Skip to content
Control Plane Labs
Search

RESINFO record

Publishes resolver capabilities as key/value attributes so DNS clients can make informed resolver-selection decisions.

Written and maintained by Ben Ennis

Last reviewed July 27, 2026 · How we verify this

Zone-file example

resolver.example.net. 7200 IN RESINFO qnamemin exterr=15-17 infourl=https://resolver.example.net/guide

Typical uses

  • Advertising QNAME minimisation support
  • Listing Extended DNS Error codes a resolver may return
  • Providing an HTTPS troubleshooting page for resolver operators
  • Helping encrypted-DNS clients compare resolver privacy and transparency properties

When it breaks, check

  • The RESINFO RRset should contain exactly one record when the resolver supports the type
  • Clients query the resolver's authentication domain with recursion disabled and expect an authoritative answer
  • Only registered keys or local-use keys beginning with temp- are valid
  • Treat an unauthenticated or inconsistent answer as untrusted resolver metadata, not as policy evidence

What the RESINFO record does

RESINFO describes the resolver rather than a zone’s application data. A client queries the resolver’s authentication domain with recursion disabled; a valid authoritative answer can then say, for example, that QNAME minimisation is enabled or that the resolver may return denied, censored, or filtered Extended DNS Errors. The record is intended for client software and resolver selection, not for an end user’s ordinary DNS browsing.

The RDATA follows TXT-style key/value conventions. Unknown keys are ignored, and the standardized keys are maintained in an IANA registry. A resolver can publish an HTTPS infourl for operator guidance, but the URL is diagnostic information and is not itself proof that the resolver behaves as described. RESINFO does not replace encrypted transport, DNSSEC validation, or a local resolver policy.

Zone-file and wire format

RESINFO uses TXT-like character strings containing space-separated attributes. A Boolean attribute is present without =, while a valued attribute uses key=value. The exterr value can contain one code, a range, or comma-separated values. An infourl value must use HTTPS. This example advertises QNAME minimisation, EDE codes 15 through 17, and a diagnostic page.

resolver.example.net. 7200 IN RESINFO qnamemin exterr=15-17 infourl=https://resolver.example.net/guide

Common uses

Resolver operators can use RESINFO to make capability discovery less ambiguous for encrypted-DNS clients, enterprise endpoint software, and troubleshooting tools. Publish it at the authentication domain used by the resolver, keep anycast instances consistent, and change the RRset when capabilities change. Clients should use the result as one input to a documented selection policy rather than treating any single attribute as a universal trust score.

Troubleshooting

If a client sees no record, query the resolver’s authentication domain directly with the Recursion Desired bit clear and inspect the Authoritative Answer flag. A recursive answer or a response from an upstream resolver does not establish that the selected resolver published the data. If exterr does not match an observed EDE, refresh the resolver connection and query RESINFO again. Validate the response through the authenticated resolver connection or local DNSSEC before showing attributes to users or using them to choose a resolver.

dig @192.0.2.53 resolver.example.net RESINFO +norecurse +noall +answer +comments

# Inspect the resolver.arpa discovery name when supported.
dig @192.0.2.53 resolver.arpa RESINFO +norecurse +noall +answer

The defining RFC

RESINFO is defined by RFC 9606, including the TXT-like key/value format, resolver query procedure, and security requirements. See the IANA DNS Resolver Information Keys registry for standardized attributes.

Reference and tooling

Every record type and its assigned numeric value is listed in theIANA DNS Parameters registry. To query a live zone from the browser, use theDNS lookup tool. If the record you are chasing is TLS-related, the TLS inspector andCertificate Transparency lookup are usually the next two stops.

Other record types