Search 32 DNS record types, from A and MX to HTTPS and DNSSEC, with type numbers, zone-file examples and the RFC for each.
Type a record such as MX, a type number such as 15, or a word such as email, alias or DNSSEC.
Showing all 32 record types.
IPv4 address
Maps a hostname to an IPv4 address. It is the record behind most websites: a browser looks up the A record, then connects to that address. A name can have several A records, which spreads traffic across servers.
example.com. 300 IN A 192.0.2.1Defined in RFC 1035
IPv6 address
The IPv6 counterpart of an A record. It maps a hostname to a 128-bit IPv6 address, and the name stands for "quad A", four times the size of an IPv4 address. Publish both A and AAAA so IPv4-only and IPv6 clients can connect.
example.com. 300 IN AAAA 2001:db8::1Defined in RFC 3596
Canonical name (alias)
Makes one name an alias for another, and the resolver restarts the lookup at the target. A name with a CNAME cannot hold any other record type, so you cannot put one at the zone root (example.com), where SOA and NS records must live. The target of an MX or NS record must not be a CNAME.
www.example.com. 300 IN CNAME example.com.Mail exchanger
Tells other mail servers where to deliver email for the domain. Each record has a priority number, and the lowest number is tried first. The target must be a hostname with an A or AAAA record, not an IP address and not a CNAME. A single "0 ." record (a null MX) says the domain accepts no mail.
example.com. 300 IN MX 10 mail.example.com.Text
Holds free-form text strings of up to 255 characters each. Today it carries email authentication and ownership checks: SPF (v=spf1), DKIM public keys, the DMARC policy at _dmarc, and domain verification for Google, Microsoft and other services.
example.com. 300 IN TXT "v=spf1 include:_spf.google.com ~all"Name server
Names the authoritative name servers for a zone. The same record in the parent zone delegates a subdomain to another set of servers. Domains normally list at least two name servers, and your registrar publishes the same list in the parent zone.
example.com. 86400 IN NS ns1.example.com.Defined in RFC 1035
Start of authority
Every zone has exactly one SOA record at its root. It names the primary name server, the zone administrator's email (written with a dot instead of @), the zone serial number, the refresh, retry and expire timers for secondary servers, and the negative-caching TTL.
example.com. 3600 IN SOA ns1.example.com. hostmaster.example.com. 2026100401 7200 3600 1209600 300Pointer (reverse DNS)
Maps an IP address back to a hostname, the reverse of an A or AAAA lookup. The lookup name is the address with its octets reversed under in-addr.arpa, so 192.0.2.1 becomes 1.2.0.192.in-addr.arpa. IPv6 uses ip6.arpa. Mail servers check PTR records when judging senders, and your hosting provider usually controls them.
1.2.0.192.in-addr.arpa. 3600 IN PTR host.example.com.Defined in RFC 1035
Service locator
Points a service to a host and port, so clients do not need a fixed port. The name has the form _service._protocol.name. The fields are priority (lowest first), weight (share among equal priorities), port and target host. SIP, XMPP, LDAP, Kerberos and Minecraft Java servers use it.
_sip._tcp.example.com. 300 IN SRV 10 60 5060 sipserver.example.com.Defined in RFC 2782
Certification Authority Authorization
Lists which certificate authorities may issue TLS certificates for the domain, and certificate authorities must check it before issuing. The tags are issue, issuewild (for wildcard certificates) and iodef (where to report problems). Flag 0 is the normal value.
example.com. 3600 IN CAA 0 issue "letsencrypt.org"Defined in RFC 8659
HTTPS service binding
Lets a website tell the browser how to connect before it opens a connection: supported protocols (alpn), alternative ports, IP hints and Encrypted Client Hello keys. It can also point the zone root at another host, which a CNAME cannot do. Major browsers query it alongside A and AAAA.
example.com. 300 IN HTTPS 1 . alpn="h2,h3"Defined in RFC 9460
Service binding
The general form of the HTTPS record, for any protocol. It holds a priority, a target name and parameters such as alpn and port, so a client can discover alternative endpoints. Priority 0 is alias mode, like a CNAME. Any other priority is service mode.
_1234._bar.example.com. 300 IN SVCB 1 svc1.example.net. port=1234 ipv6hint=2001:db8::1Defined in RFC 9460
Delegation name
Redirects a whole subtree of names, where a CNAME redirects only one. A DNAME at old.example.com sends www.old.example.com to www.new.example.net, and likewise every other name beneath it. The name old.example.com itself is not redirected. Useful when you rename a domain.
old.example.com. 3600 IN DNAME new.example.net.Defined in RFC 6672
ALIAS (provider feature)
Not a real DNS record type. Some DNS hosts offer it under the names ALIAS, ANAME or CNAME flattening so that the zone root can point at another hostname. The provider looks up the target itself and answers with ordinary A and AAAA records, so resolvers never see the ALIAS. Syntax and behavior vary by provider.
example.com. ALIAS target.example.net.Not defined in any RFC
Sender Policy Framework (obsolete type)
A dedicated record type that was once used for SPF policies. RFC 7208 says SPF policies must be published as TXT records and the SPF type is no longer used, so publish a TXT record that starts with v=spf1 instead.
example.com. 300 IN TXT "v=spf1 mx -all"Defined in RFC 7208
TLS authentication (DANE)
Pins the certificate or public key a TLS server should present, published under _port._protocol.host. The three numbers are usage, selector and matching type. It needs DNSSEC. Mail servers use it for DANE with SMTP, but browsers do not check it.
_443._tcp.example.com. 300 IN TLSA 3 1 1 <SHA-256 hash of the public key>SSH key fingerprint
Publishes the fingerprint of a host's SSH key so a client can check it without the unknown-host prompt (OpenSSH option VerifyHostKeyDNS). The fields are the key algorithm (4 is Ed25519), the fingerprint type (2 is SHA-256) and the fingerprint in hex. Only trustworthy in a DNSSEC-signed zone.
host.example.com. 3600 IN SSHFP 4 2 <SHA-256 fingerprint in hex>Naming authority pointer
Rewrites a name into a URI or another name with a regular expression. Telephony uses it: ENUM maps phone numbers to SIP addresses, and some VoIP and mobile networks use it for service discovery. Rare for ordinary websites.
example.com. 300 IN NAPTR 100 10 "u" "E2U+sip" "!^.*$!sip:info@example.com!" .Defined in RFC 3403
Uniform resource identifier
Maps a service name to a full URI, with a priority and weight like SRV. For example, _ftp._tcp can point to an ftp:// address. Rarely deployed.
_ftp._tcp.example.com. 3600 IN URI 10 1 "ftp://ftp1.example.com/public"Defined in RFC 7553
DNS public key
Holds a public key used to verify DNSSEC signatures in the zone. A zone usually publishes two kinds: a key-signing key (flag 257), which signs the DNSKEY set and is referenced by the DS record, and a zone-signing key (flag 256), which signs the other records.
example.com. 3600 IN DNSKEY 257 3 13 <base64 public key>Defined in RFC 4034
Delegation signer
Lives in the parent zone and holds a digest of the child zone's key-signing key, which chains DNSSEC trust from parent to child. After you enable DNSSEC at your DNS host, you add the DS record at your registrar. The fields are key tag, algorithm, digest type and digest.
example.com. 86400 IN DS 12345 13 2 <SHA-256 digest of the DNSKEY>Defined in RFC 4034
Resource record signature
The digital signature over a set of records, for example all the A records of one name. A validating resolver checks it against the DNSKEY. It also carries the signature validity window, so a signed zone must be re-signed before the signatures expire.
example.com. 3600 IN RRSIG A 13 2 3600 20261101000000 20261004000000 12345 example.com. <base64 signature>Defined in RFC 4034
Next secure
Proves that a name or record type does not exist (authenticated denial of existence). It lists the next name in the zone in order, and the record types the current name has. Because the names are in plain text, anyone can walk the whole zone.
alpha.example.com. 3600 IN NSEC host.example.com. A RRSIG NSECDefined in RFC 4034
Hashed next secure
Like NSEC, but it uses hashed owner names, which makes zone walking harder. The hashes can still be guessed offline, so RFC 9276 says to use 0 extra iterations and an empty salt wherever NSEC3 is used.
<hashed name>.example.com. 3600 IN NSEC3 1 0 0 - <next hashed name> A RRSIGNSEC3 parameters
Sits at the zone root and tells the authoritative server which hash algorithm, flags, iterations and salt to use when it builds NSEC3 records. Validating resolvers do not use it.
example.com. 3600 IN NSEC3PARAM 1 0 0 -Child DS
Published in the child zone to ask the parent to create or update the DS record, which allows automated DNSSEC key rollovers. It has the same fields as DS.
example.com. 3600 IN CDS 12345 13 2 <SHA-256 digest of the DNSKEY>Child DNSKEY
Does the same job as CDS but carries the child's public key itself, from which the parent computes the DS record.
example.com. 3600 IN CDNSKEY 257 3 13 <base64 public key>Certificate
Stores a certificate or certificate revocation list in DNS, with types such as PGP and X.509. Rarely used today, because TLSA, OPENPGPKEY and SMIMEA cover the common cases.
example.com. 3600 IN CERT PGP 0 0 <base64 certificate data>Defined in RFC 4398
OpenPGP public key
Publishes a person's OpenPGP public key under a hash of the local part of their email address, below _openpgpkey. A mail client can find a recipient's key with a DNS lookup.
<hashed local part>._openpgpkey.example.com. 3600 IN OPENPGPKEY <base64 public key>Defined in RFC 7929
S/MIME certificate association
Associates an S/MIME certificate with an email address, using the same fields as TLSA, below _smimecert. It lets a mail client find a recipient's certificate by DNS lookup.
<hashed local part>._smimecert.example.com. 3600 IN SMIMEA 3 0 0 <certificate data>Defined in RFC 8162
Location
Records a geographic position: latitude, longitude, altitude and precision. Mostly a curiosity, though some network-mapping tools read it.
example.com. 3600 IN LOC 42 21 54 N 71 06 18 W -24m 30mDefined in RFC 1876
Host information
Names the CPU and operating system of a host. Almost nobody publishes it, because it tells attackers what you run. Since RFC 8482, some DNS servers use a made-up HINFO record as a minimal answer to ANY queries.
example.com. 3600 IN HINFO "RISCV" "Linux"MX, a type number such as 15, or a word such as email or DNSSEC.Each example is one line of a zone file: name, TTL, class, type, then data. A trailing dot, as in example.com., marks a complete name. The TTL is how many seconds resolvers may cache the answer, and IN is the Internet class. Examples use documentation values only, and keys and hashes appear as placeholders in angle brackets.
With the search box empty, the status line reads Showing all 32 record types. and the first card is the A record: example.com. 300 IN A 192.0.2.1. The name example.com points to the IPv4 address 192.0.2.1, and resolvers may cache that answer for 300 seconds. Type mx and the status line reads 1 record type matches "mx". with the MX card: example.com. 300 IN MX 10 mail.example.com.. Mail for example.com goes to mail.example.com, and 10 is its priority.
dig MX example.com or nslookup -type=MX example.com.Setting up a server as well? The port lookup names the service behind a port number, and the IP subnet calculator splits address ranges.
An A record maps a name directly to an IPv4 address. A CNAME maps a name to another name, and the resolver then looks up that name's address. Use an A record when you know the IP address, and a CNAME when a provider gives you a hostname instead.
No. A CNAME cannot share a name with other records, and the root of a zone must carry SOA and NS records. Use an A or AAAA record instead, or the ALIAS, ANAME or CNAME flattening feature if your DNS host offers one.
MX records say where mail for your domain is delivered. TXT records add authentication: SPF (starting v=spf1) lists the servers allowed to send, DKIM publishes a public key at selector._domainkey, and DMARC at _dmarc says what to do with mail that fails.
Resolvers may keep the old answer until its TTL runs out, so a TTL of 3600 can mean up to an hour. Lower the TTL a day before a planned change. Name server and DS changes at your registrar can take a day or two, because the parent zone caches them longer.
Sources: the IANA DNS resource record types registry for type numbers, RFC 1035 for the core record types and RFC 9460 for SVCB and HTTPS.