DNS basics for a new domain

A name that has a CNAME record cannot have any other record. The root of your domain, example.com without www, always has NS and SOA records, so it cannot be a CNAME. Point the root to your server with A and AAAA records, and use a CNAME for www if you like. Some DNS providers offer ALIAS records or CNAME flattening, which work around this rule by answering with addresses instead.

Every record has a time to live, or TTL, in seconds. A resolver that looked up your record keeps the answer for that long before asking again. There is no central update that spreads across the internet: a change has propagated once the cached copies have expired.

• Lower the TTL, for example to 300 seconds, a day before a planned change, and raise it again afterwards.
• Nameserver changes take longer, because the records at the registry of your extension have their own TTL, often one or two days.
• Check what resolvers see with dig or nslookup, and query your authoritative nameserver directly, for example with dig @ns1.example.com example.com, to confirm the change is live.

Email records matter even for a domain that sends no email, because they stop others from sending mail in your name.

SPF

An SPF record is a TXT record that lists the servers allowed to send mail for your domain. Publish exactly one SPF record per name, and keep it within the limit of ten DNS lookups that mechanisms such as include can trigger.

DKIM

DKIM adds a cryptographic signature to outgoing mail. Your mail provider gives you a public key to publish as a TXT record under a selector name.

DMARC

DMARC tells receiving servers what to do with mail that fails the SPF and DKIM checks for your domain: p=none to monitor, p=quarantine or p=reject to enforce, and where to send reports. Its current specification was published as RFC 9989 in 2026.

Large mailbox providers expect this setup. Gmail, for example, requires SPF or DKIM from every sender, and SPF, DKIM and a DMARC record from senders of more than 5,000 messages a day to its users. For a domain that sends no email at all, publish an SPF record of v=spf1 -all and a DMARC policy of p=reject.

Under ICANN's Transfer Policy, a generic domain usually cannot move to another registrar for a short period after it was registered or last transferred; country-code domains follow their own rules. Plan a transfer outside that window, and remember that a transfer of a generic domain normally adds a year to its registration.