DNS Record Types — Complete Reference

The A Record is the most fundamental DNS record type. It maps a domain name to an IPv4 address.

Structure

Hostname       TTL     Class   Type  Value
example.com.   3600    IN      A     93.184.216.34

Common Use Cases

• Web server: example.com → 93.184.216.34
• Subdomains: api.example.com → 10.0.1.50
• Load balancing: Multiple A records for the same domain (Round Robin DNS)

Examples

; Main domain pointing to web server
example.com.       3600  IN  A  93.184.216.34

; Subdomains for different services
www.example.com.   3600  IN  A  93.184.216.34
api.example.com.   300   IN  A  10.0.1.50
mail.example.com.  3600  IN  A  10.0.1.100

; Round Robin load balancing
cdn.example.com.   60    IN  A  203.0.113.10
cdn.example.com.   60    IN  A  203.0.113.11
cdn.example.com.   60    IN  A  203.0.113.12

Important Notes

• A records always point to an IPv4 address (4 bytes, e.g. 192.168.1.1)
• For IPv6, use an AAAA record instead
• At the domain apex (e.g. example.com without subdomain), you cannot use a CNAME — an A record is required here
• Multiple A records for the same hostname enable simple load balancing

Diagnostics

dig example.com A
nslookup example.com
host example.com

The AAAA record (pronounced "Quad-A") is the IPv6 counterpart of the A record. It maps a domain name to an IPv6 address.

Structure

Hostname       TTL     Class   Type   Value
example.com.   3600    IN      AAAA   2606:2800:220:1:248:1893:25c8:1946

Why IPv6?

IPv4 has only about 4.3 billion addresses — practically exhausted since 2011. IPv6 provides 340 sextillion (3.4 × 10³⁸) addresses. In many regions (especially Asia), IPv6 is already the primary address family.

Best Practices

• Dual-stack recommended: Set both A and AAAA records for maximum reachability
• Test your IPv6 connectivity: test-ipv6.com
• Many CDNs and cloud providers offer automatic IPv6 support

Diagnostics

dig example.com AAAA
dig +short example.com AAAA
host -t AAAA example.com

A CNAME record creates an alias for another domain name. Instead of pointing directly to an IP, it refers to another DNS name, which is then resolved in turn.

How CNAME Works

When a client resolves www.example.com:

1. DNS resolver finds the CNAME: www.example.com → example.com
2. Resolver then resolves example.com and finds the A record: 93.184.216.34
3. Client receives the IP 93.184.216.34

Common Use Cases

• www subdomain: www.example.com → example.com
• CDN integration: cdn.example.com → d1234.cloudfront.net
• SaaS services: shop.example.com → shops.myshopify.com

⚠️ Important Restrictions

Rule	Explanation
No CNAME at apex	The domain apex (example.com) must NOT have a CNAME per RFC 1034. An A/AAAA record is required. Some providers offer "ALIAS" or "ANAME" records as a workaround.
No other records	Where a CNAME exists, no other record types (A, MX, TXT etc.) may exist for the same hostname.
Avoid chains	CNAME chains (CNAME → CNAME → CNAME) are technically possible but strongly discouraged — they slow down resolution and are error-prone.

Diagnostics

dig www.example.com CNAME
dig +trace www.example.com

The MX record determines which mail servers are responsible for receiving email for a domain. Without correct MX records, your domain cannot receive emails.

Priority (Preference)

The priority number determines the order in which mail servers are contacted:

• Lower number = higher priority
• The sending server tries the server with the lowest priority number first
• If unreachable, the next higher is tried
• Equal priority → Round Robin (random selection)

Example: Google Workspace

example.com.  3600  IN  MX  1   aspmx.l.google.com.
example.com.  3600  IN  MX  5   alt1.aspmx.l.google.com.
example.com.  3600  IN  MX  5   alt2.aspmx.l.google.com.
example.com.  3600  IN  MX  10  alt3.aspmx.l.google.com.
example.com.  3600  IN  MX  10  alt4.aspmx.l.google.com.

Example: Microsoft 365

example.com.  3600  IN  MX  0   example-com.mail.protection.outlook.com.

Important Notes

• MX records always point to a hostname, never directly to an IP address
• The target hostname must not be a CNAME (RFC 2181)
• Ensure the target host has an A/AAAA record and a correct PTR record (Reverse DNS)
• For email authentication, additionally configure SPF, DKIM and DMARC records

Null MX Record (RFC 7505)

If your domain explicitly should NOT receive emails:

example.com.  3600  IN  MX  0  .

This signals to sending mail servers that the domain does not support mail reception.

Diagnostics

dig example.com MX
nslookup -type=mx example.com

The TXT record is a versatile record type that can store arbitrary text. Originally intended for human-readable notes, it is now the most important record for email security, domain verification and various other applications.

Key Applications

1. SPF (Sender Policy Framework)

example.com.  3600  IN  TXT  "v=spf1 include:_spf.google.com include:sendgrid.net -all"

Defines which servers are allowed to send emails on behalf of your domain.

2. DKIM (DomainKeys Identified Mail)

google._domainkey.example.com.  3600  IN  TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCS..."

Contains the public key for verifying email signatures.

3. DMARC (Domain-based Message Authentication)

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

Defines the DMARC policy for your domain.

4. Domain Verification

; Google Search Console
example.com.  3600  IN  TXT  "google-site-verification=abc123..."

; Microsoft 365
example.com.  3600  IN  TXT  "MS=ms12345678"

Technical Limits

• Max 255 characters per string: Longer values must be split into multiple strings that are then concatenated: "Part1" "Part2"
• Multiple TXT records possible: Multiple TXT records can exist per hostname

Diagnostics

dig example.com TXT
dig _dmarc.example.com TXT

The SOA record defines basic administrative information about a DNS zone. Every DNS zone has exactly one SOA record. It is the first record in every zone file.

Structure

example.com. 86400 IN SOA ns1.example.com. admin.example.com. (
    2025022701 ; Serial Number (YYYYMMDDNN)
    3600       ; Refresh (1 hour)
    900        ; Retry (15 minutes)
    1209600    ; Expire (14 days)
    86400      ; Minimum TTL / Negative Caching TTL (24 hours)
)

Fields in Detail

Field	Description	Recommendation
MNAME	Primary nameserver of the zone	ns1.example.com.
RNAME	Email of the zone administrator (@ replaced by .)	admin.example.com. = admin@example.com
Serial	Version number — must be incremented with every change	Format YYYYMMDDNN
Refresh	Interval at which secondary servers check the primary for changes	3600–7200 (1–2 hours)
Retry	Wait time after a failed refresh	900–3600
Expire	After this time, secondaries discard the zone if no refresh was possible	604800–1209600 (7–14 days)
Minimum TTL	How long negative responses (NXDOMAIN) are cached	3600–86400

Diagnostics

dig example.com SOA
dig +short example.com SOA

The PTR record is the opposite of an A record: it maps an IP address to a hostname. This is called Reverse DNS (rDNS). PTR records are essential for email deliverability.

Why Reverse DNS is Essential for Email

Most mail servers perform a Forward Confirmed Reverse DNS (FCrDNS) check when receiving an email:

1. Sender's IP → PTR lookup → yields hostname
2. Hostname → A record lookup → yields IP
3. Check: Does the resolved IP match the original IP?

If this check fails, the email is often marked as spam or rejected. Major providers like Google, Microsoft and Yahoo reject emails without a correct PTR.

Who Sets PTR Records?

PTR records are not set in your regular DNS zone, but by the owner of the IP address block — usually your hosting provider or ISP.

Best Practices for Email

• The PTR should point to the HELO/EHLO hostname of your mail server
• Forward and reverse must match (FCrDNS)
• Use descriptive hostnames (not ip-93-184-216-34.example.com)

Diagnostics

dig -x 93.184.216.34
nslookup 93.184.216.34
host 93.184.216.34

The NS record specifies which DNS servers are authoritative for a domain — meaning they are the official source of DNS information for that domain.

Best Practices

• At least 2 NS servers — for redundancy (RFC recommends at least 2, typical is 2–4)
• Geographically distributed — different networks/locations for fault tolerance
• Different networks — not all NS in the same /24 subnet
• High TTL — 86400 (24h) or higher, since NS changes are rare

Glue Records

When your nameservers are within your own domain (e.g. ns1.example.com for example.com), a chicken-and-egg problem arises. Glue records solve this — they are A records stored directly in the parent zone.

Diagnostics

dig example.com NS
dig +trace example.com NS
whois example.com | grep -i "name server"

The SRV record allows defining the location (hostname and port) of a specific service. It is used for VoIP (SIP), messaging (XMPP), directory services (LDAP) and Microsoft services.

Structure

_service._proto.name.  TTL  IN  SRV  Priority  Weight  Port  Target
_sip._tcp.example.com.    3600  IN  SRV  10  60  5060  sipserver.example.com.

Fields

Field	Description
_service	Service name (e.g. _sip, _xmpp-client, _ldap)
_proto	Transport protocol (_tcp or _udp)
Priority	Like MX: lower value = preferred
Weight	Load distribution at equal priority (higher = more traffic)
Port	TCP/UDP port of the service
Target	Hostname of the server (must have A/AAAA record)

Diagnostics

dig _sip._tcp.example.com SRV
dig _sipfederationtls._tcp.example.com SRV

The CAA record defines which Certificate Authorities (CAs) are allowed to issue SSL/TLS certificates for your domain. Since September 2017, all CAs must check CAA records before issuing a certificate.

Tags

Tag	Description
issue	Which CA may issue certificates for this domain
issuewild	Which CA may issue wildcard certificates (*.example.com)
iodef	Email or URL for notifications on policy violations

Examples

; Only Let's Encrypt may issue certificates
example.com.  3600  IN  CAA  0  issue  "letsencrypt.org"
example.com.  3600  IN  CAA  0  issuewild  ";"  ; No wildcard certificates

; With notification
example.com.  3600  IN  CAA  0  iodef  "mailto:security@example.com"

Diagnostics

dig example.com CAA

DS & DNSKEY Records (DNSSEC)

DS (Delegation Signer) and DNSKEY records form the foundation of DNSSEC — the system for cryptographically securing DNS responses. See the dedicated DNSSEC article for details.

HTTPS / SVCB Record (RFC 9460, 2023)

New record type for modern HTTP services. Enables communicating ALPN protocols, ECH keys, and alternative endpoints in a single DNS lookup.

example.com.  IN  HTTPS  1  .  alpn="h3,h2" ech="MIGf..."

Benefits: Faster connection setup, fewer round-trips, Encrypted Client Hello (ECH) support.

TLSA Record (DANE)

Enables certificate validation via DNS. Alternative to or complement of traditional CAs.

_443._tcp.example.com.  IN  TLSA  3  1  1  2b4c342f...

Record Type Overview

Type	RFC	Purpose	Frequency
A	1035	IPv4 address	⭐⭐⭐⭐⭐
AAAA	3596	IPv6 address	⭐⭐⭐⭐
CNAME	1034	Alias	⭐⭐⭐⭐⭐
MX	1035	Mail server	⭐⭐⭐⭐⭐
NS	1035	Nameserver	⭐⭐⭐⭐⭐
TXT	1035	Text / verification	⭐⭐⭐⭐⭐
SOA	1035	Zone administration	⭐⭐⭐⭐⭐
PTR	1035	Reverse DNS	⭐⭐⭐⭐
SRV	2782	Service locator	⭐⭐⭐
CAA	8659	Certificate authorization	⭐⭐⭐
DS/DNSKEY	4034	DNSSEC	⭐⭐⭐
HTTPS	9460	HTTP Service Binding	⭐⭐ (rising)