Add and edit DNS records

Add, edit and delete the DNS records that control your domain — InfraNest pushes every change straight to your provider, for anyone managing a domain's DNS without needing to know the technical details.

#Overview

• Add, edit and delete DNS records in one place, with the right fields shown for each record type.
• See what each record is for and what depends on it before you change or remove it.
• Keep a zone in sync with your provider, and get told if something changes outside InfraNest.

#Edit records

1. Open a zone from the DNS page.
2. Choose Add record at the top of the page, or the pencil on a row to edit it. The editor shows the right fields for each type — for example priority for MX, the Proxy status setting for Cloudflare, plus TTL and an optional comment. The TTL is also shown when you hover over a value.

3. Select Save. The change is pushed to the provider. If the provider rejects it, InfraNest rolls the change back, so the two never disagree.

#What each record points at, and what uses it

The Points at column says what each value is, so you don't have to recognise an address:

• Hetzner · web-01 — the address belongs to one of your servers. Select it to open the server.
• Behind Cloudflare, Hosted on GitHub Pages, Mail handled by Google Workspace — a service InfraNest recognises from the value.
• Office · dynamic address — the record follows a home or office connection whose address changes. The value has a small refresh icon so you can spot it at a glance.
• Same as example.com — a CNAME that points at the zone itself.
• SPF for Google Workspace, DMARC, monitoring only, DKIM key for Google Workspace, Google Search Console — what a TXT record is for.
• Proves example.com for single sign-on, Your status page … — records InfraNest asked you to add. They are never suggested as left over. A status page record that still points at an older InfraNest address says which address to change it to.
• Atlassian, DKIM key for SendGrid, Mail settings for Microsoft 365, Status page on incident.io — what a verification code, a mail key or a service record is for, for several hundred common services.
• Domain Connect · GoDaddy — a record your DNS host adds so apps can set up your domain for you. If the host is connected to InfraNest it links there; if another host serves your zone now, it is marked as left over.
• Cloudflare nameservers, Start of authority at Cloudflare, Let's Encrypt may issue certificates — nameserver, SOA and CAA records.
• Receives no mail (null MX) — an MX record of ., which tells senders this name takes no mail at all. That is deliberate, for example on a name you only send from.
• This computer (localhost), A private network address — the internet cannot reach these addresses.
• Hetzner · not connected — the address is in a cloud provider's network that you haven't connected. Select it to connect the provider and see which server it is.
• An address you released, in red — none of your servers has this address any more. Your provider can give it to someone else, and this name would then send your visitors to their machine. Point the record somewhere you hold, or delete it.
• … no longer holds this name, in red — the record points at a service that dropped the name, so anyone can claim it there. Point it somewhere else, or delete it.

A quieter line under it adds what is worth knowing: Proxied by Cloudflare, what an SPF record does with mail from anyone else, or Looks left over for a record the zone no longer seems to need. It also says when your mail records disagree: a DKIM key for a service your SPF record does not let send, or a service SPF allows that has no DKIM key here.

#Say what a record is for

When InfraNest doesn't recognise a record, nobody else will either, and the next person tidying the zone may delete it. If you know what it is for, select Say what it's for under the record and type a short note, such as Verification for our CRM. You can do this on any record nothing names, and on one marked Looks left over that you know is still needed.

• Your note is shown in Points at, with a note icon.
• A record with a note is never suggested as left over.
• Only people in your workspace see it. InfraNest doesn't share it or use it for anything else.
• To change or remove a note, select the pencil next to it. Notes are kept in the zone's History.
• The note belongs to the record's name and value. If you change the value, the note stays with the old value. If you remove the zone and import it again, the note comes back.

When all of a zone's mail servers belong to one provider, they are shown as one row, for example Mail handled by Google Workspace · + 4 more MX records. Select it to see each server in the order senders try them.

Used by lists what depends on the record — the monitors that check the name, the certificates that cover it, the status pages served from it and other records that point at it. Each one is a link.

The domain's registration is shown above the records: who it is registered with, when it renews, and Open domain. If the registration lapses, every record in the zone stops working, so it is kept in view.

#Before you change or delete a record

When you edit a record, the editor lists what depends on it — for example Monitor Status checks this name. After the change it checks whatever the new value answers. — and, once you type a new value, what that value is (New value — Hosted on GitHub Pages).

Moving an address? If the record is cached for a long time (more than an hour), the editor warns that visitors may keep seeing the old address that long after you save. Select Lower TTL now: the record's TTL drops to 5 minutes (or the lowest your provider allows) straight away, and nothing else changes. Come back the next day and change the address — by then every cached copy has run out, so the switch takes minutes. Lowering the TTL shows in the zone's history and can be undone there.

When you delete a record something depends on, the confirmation says what stops working, in one sentence, and the button reads Delete anyway.

#A domain with real visitors

When the domain is among the most-visited sites on the web (it is in the public Tranco list), the editor says so before you save a change to, or delete, an A, AAAA, CNAME, MX or NS record — for example acme.com is among the most-visited sites (rank 4,210 in the Tranco list) — this change affects real visitors right away. It is a note, not an extra step: you save as usual.

Two deletions ask you to confirm first: the address the site answers on (an A, AAAA or CNAME record for the domain itself or for www), and the last MX record, after which mail to the domain stops arriving. Tick I understand that real visitors are affected right away, then Delete. A domain that is not in the list works exactly as before — not being in it says nothing about how many people visit it.

The rank is credited under the note: Traffic rank: Tranco list from Majestic (CC BY 3.0), Chrome UX Report (CC BY-SA 4.0) and Cisco Umbrella.

WarningDeleting a record something depends on, or deleting the address a busy domain answers on, can take your site or mail offline right away. Read what the confirmation says before selecting Delete anyway or Delete.

#The name field

The Name is the part in front of your domain, not the whole address.

1. For the domain itself — example.com, with nothing in front — leave the field empty. The hint under the field says which domain that is.
2. For anything under it, type only the part in front: www for www.example.com, mail for mail.example.com.

If you paste the whole address, InfraNest shortens it for you and tells you what it will save, so you never end up with www.example.com.example.com.

#Pointing a record at a server

For A and AAAA records, start typing and InfraNest offers the servers in your connected cloud accounts. Some providers hand out a whole IPv6 block for a server rather than one address — the suggestion then reads "first address in 2a01:…::/64", which is the address to use unless your server was set up with a different one from that block.

If you paste a range yourself (anything with a / in it), InfraNest tells you which single address to use instead. A DNS record can only point at one address.

#Checks before you save

InfraNest checks a few things that would otherwise go wrong quietly, and explains them beside the field:

• a CNAME sharing a name with any other record, which is not allowed and behaves differently at every provider;
• a second SPF record on one name — two of them cancel out, and mail providers stop checking altogether;
• an IP range, a port or a web address typed where a single IP address belongs.

You can save through a caution shown in yellow; the ones in red are records that could not work.

#A record that is already there

If the record you are adding is already in the zone, InfraNest says so instead of sending it to your provider and passing the provider's refusal back to you. There are two versions of it:

• It is already here. The zone already has a record of this type and name with exactly this value, so adding it again would change nothing. Use Open the existing record if you meant to edit it — to change where it points, or how long it is cached.
• The name is taken. A name can only carry one CNAME (the same goes for ALIAS and DNAME), so a second one would contradict the first. Edit that record instead opens the record that is already there and keeps the target you just typed, so one save finishes the job.
• Your provider has it, we do not. Sometimes a record was added at the provider directly and has not reached this list yet. The provider refuses the new one, and InfraNest says so and offers Sync this zone — that pulls the record in, and you can edit it here like any other.

This is only about records that genuinely clash. Several A records on one name is a normal way to spread traffic across servers, and several MX records is how mail is set up — neither is treated as a duplicate.

#After you save

A panel above the records says what the record now points to — "www.example.com now points to web-02" — and shows your change reaching the internet: one row for your provider's nameservers, then one for each big public resolver, each with New address or Old address, for up to N more minutes. If a monitor watches the name, its first check after the change shows there too, with whether the certificate is valid. Undo change is right there if the change was a mistake. See My DNS change isn't showing up yet for what each line means.

#TTL — how long a record is cached

The TTL column says how long resolvers may keep a copy of the record before asking again — "5 min", "1 hour" and so on. Hover over it to see the exact number of seconds.

Auto means the provider decides. Cloudflare uses Auto for every proxied record (and lets you pick it for others); it works out to about 5 minutes. A proxied record always shows Auto, and saving it keeps it that way.

#Keep a zone up to date

1. Sync this zone — in the zone's Actions menu: pull the latest records from the provider at any time (it also runs on its own, about once an hour).
2. Copy from a connected account — clone another zone's records into this one.
3. Re-scan DNS — import records by reading the zone's live DNS.

#Drift

If records are changed at the provider outside InfraNest, the next sync picks them up and the zone's History tab says so ("Records were changed outside InfraNest"). On plans with DNS drift alerts you are also told, so a surprise change never goes unnoticed. The alert goes to your alert destinations, so it needs at least one — the tip on the DNS page takes you there. To pick a change up straight away, select Sync this zone.

A change that you saved but the internet doesn't show yet is covered in My DNS change isn't showing up yet.

#Point a name at your home or office

For A and AAAA records the editor asks one question: Points to. Type an address, or pick one from the list:

• Your servers — your servers' fixed addresses. The record stays exactly as you set it.
• Home and office connections — a connection whose address changes, such as your home internet. The record follows it: it shows as a chip like Office · now 198.51.100.20 · follows every change, and is rewritten whenever the address changes.
• New home or office connection — name it (for example Office) and save. The next screen shows you how to connect your router, or a computer on that network, so its address reaches us.

When the record follows a connection, its time to live is set to 5 minutes, so a new address reaches your visitors within minutes. If the connection also has an IPv6 address you can tick Also keep an AAAA record, and on a zone that can proxy you're offered to hide your home address behind the proxy.

To stop following, select × on the chip. The record keeps the address it has now, as a fixed value.

If you type an address the editor knows, it tells you:

• A connection's current address — it offers to follow that connection instead, because the address will change.
• One of your servers — it names the server.
• An address one of your servers no longer has — it won't save it. Your provider can give that address to someone else, and the record would send your visitors to their machine.

Linking a record to a connection needs permission to change monitoring. Without it you still see your connections, greyed out, with who to ask.

#Tips

TipBefore moving an address on a record cached for more than an hour, select Lower TTL now a day ahead. Come back the next day to make the real change — by then it takes minutes to reach everyone instead of hours.