At minimum, A/AAAA records that point the domain to the host serving HTTPS. For GitHub Pages, CNAME is enough for the www host. For CloudFront or S3, follow the provider instructions; many use ALIAS/ANAME at apex or CNAME at subdomain.

These are provider-specific pseudo-records that let the apex behave like a CNAME while staying RFC-compliant. Use them when you need apex to point to a hostname, for example `example.com -> myapp.example.com` or CloudFront endpoint.

Use `dig`, `nslookup`, or `host` to check A, AAAA, CNAME, and NS records. Compare the result with what your registrar or DNS provider UI shows. Propagation usually completes within minutes for TTL=60 but can take hours for cached resolvers.

Often yes. ACME HTTP-01 requires a public HTTP path visible at the domain; DNS-01 requires TXT records for validation. Verify the exact validation domain, check for conflicting redirects, and ensure the validator can reach the record.

Yes. Lower TTL to 60–300 seconds before record changes. After the change stabilizes, raise TTL again for better performance. This reduces stale cache windows during migrations or cert rollovers.