DNS Record Reference
Network
Quick reference for the DNS record types you actually meet — what each is for, gotchas (e.g. CNAMEs can't sit at the zone apex), and a concrete zone-file example. Covers the everyday set plus DNSSEC and the newer SVCB / HTTPS records used for HTTP/3 and ECH.
Maps a hostname to an IPv4 address. The most common record — every domain that resolves to a server has at least one.
Zone-file example
example.com. IN A 93.184.216.34
Maps a hostname to an IPv6 address. Pronounced "quad-A".
Zone-file example
example.com. IN AAAA 2606:2800:220:1:248:1893:25c8:1946
Aliases one hostname to another. The target must itself resolve; CNAMEs cannot coexist with other records at the same name, and cannot appear at the apex (root) of a zone.
Zone-file example
www.example.com. IN CNAME example.com.
Mail exchanger — where SMTP for the domain should be delivered. Includes a priority (lower = preferred).
Zone-file example
example.com. IN MX 10 mail.example.com.
Arbitrary text. Used for SPF (mail anti-spoofing), DKIM keys, domain verification (Google, Facebook, etc.), and human-readable notes.
Zone-file example
example.com. IN TXT "v=spf1 include:_spf.google.com ~all"
Delegates a (sub)domain to a set of authoritative name servers. Every zone has NS records at its apex.
Zone-file example
example.com. IN NS ns1.example.com.
Start of Authority — administrative info for the zone: primary name server, hostmaster email, serial number, and TTLs for negative caching.
Zone-file example
example.com. IN SOA ns1.example.com. hostmaster.example.com. 2025010101 7200 3600 1209600 3600
Reverse lookup — maps an IP back to a hostname. Lives under the `in-addr.arpa` (v4) or `ip6.arpa` (v6) zones.
Zone-file example
34.216.184.93.in-addr.arpa. IN PTR example.com.
Locates the host and port for a named service (with priority and weight). XMPP, SIP, and Microsoft AD all use SRV.
Zone-file example
_sip._tcp.example.com. IN SRV 10 60 5060 sipserver.example.com.
Certification Authority Authorization — restricts which CAs may issue TLS certs for the domain. Modern CAs are required to check CAA before issuing.
Zone-file example
example.com. IN CAA 0 issue "letsencrypt.org"
DNSSEC public key used to verify signatures in the zone. Paired with RRSIG records.
Zone-file example
example.com. IN DNSKEY 257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0d…
Delegation Signer — published at the parent zone to fingerprint the child zone's DNSKEY. Forms the DNSSEC chain of trust.
Zone-file example
example.com. IN DS 31589 13 2 3490A6806D47F17A34C29E2CE80E8A999FFBE4BE…
Resource Record Signature — cryptographic signature over a record set, validated against the zone's DNSKEY. Added automatically when the zone is signed.
Zone-file example
example.com. IN RRSIG A 13 2 300 20260101000000 …
DNSSEC "authenticated denial of existence" — proves a record does not exist. NSEC3 hashes names to discourage zone walking.
Zone-file example
example.com. IN NSEC www.example.com. A NS SOA MX TXT RRSIG NSEC
DANE — binds a TLS certificate (or its public key) to a hostname via DNSSEC. Lets clients verify certs without trusting a CA.
Zone-file example
_443._tcp.example.com. IN TLSA 3 1 1 ABCD…
Service Binding — advertises alternative endpoints, ALPNs, port, and ECH config for a service. `HTTPS` is the HTTPS-specific subtype enabling HTTP/3 and ECH.
Zone-file example
example.com. IN HTTPS 1 . alpn="h3,h2"
Rewrites a name to a URI / regex result. Used by ENUM and SIP for service discovery.
Zone-file example
example.com. IN NAPTR 100 10 "u" "E2U+sip" "!^.*$!sip:info@example.com!" .
Geographic location — latitude, longitude, altitude. Rarely used in practice.
Zone-file example
example.com. IN LOC 37 30 N 127 0 E 30m
A non-standard "flattened CNAME" supported by some providers (Route 53 alias, Cloudflare CNAME flattening). Lets you point the zone apex at another hostname.
Zone-file example
example.com. IN ALIAS app.example.cdn.com.
How to use
- Type a record type (`mx`) or keyword (`mail`, `dnssec`) in the search box.
- Read the description and the zone-file example.
- Click the type chip's copy button to drop the record name into your zone file.
Frequently asked questions
- Why can't CNAME live at the apex?
- Because every zone must serve SOA and NS records at the apex, and CNAME isn't allowed to coexist with other record types at the same name. Use ALIAS / ANAME (provider-specific flattening) or HTTPS records to work around it.
- What's the difference between SVCB and HTTPS?
- Both are Service Binding records. `HTTPS` is the HTTPS-specific subtype browsers query automatically — it advertises HTTP/3 (`alpn=h3`), alternative ports, and Encrypted Client Hello (ECH) configuration. `SVCB` is the generic form for other protocols.
- Do I need CAA?
- CAA is technically optional but strongly recommended — without it, any public CA may issue a cert for your domain. Adding `0 issue "letsencrypt.org"` (or whichever CA you use) restricts issuance to that authority.
Related tools
MAC to EUI-64 / Link-local
Convert any MAC address into its modified EUI-64 interface ID and the matching IPv6 link-local address — the same form Windows / Linux compute automatically.
URL Query Builder
Build URLs by combining a base address with editable key-value query parameters — each pair toggleable, properly percent-encoded.
IP Address Inspector
Type an IPv4 or IPv6 address and see its class, scope (private / public / loopback / link-local), decimal value, binary, reverse-DNS notation, and /32 CIDR.
Port Number Reference
Searchable cheat sheet for ~60 standard TCP / UDP port numbers — from 22 (SSH) and 80 (HTTP) to 6379 (Redis) and 27017 (MongoDB).
Subnet Calculator (IPv4 / CIDR)
Parse an IPv4 CIDR into network address, broadcast, netmask, wildcard, host range, and class. Shows binary breakdown and private/public status.
User Agent Parser
Parse a User-Agent string into browser, engine, OS, device, and CPU. Detects 20+ bots including GPTBot, ClaudeBot, PerplexityBot.