What does an AAAA record do for IPv6 website resolution?
An AAAA record publishes a hostname's IPv6 address. Resolvers return it for IPv6 queries, and networks that prefer IPv6 use it. IPv4 visitors still need an A record. Publishing an address where nothing listens makes some people fail while others still arrive over IPv4. Add the row only for an address the web server actually uses.
www.example.com. 3600 IN AAAA 2001:db8::1The address 2001:db8::1 is a documentation example, not a WebJi address. How IPv4 and IPv6 differ, including why a site can need both an A row and an AAAA row, is covered in IPv4 compared with IPv6.
How does a DNS CAA record restrict which Certificate Authority can issue SSL for your domain?
CAA tells certificate authorities which of them may issue. issue is for normal certificates, issuewild for wildcards, and iodef is a report contact, not an issuer. With no CAA record, authorities may generally still issue. If your authority is not listed, issuance should fail. The record neither installs nor renews a certificate.
example.com. IN CAA 0 issue "letsencrypt.org"| Tag | What it controls | Easy mistake |
|---|---|---|
| issue | Which authority may issue a non-wildcard certificate | Listing a brand name that does not match the issuer's CAA value |
| issuewild | Which authority may issue a wildcard | Assuming a normal issue tag also covers the wildcard |
| iodef | Where violation reports can be sent | Treating it as permission to issue |
A value of issue ";" means you are telling issuers that none of them may issue. Use that only when you mean it. Ordering and installing the certificate is a separate step, described on SSL certificates.
What zone serial and refresh timers are stored inside an SOA record?
Each zone has one SOA, the start of authority. It names the primary nameserver and a mailbox, then a serial and four timers. If your serial is higher, secondaries pull a new copy on that timer schedule. Write the mailbox with a dot, not @. Raise the serial when the zone changes, or others keep the old copy.
| Field | What it stores |
|---|---|
| Primary nameserver | The host secondaries treat as the source of the zone |
| Responsible mailbox | An email address, with @ written as a dot |
| Serial | A version number that must go up when records change |
| Refresh | How often a secondary checks whether the serial changed |
| Retry | How long a secondary waits after a failed refresh |
| Expire | How long a secondary may serve the zone if the primary stays silent |
| Minimum | On modern DNS, how long a resolver may cache a "name does not exist" answer |
example.com. 3600 IN SOA ns1.example.com. hostmaster.example.com. 2026110501 7200 1800 1209600 300Those timers are an illustration of the field order: serial, refresh, retry, expire, minimum. They are not a required WebJi setting. hostmaster.example.com. stands for hostmaster@example.com.
When do you need to edit AAAA, CAA, or SOA records on a web hosting server?
Edit AAAA only when the host's IPv6 address actually serves the site. Edit CAA before a certificate order if you want to limit the issuer, and again when you change issuer. Leave SOA alone on shared DNS unless you run the authoritative server. Let the software raise the serial. Hand-edited timers can leave secondaries stale or expired.
- Confirm you are editing the zone the live nameservers publish.
- Add AAAA only for a hostname that answers on that IPv6 address.
- Add CAA for the authority that will issue, using that issuer's own CAA name.
- After any change, query the name and check that the serial increased if you run secondaries.
A public check belongs in the DNS lookup tool. Look up AAAA, CAA, or SOA on purpose. A default A lookup will not show these rows.