DNS record types
One page per record type: what it is for, the zone-file and wire format with a real example, what it is normally used for, how to troubleshoot it, and the RFC that defines it. Type numbers come from theIANA DNS Parameters registry.
To query a live zone, use the DNS lookup tool.
Addressing and delegation
The records that answer “where does this name point” and “who is authoritative for this zone”. Most outages that look like application failures start here.
- AMaps a hostname to a single IPv4 address.
- AAAAMaps a hostname to a single IPv6 address.
- CNAMEAliases one name to another name, which is then resolved in its place.
- ALIAS / ANAMEProvider-specific apex alias that behaves like a CNAME but returns address records. Not standardised.
- NSNames the authoritative nameservers for a zone, and creates delegations.
- SOAMarks the start of a zone and carries its serial number, refresh timings, and negative-cache TTL.
- PTRMaps an address back to a name, using the reverse in-addr.arpa and ip6.arpa zones.
Mail and text records
Mail routing plus the three policy records that decide whether your mail is accepted. SPF, DKIM, and DMARC are all published inside TXT records, not in types of their own.
- MXNames the hosts that accept mail for a domain, in preference order.
- TXTCarries arbitrary text strings, and is the substrate for most domain policy records.
- SPFLists the hosts allowed to send mail using a domain in the SMTP envelope sender.
- DKIMPublishes the public key that verifies a domain's cryptographic signature on outbound mail.
- DMARCTells receivers what to do when a message fails aligned SPF and DKIM, and where to send reports.
TLS, DNSSEC, and certificate policy
Records that constrain who may issue certificates for a name and that carry the DNSSEC chain of trust from parent to child zone.
- CAADeclares which certificate authorities are allowed to issue certificates for a domain.
- DSPublished in the parent zone, fingerprints a child zone's key and links the DNSSEC chain of trust.
- DNSKEYPublishes the public keys a resolver uses to verify a zone's DNSSEC signatures.
- TLSABinds a certificate or public key to a hostname and port, so DNSSEC can authenticate TLS.
Service discovery
Records that publish which host, port, protocol, and connection parameters a client should use for a named service.
- SRVPublishes the host and port of a named service, with priority and weight for selection.
- NAPTRRewrites a name into a URI or another lookup key, using the DDDS regular-expression algorithm.
- SVCBGeneric service binding record: an alias, or an endpoint plus connection parameters, in one lookup.
- HTTPSService binding record for HTTPS origins: advertises HTTP/3, ECH keys, and address hints.
Related: HTTP status code reference ·DNS lookup ·TLS inspector ·Certificate Transparency lookup