Why can't CNAME live at the apex?

Because every zone must serve SOA and NS records at the apex, and CNAME isn't allowed to coexist with other record types at the same name. Use ALIAS / ANAME (provider-specific flattening) or HTTPS records to work around it.

What's the difference between SVCB and HTTPS?

Both are Service Binding records. `HTTPS` is the HTTPS-specific subtype browsers query automatically — it advertises HTTP/3 (`alpn=h3`), alternative ports, and Encrypted Client Hello (ECH) configuration. `SVCB` is the generic form for other protocols.

CAA is technically optional but strongly recommended — without it, any public CA may issue a cert for your domain. Adding `0 issue "letsencrypt.org"` (or whichever CA you use) restricts issuance to that authority.

DNS Record Reference

Quick reference for the DNS record types you actually meet — what each is for, gotchas (e.g. CNAMEs can't sit at the zone apex), and a concrete zone-file example. Covers the everyday set plus DNSSEC and the newer SVCB / HTTPS records used for HTTP/3 and ECH.

—

Maps a hostname to an IPv4 address. The most common record — every domain that resolves to a server has at least one.

Zone-file example

example.com.   IN  A      93.184.216.34

AAAA

Maps a hostname to an IPv6 address. Pronounced "quad-A".

Zone-file example

example.com.   IN  AAAA   2606:2800:220:1:248:1893:25c8:1946

CNAME

Aliases one hostname to another. The target must itself resolve; CNAMEs cannot coexist with other records at the same name, and cannot appear at the apex (root) of a zone.

Zone-file example

www.example.com.   IN  CNAME  example.com.

Mail exchanger — where SMTP for the domain should be delivered. Includes a priority (lower = preferred).

Zone-file example

example.com.   IN  MX  10 mail.example.com.

TXT

Arbitrary text. Used for SPF (mail anti-spoofing), DKIM keys, domain verification (Google, Facebook, etc.), and human-readable notes.

Zone-file example

example.com.   IN  TXT  "v=spf1 include:_spf.google.com ~all"

Delegates a (sub)domain to a set of authoritative name servers. Every zone has NS records at its apex.

Zone-file example

example.com.   IN  NS  ns1.example.com.

SOA

Start of Authority — administrative info for the zone: primary name server, hostmaster email, serial number, and TTLs for negative caching.

Zone-file example

example.com.   IN  SOA  ns1.example.com. hostmaster.example.com. 2025010101 7200 3600 1209600 3600

PTR

Reverse lookup — maps an IP back to a hostname. Lives under the `in-addr.arpa` (v4) or `ip6.arpa` (v6) zones.

Zone-file example

34.216.184.93.in-addr.arpa.   IN  PTR  example.com.

SRV

Locates the host and port for a named service (with priority and weight). XMPP, SIP, and Microsoft AD all use SRV.

Zone-file example

_sip._tcp.example.com.   IN  SRV  10 60 5060 sipserver.example.com.

CAA

Certification Authority Authorization — restricts which CAs may issue TLS certs for the domain. Modern CAs are required to check CAA before issuing.

Zone-file example

example.com.   IN  CAA  0 issue "letsencrypt.org"

DNSKEY

DNSSEC public key used to verify signatures in the zone. Paired with RRSIG records.

Zone-file example

example.com.   IN  DNSKEY  257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0d…

Delegation Signer — published at the parent zone to fingerprint the child zone's DNSKEY. Forms the DNSSEC chain of trust.

Zone-file example

example.com.   IN  DS  31589 13 2 3490A6806D47F17A34C29E2CE80E8A999FFBE4BE…

RRSIG

Resource Record Signature — cryptographic signature over a record set, validated against the zone's DNSKEY. Added automatically when the zone is signed.

Zone-file example

example.com.   IN  RRSIG  A 13 2 300 20260101000000 …

NSEC / NSEC3

DNSSEC "authenticated denial of existence" — proves a record does not exist. NSEC3 hashes names to discourage zone walking.

Zone-file example

example.com.   IN  NSEC  www.example.com. A NS SOA MX TXT RRSIG NSEC

TLSA

DANE — binds a TLS certificate (or its public key) to a hostname via DNSSEC. Lets clients verify certs without trusting a CA.

Zone-file example

_443._tcp.example.com.   IN  TLSA  3 1 1 ABCD…

SVCB / HTTPS

Service Binding — advertises alternative endpoints, ALPNs, port, and ECH config for a service. `HTTPS` is the HTTPS-specific subtype enabling HTTP/3 and ECH.

Zone-file example

example.com.   IN  HTTPS  1 . alpn="h3,h2"

NAPTR

Rewrites a name to a URI / regex result. Used by ENUM and SIP for service discovery.

Zone-file example

example.com.   IN  NAPTR  100 10 "u" "E2U+sip" "!^.*$!sip:info@example.com!" .

LOC

Geographic location — latitude, longitude, altitude. Rarely used in practice.

Zone-file example

example.com.   IN  LOC  37 30 N 127 0 E 30m

ALIAS / ANAME

A non-standard "flattened CNAME" supported by some providers (Route 53 alias, Cloudflare CNAME flattening). Lets you point the zone apex at another hostname.

Zone-file example

example.com.   IN  ALIAS  app.example.cdn.com.

How to use

Type a record type (`mx`) or keyword (`mail`, `dnssec`) in the search box.
Read the description and the zone-file example.
Click the type chip's copy button to drop the record name into your zone file.

Frequently asked questions

Why can't CNAME live at the apex?: Because every zone must serve SOA and NS records at the apex, and CNAME isn't allowed to coexist with other record types at the same name. Use ALIAS / ANAME (provider-specific flattening) or HTTPS records to work around it.
What's the difference between SVCB and HTTPS?: Both are Service Binding records. `HTTPS` is the HTTPS-specific subtype browsers query automatically — it advertises HTTP/3 (`alpn=h3`), alternative ports, and Encrypted Client Hello (ECH) configuration. `SVCB` is the generic form for other protocols.
Do I need CAA?: CAA is technically optional but strongly recommended — without it, any public CA may issue a cert for your domain. Adding `0 issue "letsencrypt.org"` (or whichever CA you use) restricts issuance to that authority.

Related tools

CAA Record Builder (DNS Certificate Authority Authorization)

Generate Certificate Authority Authorization (CAA) DNS records so only the CAs you trust can issue TLS certificates for your domain. Builds BIND-format records and split tag/value rows for control-panel UIs, plus a one-click list of common CAs (Let's Encrypt, DigiCert, Google, Amazon, …).

Network 0 0

TXT Record Splitter (255-Byte Chunks)

Split a long SPF, DKIM or DMARC TXT record into the 255-byte chunks the DNS protocol requires — outputs BIND, generic zone file, Cloudflare or Route 53 syntax.

Network 0 0

DKIM Record Builder & Parser

Build or parse a DKIM (DomainKeys Identified Mail) DNS TXT record — paste your public key, pick selector, key type (RSA/Ed25519), hash and flags, get the full record plus the selector._domainkey hostname and a DNS-chunked version for records over 255 chars.

Network 0 0

IP Address Inspector

Type an IPv4 or IPv6 address and see its class, scope (private / public / loopback / link-local), decimal value, binary, reverse-DNS notation, and /32 CIDR.

Network 0 0

SPF Record Builder

Compose a Sender Policy Framework TXT record from mechanisms, IPs and includes — with a live DNS-lookup counter and warnings.

Network 0 0

DMARC Record Builder

Compose a `_dmarc` TXT record — policy, subdomain policy, percentage rollout, alignment, rua/ruf reporting — with safety warnings.

Network 0 0