","TTL":60,"ResourceRecords":[{"Value":"challenge-token"}]}}]}'

Alias at the apex, CNAME for www, and a TXT for ACME ownership verification.

Real world

In production

  • A microservices platform creates a private hosted zone so services resolve by internal FQDN.
  • Azure DNS zone carries MX + SPF/DKIM TXT for corporate mail migration.
  • Cloud DNS alias records keep GCP LB names wired to traffic-manager-style records.
Guidelines

Best practices

  • Use alias/CNAME to resources, not baked IPs, for anything that can change.
  • Centralize TXT/SPF in the zone so ownership verifications are visible.
  • Name internal records under a private zone (e.g. .internal) to avoid collisions.
  • Audit your zones periodically: typo'd records and dead MXs accumulate.
Watch out

Common mistakes

  • CNAME at the apex breaking resolution or failing provider validation.
  • Hard-coded IP records that silently drift from the auto-updated LB IP.
  • Skipping NS delegation → 'works in console, fails on the internet'.
  • Public zone records leaking internal endpoint names into the global DNS.
Root cause analysis

Common issues

Error
Zone works in console but not on the internet
Root cause

Missing NS delegation at the registrar

Fix

Point the domain's nameservers at the zone's 4 NS records at the registrar.

Error
Apex record can't be CNAME
Root cause

RFC constraint at zone apex

Fix

Use a provider alias/A record (Route 53 alias) or serve the app from www + redirect apex.

When things break

Debugging tips

  • Confirm delegation: dig +trace shows where the NS pointer lands.
  • Alias not answering: verify the resource ARN/region and DNSName of the alias target.
  • TXT working? dig TXT _acme-challenge.example.com.
  • Private vs public conflict: two zones for the same name — resolution picks scoped-first.
Interviews

Interview checkpoint

Test yourself

Quick quiz

0/1
1

Which record type updates automatically when the target's IP changes?

Go deeper

Official documentation

AWS — Route 53 records
docs
Azure — DNS zones and records
docs
GCP — Managing DNS records
docs