DNS Record Reference
Searchable cheat sheet for DNS record types — A, AAAA, CNAME, MX, TXT, NS, SOA, PTR, SRV, CAA, DNSSEC, SVCB / HTTPS — with examples.
Maps a hostname to an IPv4 address. The most common record — every domain that resolves to a server has at least one.
Zone-file example
example.com. IN A 93.184.216.34
Maps a hostname to an IPv6 address. Pronounced "quad-A".
Zone-file example
example.com. IN AAAA 2606:2800:220:1:248:1893:25c8:1946
Aliases one hostname to another. The target must itself resolve; CNAMEs cannot coexist with other records at the same name, and cannot appear at the apex (root) of a zone.
Zone-file example
www.example.com. IN CNAME example.com.
Mail exchanger — where SMTP for the domain should be delivered. Includes a priority (lower = preferred).
Zone-file example
example.com. IN MX 10 mail.example.com.
Arbitrary text. Used for SPF (mail anti-spoofing), DKIM keys, domain verification (Google, Facebook, etc.), and human-readable notes.
Zone-file example
example.com. IN TXT "v=spf1 include:_spf.google.com ~all"
Delegates a (sub)domain to a set of authoritative name servers. Every zone has NS records at its apex.
Zone-file example
example.com. IN NS ns1.example.com.
Start of Authority — administrative info for the zone: primary name server, hostmaster email, serial number, and TTLs for negative caching.
Zone-file example
example.com. IN SOA ns1.example.com. hostmaster.example.com. 2025010101 7200 3600 1209600 3600
Reverse lookup — maps an IP back to a hostname. Lives under the in-addr.arpa (v4) or ip6.arpa (v6) zones.
Zone-file example
34.216.184.93.in-addr.arpa. IN PTR example.com.
Locates the host and port for a named service (with priority and weight). XMPP, SIP, and Microsoft AD all use SRV.
Zone-file example
_sip._tcp.example.com. IN SRV 10 60 5060 sipserver.example.com.
Certification Authority Authorization — restricts which CAs may issue TLS certs for the domain. Modern CAs are required to check CAA before issuing.
Zone-file example
example.com. IN CAA 0 issue "letsencrypt.org"
DNSSEC public key used to verify signatures in the zone. Paired with RRSIG records.
Zone-file example
example.com. IN DNSKEY 257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0d…
Delegation Signer — published at the parent zone to fingerprint the child zone's DNSKEY. Forms the DNSSEC chain of trust.
Zone-file example
example.com. IN DS 31589 13 2 3490A6806D47F17A34C29E2CE80E8A999FFBE4BE…
Resource Record Signature — cryptographic signature over a record set, validated against the zone's DNSKEY. Added automatically when the zone is signed.
Zone-file example
example.com. IN RRSIG A 13 2 300 20260101000000 …
DNSSEC "authenticated denial of existence" — proves a record does not exist. NSEC3 hashes names to discourage zone walking.
Zone-file example
example.com. IN NSEC www.example.com. A NS SOA MX TXT RRSIG NSEC
DANE — binds a TLS certificate (or its public key) to a hostname via DNSSEC. Lets clients verify certs without trusting a CA.
Zone-file example
_443._tcp.example.com. IN TLSA 3 1 1 ABCD…
Service Binding — advertises alternative endpoints, ALPNs, port, and ECH config for a service. HTTPS is the HTTPS-specific subtype enabling HTTP/3 and ECH.
Zone-file example
example.com. IN HTTPS 1 . alpn="h3,h2"
Rewrites a name to a URI / regex result. Used by ENUM and SIP for service discovery.
Zone-file example
example.com. IN NAPTR 100 10 "u" "E2U+sip" "!^.*$!sip:info@example.com!" .
Geographic location — latitude, longitude, altitude. Rarely used in practice.
Zone-file example
example.com. IN LOC 37 30 N 127 0 E 30m
A non-standard "flattened CNAME" supported by some providers (Route 53 alias, Cloudflare CNAME flattening). Lets you point the zone apex at another hostname.
Zone-file example
example.com. IN ALIAS app.example.cdn.com.
How to use
- Type a record type (
mx) or keyword (mail,dnssec) in the search box. - Read the description and the zone-file example.
- Click the type chip's copy button to drop the record name into your zone file.
About this tool
ShowHide
A searchable cheat sheet for the DNS record types you actually meet, each with what it is for, the traps that come with it, and a concrete zone-file example you can adapt. It covers the everyday set through to DNSSEC and the newer SVCB and HTTPS records behind HTTP/3 and encrypted client hello. The traps are the reason to keep it open: a CNAME cannot sit at the zone apex because it may not coexist with the SOA and NS records that have to be there, MX priority is lowest-wins rather than highest, and a single TXT string is capped at 255 characters, which is why a long DKIM key arrives split into several quoted pieces that the resolver joins back together.
Frequently asked questions
Why can't CNAME live at the apex?
Because every zone must serve SOA and NS records at the apex, and CNAME isn't allowed to coexist with other record types at the same name. Use ALIAS / ANAME (provider-specific flattening) or HTTPS records to work around it.
What's the difference between SVCB and HTTPS?
Both are Service Binding records. HTTPS is the HTTPS-specific subtype browsers query automatically — it advertises HTTP/3 (alpn=h3), alternative ports, and Encrypted Client Hello (ECH) configuration. SVCB is the generic form for other protocols.
Do I need CAA?
CAA is technically optional but strongly recommended — without it, any public CA may issue a cert for your domain. Adding 0 issue "letsencrypt.org" (or whichever CA you use) restricts issuance to that authority.
I changed a record and nothing happened. How long should I wait?
At least the previous record's TTL, because resolvers may keep serving the old answer until it expires — and a change made after a long TTL was already handed out can take that full period to disappear from every cache. The usual pattern is to lower the TTL a day before a planned change, make the change, then raise it again once the new value has settled.
Why is my TXT record rejected or truncated?
Because a single character string in a TXT record cannot exceed 255 bytes. Longer values — a DKIM key is the common case — have to be split into several quoted strings inside one record, which the resolver concatenates back together. Splitting them into separate records instead is a different thing entirely and usually breaks the verification you were trying to set up.
Related tools
DNSSEC Calculator — DS Record & NSEC3 Hash
Turn a DNSKEY into the DS record your registrar wants — key tag and all three digest types — or hash a name the way NSEC3 does.
Network
DNS Zone File Validator
Paste a BIND zone file and see what it really says: every name fully qualified, the SOA explained, and the traps a parser alone will not report.
Network
CAA Record Builder (DNS Certificate Authority Authorization)
Generate Certificate Authority Authorization (CAA) DNS records so only the CAs you trust can issue TLS certificates for your domain.
Network
DNS Message Decoder
Paste a DNS packet as hex or DoH base64url and read it: header flags, opcode and rcode, every record, and the EDNS0 OPT options.
Network
TLSA Record Generator (DANE) & Checker
Turn a certificate into its TLSA records — every selector and matching type — and check an existing record against the certificate you are serving.
Network
TXT Record Splitter (255-Byte Chunks)
Split a long SPF, DKIM or DMARC TXT record into the 255-byte strings DNS requires, in BIND, generic zone-file, Cloudflare or Route 53 syntax.
Network