DNS record types

Addressing and delegation

The records that answer “where does this name point” and “who is authoritative for this zone”. Most outages that look like application failures start here.

• AMaps a hostname to a single IPv4 address.
• AAAAMaps a hostname to a single IPv6 address.
• CNAMEAliases one name to another name, which is then resolved in its place.
• ALIAS / ANAMEProvider-specific apex alias that behaves like a CNAME but returns address records. Not standardised.
• NSNames the authoritative nameservers for a zone, and creates delegations.
• SOAMarks the start of a zone and carries its serial number, refresh timings, and negative-cache TTL.
• PTRMaps an address back to a name, using the reverse in-addr.arpa and ip6.arpa zones.

Mail and text records

Mail routing plus the three policy records that decide whether your mail is accepted. SPF, DKIM, and DMARC are all published inside TXT records, not in types of their own.

• MXNames the hosts that accept mail for a domain, in preference order.
• TXTCarries arbitrary text strings, and is the substrate for most domain policy records.
• SPFLists the hosts allowed to send mail using a domain in the SMTP envelope sender.
• DKIMPublishes the public key that verifies a domain's cryptographic signature on outbound mail.
• DMARCTells receivers what to do when a message fails aligned SPF and DKIM, and where to send reports.

TLS, DNSSEC, and certificate policy

Records that constrain who may issue certificates for a name and that carry the DNSSEC chain of trust from parent to child zone.

• CAADeclares which certificate authorities are allowed to issue certificates for a domain.
• DSPublished in the parent zone, fingerprints a child zone's key and links the DNSSEC chain of trust.
• DNSKEYPublishes the public keys a resolver uses to verify a zone's DNSSEC signatures.
• TLSABinds a certificate or public key to a hostname and port, so DNSSEC can authenticate TLS.
• NSECAuthenticates DNSSEC denial of existence by naming the next owner name and listing the types present at the current name.
• NSEC3Provides DNSSEC denial of existence using hashed owner names, reducing direct disclosure of the zone's names while preserving authenticated proofs.
• NSEC3PARAMPublishes the NSEC3 hashing parameters a validating resolver needs when interpreting an NSEC3-signed zone.

Service discovery

Records that publish which host, port, protocol, and connection parameters a client should use for a named service.

• SRVPublishes the host and port of a named service, with priority and weight for selection.
• NAPTRRewrites a name into a URI or another lookup key, using the DDDS regular-expression algorithm.
• SVCBGeneric service binding record: an alias, or an endpoint plus connection parameters, in one lookup.
• HTTPSService binding record for HTTPS origins: advertises HTTP/3, ECH keys, and address hints.

Other record types

• CDNSKEYPublishes the child DNSKEY set that a parent can use to derive and maintain the delegation's DS records.
• CDSPublishes the child zone's requested DS set so a parent or registrar can automate DNSSEC delegation maintenance.
• CSYNCSignals that a child zone's parent may synchronize selected NS, A, and AAAA delegation data from the child.
• DHCIDStores a DHCP client identifier in DNS so an automated update service can identify the client that owns a name.
• ISOIANA-assigned DNS record type for data coded according to an International Organization for Standardization specification.
• OPENPGPKEYPublishes an OpenPGP public key for an email address at a DNS-derived owner name for automated key discovery.
• SMIMEAAssociates an email address with a certificate or public-key hash so S/MIME clients can discover and authenticate the intended key.
• SSHFPPublishes an SSH host-key fingerprint in DNS so a client can compare the key it receives with an authenticated DNS answer.
• UNECEIANA-assigned DNS record type for data coded according to a United Nations Economic Commission for Europe recommendation.
• URIPublishes a service URI, optionally with priority and weight, so a client can discover an endpoint without a fixed hostname or port.
• ZONEMDPublishes a digest of a DNS zone so a validator can detect unauthorized or incomplete zone transfers.