A
is for resolution of domain name to IP address.
MX
is not really needed but it is a good practice to say that mails sent to your domain should be delivered to the host specified in MX record. This normally defaults to the same domain anyway.
SRV
records are not really needed, Delta Chat does not use them as they are not secure.
CAA
record prevents someone who gets control over your port 80 but not the keys (e.g. via a vulnerability in nginx after dropping privileges or MITM at your hoster) from issuing a new TLS certificate via Let’s Encrypt or other CA. It is not strictly necessary, but adds some security.
SPF TXT record is for compatibility with receiving hosts that don’t support DKIM. It is a legacy email authentication mechanism.
DMARC is basically useless, but some providers like Google care that it exists, no matter the contents. Could be “v=DMARC1;p=none” and they are still happy, this is what they use themselves, you can check _dmarc.gmail.com.
and similar providers. This is just to maybe increase deliverability to such providers.
MTA-STS records are to say that your host uses TLS for message delivery and other hosts should use TLS too. It actually increases security, better have it.
www
domain is just for redirect to primary domain in case someone types www
in front of domain, not really needed. When we did not have it, we got some reports of people adding www
to URL and thinking the server is down.
opendkim
record is a “DKIM selector”, chatmail servers use “opendkim” in DKIM signatures to point to this key. DNS record contains the public key that chatmail servers sign messages with. DKIM is absolutely necessary if you want your mails to be accepted by chatmail servers, it is the only authentacation mechanism chatmail cares about.
_adsp
is a historic standard RFC 5617: DomainKeys Identified Mail (DKIM) Author Domain Signing Practices (ADSP), this record says that any mails from us not signed with DKIM should go to trash. Probably nobody looks into this record. Officially this standard was superseded by DMARC. This is likely never resolved by anyone.