Operations

Configure DNS records for your domain: A, CNAME, MX, TXT

BM BizMaC Team Jul 21, 2026 8 min read

When you rent a VPS in Vietnam and point a domain to it, the first thing you'll configure is the DNS records. Miss an A record and the site won't load; misconfigure the MX record and email bounces. This guide runs through the four essential DNS record types, A, CNAME, MX, and TXT, with real commands and verify steps you can use today, whether you manage DNS through your registrar, Cloudflare, or a self-hosted BIND server.

Why DNS records matter for a VPS

A domain name is useless without DNS, it's the phonebook that tells the internet where to find your server. Every time someone types your domain into a browser, a DNS lookup resolves it to an IP address. On a Linux VPS, you control the server that responds to that IP. The records you set determine which service handles what: web traffic, email, authentication, or subdomain delegation. Getting them wrong means downtime, lost email, or security gaps.

Step 1, Understanding A records (the foundation)

An A record maps a domain name directly to an IPv4 address. It's the most basic and essential record. When you set up a Vietnam VPS with dedicated IPv4, the A record is what lets users reach your site by name instead of typing the raw IP every time. For example, example.com → 203.0.113.10.

Typical A record values:

NameTypeValueTTL
@ (or blank)A203.0.113.10300
wwwA203.0.113.10300
apiA203.0.113.10300

The @ or blank name field points the apex domain itself. The www subdomain often points to the same IP so www.example.com works. The api subdomain is useful for separating API traffic.

How to verify an A record resolves:

dig example.com A +short
# Expected output: 203.0.113.10

nslookup example.com
# Shows the resolved IP

If you see a different IP or no answer, wait for propagation or double-check the value in your DNS control panel.

Step 2, Understanding CNAME records (aliases)

A CNAME record creates an alias: it maps one domain name to another, not directly to an IP. When you point www.example.com to example.com via CNAME, any change to the target's A record automatically propagates to the alias. This is perfect for subdomains like cdn, blog, or mail that share an origin server.

Why use a CNAME instead of a second A record? If your server IP changes, you update only the A record of the canonical name; all CNAMEs pointing to it update automatically. This reduces errors when managing multiple services on a single VPS.

Key rules:

  • The apex domain (the bare example.com) cannot be a CNAME, it must be an A record.
  • A CNAME cannot coexist with other record types on the same name (no MX or TXT on a CNAME).
  • If your DNS provider has a "flat" alias (ANAME or ALIAS), use it for the apex. Otherwise, keep the apex as an A.

CNAME record example:

NameTypeValueTTL
wwwCNAMEexample.com.300
blogCNAMEexample.com.300
cdnCNAMEcdn.example.com.600

Verify a CNAME:

dig www.example.com CNAME +short
# Expected output: example.com.

dig blog.example.com CNAME +short
# Expected output: example.com.

Step 3, Understanding MX records (mail routing)

An MX record tells the internet where to deliver email for your domain. If you run a mail server on your VPS or use a third-party email service, you must set the MX record. It includes a priority number: lower numbers are tried first. If the primary mail server is unreachable, the fallback (higher priority) server handles delivery.

Sample MX setup for a VPS running Postfix:

NameTypePriorityValueTTL
@MX10mail.example.com.300
@MX20backup-mail.example.com.300

The first MX record (priority 10) points to mail.example.com, which itself needs an A record pointing to your VPS IP. The second record (priority 20) is a backup, if your mail server goes down, email queues and tries the lower-priority server after retries.

Verify MX records:

dig example.com MX +short
# Expected output:
# 10 mail.example.com.
# 20 backup-mail.example.com.

nslookup -type=mx example.com
# Shows the same data

A common mistake is forgetting to create the A record for mail.example.com. Without it, the MX record is useless, the MTA cannot connect to the IP.

Step 4, Understanding TXT records (verification and security)

A TXT record stores arbitrary text data. Its most important use today is email authentication: SPF, DKIM, and DMARC records that protect your domain from spoofing. Without them, your mail goes to spam, or is rejected by recipients like Gmail and Outlook.

SPF record

SPF tells receiving servers which IPs are authorized to send mail for your domain. A typical SPF record for a VPS with its own mail server:

example.com.  TXT  "v=spf1 ip4:203.0.113.10 include:_spf.google.com ~all"

This allows the VPS IP and Google's mail servers (if you use Google Workspace) to send. ~all means "soft-fail" (tag as suspicious but don't reject). Use -all for strict rejection.

DKIM record

DKIM adds a cryptographic signature to outgoing mail. The TXT record holds the public key. Your mail server (Postfix, Exim) signs each message with the private key; recipients verify with the public key in DNS.

default._domainkey.example.com.  TXT  "v=DKIM1; h=sha256; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC......IDAQAB"

DMARC record

DMARC tells recipients what to do if SPF or DKIM fails, reject, quarantine, or pass (monitor only). It also enables reporting.

_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; rua=mailto:[email protected]"

Verify TXT records:

dig example.com TXT +short
# Expected output: "v=spf1 ip4:203.0.113.10 ~all"

dig default._domainkey.example.com TXT +short
dig _dmarc.example.com TXT +short

To check DMARC compliance for another domain (or your own), use an online analyzer or run a local check:

dig _dmarc.gmail.com TXT +short
# Returns Google's DMARC policy: "v=DMARC1; p=none;..."

Troubleshooting common DNS problems

Problem: "Website not loading" after setting A record. The DNS may not have propagated. DNS changes take minutes to hours depending on TTL. Use dig or nslookup with a public resolver like @8.8.8.8 to check what's live:

dig @8.8.8.8 example.com A +short

Problem: Email bouncing with "550 5.1.1 The email account that you tried to reach does not exist." The MX record may point to a server that doesn't accept mail for that domain. Verify both the MX record and the mail server configuration. On the VPS, check:

postconf -n | grep mydomain
# Should match your domain

Problem: SPF macros or DKIM not showing in DNS queries. Double-check the exact TXT record text, a missing space or typo breaks the entire record. Use an online TXT record checker or re-export from your DNS provider's control panel.

Problem: CNAME not resolving for a subdomain. Ensure the CNAME value ends with a trailing dot (example.com.) in most DNS providers. Without the dot, the zone appends the domain name, creating an incorrect FQDN.

FAQ

What is the difference between an A record and a CNAME record?

An A record maps a domain directly to an IPv4 address. A CNAME maps a domain to another domain name, it's an alias. The CNAME must eventually resolve to an A record. Use A for the apex domain; use CNAME for subdomains when you want to avoid maintaining multiple IP entries.

Can I use a CNAME for the root domain (example.com)?

No. RFC standards prohibit a CNAME at the zone apex because the apex must also have SOA and NS records. Some DNS providers offer an ALIAS or ANAME record type that behaves like a CNAME but coexists with other record types. Use that if available, or stick with an A record.

How do I set up email for my domain on a VPS?

You need: an MX record pointing to your mail server hostname (e.g., mail.example.com), an A record for that hostname pointing to your VPS IP, and an SPF TXT record authorizing your IP. Add DKIM and DMARC for better deliverability. Without these, your email will land in spam.

What does SPF "~all" mean compared to "-all"?

~all means "soft fail", the receiving server should mark the message as suspicious but not reject it. -all means "hard fail", reject the message if it does not come from an authorized IP. Start with ~all during testing, then switch to -all when you are confident no legitimate email comes from unauthorized servers.

How do I check if my DNS changes have propagated?

Use a global DNS propagation checker like www.whatsmydns.net, or run dig @8.8.8.8 example.com A +short to query Google's public resolver directly. If you see your new value, propagation is complete. If not, wait, the TTL you set determines the wait.

Can I set multiple TXT records on the same name?

Yes. You can have multiple TXT records for the same domain name, one for SPF, one for DKIM, one for DMARC, and others for domain verification (Google Search Console, Microsoft 365). Each record is independent. Just ensure the text does not exceed 255 characters per string; many providers allow multi-string TXT records for longer data.

Related articles

Note: This guide is for general reference. Every system and infrastructure has its own specifics, so test each step in a safe environment and consult a qualified engineer before applying it in production.