DNS Records

Included with Managed DNS ($2 per domain per month).

1. What This Feature Does

The record editor on each Managed DNS domain is where you add, change and remove the DNS records CertaDNS answers for that domain. It supports eight record types — A, AAAA, CNAME, MX, TXT, NS, SRV and CAA — and also shows the domain's SOA and nameserver records, which CertaDNS manages.

Every change is recorded in the domain's Change history, and the most recent one can be undone. For any record you can check whether the public nameservers are already serving it.

2. When You Should Use It

• Pointing a name in your domain at a website, server or service (A, AAAA, CNAME).
• Routing mail (MX) and publishing verification or policy text (TXT).
• Delegating a subdomain to other nameservers (NS), advertising a service (SRV), or limiting which certificate authorities may issue for the domain (CAA).
• Recreating a domain's existing records before you move its nameservers to CertaDNS.

3. When You Should Not Use It

• Email authentication records CertaDNS publishes for you (SPF, DMARC, BIMI, TLS-RPT, MTA-STS). They are shown locked here; change them under Email Authentication.
• Hostnames that change IP address on their own, such as a home connection. Use a Dynamic DNS hostname, which your router or client keeps up to date.
• The domain's own nameserver records. NS records at @ cannot be added or edited; CertaDNS manages them. NS records here are for delegating subdomains. To use other nameservers for the whole domain, change them at your registrar.

4. Prerequisites

• The domain added under DNS > Managed DNS and its ownership verified. See Managed DNS.
• For records to be answered publicly, the domain delegated to CertaDNS (status Live). You can add records before that; they are served once the delegation takes effect.
• In an organization, a team role that allows editing DNS records on the domain.

5. How It Works (Brief)

When you save a record, CertaDNS publishes the full set of records for that name and type to its nameservers. Changes reach our nameservers within seconds. Resolvers elsewhere keep the previous answer until its TTL runs out, so a record with a 1-hour TTL can take up to an hour to change everywhere.

Several records of the same name and type — for example two A records for load sharing, or several MX records — are served together.

6. How to Use It

Open DNS > Managed DNS and click the domain, or Manage records on its row. The editor is headed DNS Records for <your domain>.

Add a record

1. Click Add Record.
2. Choose the Type, enter the Name (@ for the domain itself, or a subdomain such as www; the domain is added for you), choose a TTL, and enter the Content. For MX and SRV, also set Priority.
3. Click Add Record under the form.

Edit a record

1. Click the edit icon on the record's row. The row becomes editable in place.
2. Change the content, TTL or (for MX and SRV) priority, then click the tick to save, or the cross to cancel.

The name and type cannot be changed. To rename a record or change its type, add the new record and delete the old one.

Delete a record

Click the delete icon and confirm with Delete record. For MX and NS records the confirmation spells out what stops working.

Check whether a record is live

Click the question-mark icon on a row. It turns into a green tick when the CertaDNS nameservers are serving the record's value; hover over it to see which nameservers answered, or what they are serving instead.

Undo a change

1. Below the editor, open Change history. Each entry shows what was added, changed or removed, by whom and when.
2. Click Undo on the latest change and confirm with Undo it. A removed record is put back, an added one is removed again, and a changed one gets its previous value back.

Find records

Use Search records... to filter by name, content or type, or the type list (All Types) to show one type. Choose how many rows to show per page at the bottom.

7. Inputs and Settings

8. Outputs and Results

• Each row shows the full name, type, content, TTL, a Monitor switch (A and AAAA records only; see Uptime Monitoring) and actions. Click a name or value to copy it.
• Rows marked System are the domain's SOA and nameserver records. CertaDNS manages them and they cannot be edited.
• Rows with a lock and a label — SPF, DMARC, BIMI, TLS-RPT or MTA-STS — are maintained by Email Authentication.
• The footer counts records, split into yours and those managed by CertaDNS.

9. How to Interpret Results

• Green tick on the live check — the public nameservers serve this value. Resolvers that cached the old value switch over within the TTL.
• Yellow question mark — the nameservers answered with something else, or nothing. Straight after a save this can be a few seconds of lag; if it persists, hover to see what is being served. If the domain is not Live, the public does not see these records at all.
• Grey question mark after checking — no nameserver could be asked; hover for the reason, and reload the page to check again.

10. Common Issues and Explanations

"… is set up for email authentication only. Managed DNS is $2 per domain per month…"

The domain was added under Email Authentication, which does not host its DNS. Its records live at your own DNS host.

"The domain's own nameserver records are managed by CertaDNS…"

You tried to add or edit an NS record at @. The domain's nameservers are set by CertaDNS and shown as System rows. To serve the domain from other nameservers, change them at your registrar; to delegate part of the domain, add the NS record on that subdomain's name.

"CNAME records cannot be created at the zone apex (@)…"

The domain itself always has SOA and NS records, which a CNAME cannot sit beside. Use an A or AAAA record at @, or put the CNAME on a subdomain such as www.

"CNAME cannot coexist with other record types" / "Cannot create record where CNAME exists"

A name with a CNAME can have no other records. Delete one or the other.

"… is not a valid IPv4 address" / "That is an IPv6 address. Use an AAAA record…"

The content does not match the type. A takes IPv4, AAAA takes IPv6; CNAME, MX and NS take host names, not addresses.

"DNS record limit reached for zone …"

The domain has 500 records, counting Dynamic DNS hostnames under it. Remove records you no longer need.

"This record is managed by the … configuration"

The record belongs to Email Authentication. Change or delete it there.

"This record is managed by something else"

An active DNS Failover monitor manages this record's address and would change it back. Remove the failover monitor first. You can still go ahead by typing delete to confirm.

"Only the most recent change can be undone. Edit the record directly instead."

Undo works backwards one change at a time. To change something older, edit the record.

11. Limits and Constraints

12. Related Features

• Managed DNS — adding a domain and delegating it.
• Uptime Monitoring — the Monitor switch on A and AAAA records.
• TLS Certificates — if you publish CAA records, they must allow the authority that issues your certificates.
• Dynamic DNS — hostnames whose address updates itself.

13. Updates and Behavior Changes

• 30 September 2026. This article was rewritten to match the current dashboard. Records are edited in place on each Managed DNS domain's page rather than on a separate page; eight record types are supported; changes are recorded with an undo on the latest one; and each record can be checked against the public nameservers.