DNS and HTTPS: Connecting Your Website, Email and CDN
Explain the purpose of A, CNAME, MX, TXT, NS and other records, and explain the correct methods for HTTPS, mail verification, CDN, resolution, and migration switching.
Website address
Point the domain name to the IPv4 server address.
Alias and CDN
Point the subdomain to another domain name or service address.
Enterprise mailbox
Configure the receiving server and SPF, DKIM, DMARC verification.
Encrypted access
The certificate, domain name, and server configuration must match each other.
DNS is the basic configuration used by websites, mailboxes, and third-party services.Backing up records before modification, reducing TTL, and verifying in stages can reduce interruptions more than blindly and repeatedly modifying.
Quick check of common DNS records
The same domain name can have a website, mailbox, and verification records at the same time, and cannot keep only one A record.
| Record | Main purpose | Common examples | Precautions |
|---|---|---|---|
| A / AAAA | Point to the IPv4/IPv6 server | @ → 203.0.113.10 | Need to be updated after the server is replaced; pay attention to the proxy/CDN status |
| CNAME | Set an alias for the subdomain | www → example.com | Usually cannot coexist with other records of the same name |
| MX | Specify the mail receiving server | @ → mail.example.com | The smaller the priority value, the more priority is usually given |
| TXT | Domain name verification and email security | SPF、DKIM、DMARC | Multiple SPFS cannot be simply added repeatedly |
| NS | Designated authoritative DNS service provider | ns1.provider.com | Switching NS is equivalent to switching the complete set of resolution management |
| CAA | Restrict the institutions that can issue certificates | letsencrypt.org | Incorrect configuration may cause the certificate to fail to be issued |
1. First confirm who manages the DNS
Domain name registrars and DNS service providers can be different.Viewing the current NS record can determine the analysis platform that is really in effect.Don't modify records on the wrong platform, and don't switch NS directly when there is no backup.
- Record the current NS service provider
- Export or screenshot all analysis records
- Confirm website, mailbox, verification and CDN dependencies
- Prepare the account administrator that can be contacted
2. How to configure the root domain name and www
The common solution is that the root domain name uses A record to point to the server, and www uses CNAME to point to the root domain name or CDN.Only one main address is retained inside the website, and the other jumps through 301 to avoid duplicate content and confusion in login status.
- Determine the form of the main domain name
- The certificate covers two addresses at the same time
- The WordPress address is consistent with the jump
- The site map only outputs the main address
3. Why the resolution will not take effect immediately
DNS records will be cached by the network at all levels, and TTL determines the cache time.The TTL can be reduced in advance before modification, and then restored after the switch is completed and stabilized.Repeated modifications will make troubleshooting more difficult.
- Distinguish between local cache and authoritative records
- Use multiple networks and public DNS to check
- Don't just use the browser to refresh the judgment
- Record the time and content of each modification
4. HTTPS certificate and redirect
The domain name needs to be correctly pointed to the verification environment before the certificate is issued.After the certificate takes effect, configure the HTTP to HTTPS, www unified and application layer addresses to avoid the redirect loop.
- The certificate covers the root domain name and www
- Check the automatic renewal task
- CDN is consistent with the source station certificate mode
- Processing mixed content of pictures and scripts
5. Corporate mailboxes cannot delete MX and TXT by mistake
When migrating a website, only modify the relevant records of the website.MX, SPF, DKIM, DMARC, and mailbox verification TXT belong to the mail system. Accidental deletion will cause the receipt to fail or the mail to enter the trash can.
- Backup mail records before migration
- SPF keep one and merge authorized sources
- DKIM is configured according to the value provided by the mail platform
- DMARC first observe and then gradually tighten the strategy
6. The relationship between CDN, proxy, and source station
After CDN is enabled, the public DNS may point to the CDN instead of the source station IP.Troubleshooting requires checking domain name resolution, CDN status, source station certificate, and source station firewall separately.
- Save the real address of the source station
- Restrict the source station to only allow trusted access and leave the management entrance
- Cache refresh and DNS take effect are two things
- Payment and background paths bypass the cache as needed
7. How to reduce interruptions in server migration
Copy the website and database before migration, and complete the test at the temporary address; reduce the TTL in advance; keep the old server for a period of time after switching resolution, and check forms, orders, emails, and third-party callbacks.
- Test before switching
- Pause high-risk writing before switching
- Short-term parallel between old and new servers
- Confirm that the logs and data are not missing
online and delivery checklist
The following items should have clear results or records, not just the verbal description of “already configured”.
Frequently asked questions
What Is the Difference Between an A Record and a CNAME?
An A record points directly to an IP address, while a CNAME points to another hostname. Root domains commonly use A records; www and service subdomains commonly use CNAME records.
How long will the DNS modification take effect?
It may be a few minutes, or it may be close to the original TTL cache time.NS switching usually has a wider impact than single record modification.
The website is normal but the mailbox cannot receive letters. What should I check first?
Check whether MX exists and the target value is correct, and then check SPF/DKIM/DMARC and mail service status.
Why is the certificate reporting an error after the CDN is turned on?
The common reason is that the CDN certificate, the origin certificate, and the encryption mode do not match, or the DNS still points to the old service.
