Cybersecurity glossary
What is an A Record?
Learn what a DNS A record is, how it maps hostnames to IPv4 addresses, how TTL and multiple answers work, and which security mistakes leave A records exposed.
Definition
An A record (Address record) is a DNS resource record that maps a domain name or hostname to one or more IPv4 addresses so clients know which host to contact.
Why A records matter
Almost every IPv4 connection that starts with a hostname depends on an A record. Browsers, APIs, mail relays that fall back to host addresses, monitoring probes, and certificate issuance workflows all need a correct mapping from name to IPv4 address.
If the A answer is wrong, users reach the wrong place. If it is missing, the service looks offline even when servers are healthy. If it is stale after cloud resources are deleted, attackers may claim the abandoned target.
What an A record contains
An A record is a typed DNS answer: a name, a TTL, the type A, and a 32-bit IPv4 address. Authoritative servers publish these answers inside a zone. Recursive resolvers cache them and return them to clients.
Owner name
The hostname being queried, such as www.example.com or the zone apex example.com.
IPv4 address
A dotted-quad address like 203.0.113.10 that identifies the reachable host or load balancer.
TTL
How long resolvers may reuse the answer before asking authoritative servers again.
Class and type
Almost always Internet (IN) class with record type A, distinct from AAAA, CNAME, or MX.
How clients use A records
Application asks for a name
A browser or service requests address data for a hostname before opening a connection.
Resolver looks up type A
The recursive resolver queries for A (and often AAAA in parallel on dual-stack networks).
Authoritative zone answers
Name servers for the zone return one or more A records for that owner name.
Client selects an address
The stub resolver or application picks an IPv4 target from the answer set.
Connection begins
TCP/TLS or UDP traffic goes to that IP; HTTP Host headers and SNI still carry the original name.
Cache honors TTL
Later lookups may reuse the same A answer until the TTL expires.
A vs AAAA vs CNAME
Teams often confuse address records with aliases. The distinction drives cutovers, CDN onboarding, and apex configuration.
| Record | Maps the name to | Typical use |
|---|---|---|
| A | One or more IPv4 addresses | Direct host, VIP, or load-balancer addressing on IPv4 |
| AAAA | One or more IPv6 addresses | Same role for IPv6 dual-stack services |
| CNAME | Another hostname | Alias www or vendor endpoints without embedding IPs |
Operational patterns that work
Publishing A records looks simple, but production setups need discipline.
- Inventory every hostname that publishes A answers and which system owns the destination IP.
- Prefer stable load-balancer or anycast front ends over frequently changing instance IPs when possible.
- Lower TTL before planned migrations; raise it again after cutover stability is confirmed.
- Publish AAAA alongside A when the service is dual-stack so IPv6 clients are not forced through translation paths.
- Avoid leaving A records pointed at decommissioned cloud IPs, shared hosting, or unused CDN hostnames.
- Monitor resolution from multiple networks so unexpected A changes are caught quickly.
- Protect DNS control-plane access: a hijacked A record redirects traffic without touching application servers.
- Document whether multiple A records are intentional round-robin or accidental duplicates.
Security risks tied to A records
An A record is not malware, but it is a high-value lever.
Attackers who can change authoritative answers—or poison caches—can send users to phishing sites that still show the expected hostname in the address bar until certificate checks fail. Even without hijacking, dangling A records that point at released cloud addresses create subdomain-takeover paths when another tenant claims the IP or related resource.
DNSSEC helps resolvers detect forged answers for signed zones. It does not fix operator mistakes such as publishing the wrong production IP or forgetting to remove a staging hostname.
The practical takeaway
An A record is the DNS mapping from a hostname to IPv4. It is one of the most common and most consequential record types because applications trust it to choose where traffic goes.
Treat A answers as inventory: know the owner, watch for unexpected changes, retire stale targets, pair them with AAAA when you support IPv6, and protect the accounts that can edit them. Correct names with wrong addresses fail as completely as offline servers.
Related security terms
AAAA Record
The IPv6 counterpart that maps names to 128-bit addresses.
CNAME Record
An alias that points a name to another hostname instead of an IP.
Domain Name System (DNS)
The distributed naming system that stores and serves A records.
TTL (Time to Live)
Controls how long resolvers may cache an A answer before refreshing.
Dangling DNS Record
Stale A (or other) answers that can enable takeover when the target is gone.
Frequently asked questions
What is an A record in simple terms?
An A record tells the Internet which IPv4 address belongs to a hostname. When you type example.com, an A answer often provides the server IP your browser should contact.
Can one hostname have multiple A records?
Yes. Operators often publish several A records for basic load distribution or redundancy. Resolvers and clients may try answers in different orders depending on implementation.
What is the difference between an A record and a CNAME?
An A record maps a name directly to an IPv4 address. A CNAME maps a name to another hostname, which must then be resolved further to reach an address.
Do A records work for IPv6?
No. IPv6 addresses use AAAA records. Dual-stack hosts usually publish both A and AAAA answers for the same name.
How does TTL affect A records?
TTL tells recursive resolvers how long they may reuse a cached A answer. Lower TTLs speed cutovers; higher TTLs reduce query load and can improve resilience to short outages.
Are A records a security control?
Not by themselves. They are critical infrastructure data. Wrong, hijacked, or stale A answers can redirect traffic, enable phishing, or leave dangling targets for takeover.
Should the zone apex use an A record or a CNAME?
Many DNS setups require the zone apex (example.com) to use A/AAAA (or ALIAS/ANAME vendor features) because a CNAME at the apex conflicts with other required records like NS and SOA.
References
Explore authoritative guidance and frameworks related to a record.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.