DNS A Record (Address Record)
Detailed technical specification, security configuration analysis, threat modeling, and defensive whitelists.
Asset Risk Analysis Context
DNS records govern critical mapping parameters. Stale or misconfigured records are swept continuously by external threat monitors and passive asset enumerators.
Scan Your DNS Zone NowWhat is a DNS A Record?
The Address (A) record is the most fundamental resource record in the Domain Name System (DNS). It maps a host name to a 32-bit IPv4 address. When you type a domain (such as example.com) into your browser, the resolver queries the authoritative name servers to find the A record, allowing the client to establish a TCP/IP connection to the server's IP address.
How the A Record Pipeline Works
When an A record is queried:
1. User Request: The client browser requests the IP for the hostname.
2. Recursive Resolver: Checks its cache. If expired or not present, it queries the Root Server.
3. Root and TLD Server: Refers the resolver to the authoritative name server for the target domain.
4. Authoritative Server: Returns the IPv4 address configured in the A record alongside the Time-To-Live (TTL) value.
Cybersecurity Risks of Misconfigured A Records
DNS A records are major targets for threat actors seeking to hijack traffic or profile infrastructure:
- DNS Spoofing & Cache Poisoning: If the authoritative nameservers do not enforce DNSSEC, attackers can forge A records to redirect traffic to phishing pages.
- Orphaned IPs & Subdomain Takeovers: If an A record points to a decommissioned server IP that is subsequently reassigned to another hosting customer, that customer can hijack the subdomain's traffic.
- Asset Discovery Mapping: Passive scanners and threat actors harvest A records across subdomains to map out the external attack surface of an enterprise.
Defensive Mitigation & Configuration Best Practices
- Enforce DNSSEC: Cryptographically sign your DNS zones to guarantee that the resolver receives authentic A record data.
- Regular IP Inventory Checks: Audit your A records to ensure none point to expired or unallocated hosting services.
- Optimal TTL Settings: Configure appropriate TTL values. Use shorter TTLs (e.g., 300 seconds) for dynamic services to allow quick IP rotation in the event of a server breach.
Frequently Asked Questions
What does an A record do?
It maps a domain or subdomain hostname to its corresponding IPv4 address.
Can a domain have multiple A records?
Yes. Configuring multiple A records for a single host is a common load balancing technique known as Round Robin DNS.
What is the difference between an A record and a AAAA record?
An A record maps to an IPv4 address, while a AAAA record maps to an IPv6 address.
How long does it take for an A record change to propagate?
Propagation time is governed by the Time-To-Live (TTL) of the previous record, typically ranging from a few minutes to 24 hours.
Can an A record point to another domain name?
No. An A record must point to a raw IP address. To point to another domain name, you must use a CNAME record.