DNS record types: A, AAAA, CNAME, MX, TXT, NS, SOA, PTR, CAA and more

Maps a domain name to an IPv4 address. It is the basic record for a website and most services.

Note: Several A records can exist for the same name (simple load distribution through DNS). A change spreads in at most the old record's TTL.

Maps a domain name to an IPv6 address.

Note: Do not publish an AAAA record unless your server really listens on that IPv6 address: visitors using IPv6 cannot connect or see delays.

Makes one name an alias of another; the resolver follows the target name and returns its records.

Note: No other record can exist at the same name. That is why a CNAME cannot be placed at the zone apex (ornek.com): the apex already holds SOA and NS. At the apex use A/AAAA, HTTPS or your provider's ALIAS/ANAME feature. MX and NS targets must not be CNAMEs either.

Tells the browser, before it connects, which protocols (HTTP/3, HTTP/2), addresses and ports a site is reachable on. SVCB is the general form (type 64) and HTTPS is the one for the web.

Note: Providers such as Cloudflare add this record automatically. "AliasMode" (priority 0) works like a CNAME at the apex; priority 1 and above is "ServiceMode".

Not a DNS standard: a provider-specific record some providers offer so that the zone apex can behave like a CNAME. The answer sent to resolvers is an A/AAAA record.

Note: It is provider-specific. When moving DNS to another provider, decide its equivalent (A/AAAA or HTTPS AliasMode) beforehand.

Names the servers that accept email for the domain and the order in which they are tried (preference).

Note: The lower preference number is tried first. The target must be a name, not an IP address, and must not be a CNAME. A domain that receives no email publishes a "null MX" (MX 0 .), RFC 7505.

Holds free text. SPF, DKIM, DMARC, MTA-STS and domain-ownership verification codes are all published in TXT (see the list below).

Note: A single string can be at most 255 bytes; long values (such as a DKIM key) are split into several quoted parts that the resolver joins. A name must have only one SPF record (v=spf1); a second one breaks SPF.

The old, separate SPF record type. RFC 7208 deprecated it: SPF is published as a TXT record.

Note: Do not publish the separate SPF type; use v=spf1 in TXT only. If your zone provider still suggests an "SPF" type, ignore it.

States which servers manage the domain's DNS records (the authoritative nameservers).

Note: At least two nameservers on different networks are recommended. The NS records at the parent (the registrar) and in your zone must match; the target name cannot be a CNAME.

The zone's start record: the primary nameserver, the responsible person's email (with a dot instead of @), the serial number and the refresh timers.

Note: Increase the serial on every change (most panels do it for you). The last field is how long a negative answer for a non-existent name may be cached (RFC 2308).

Maps an IP address back to a name (reverse DNS). It lives under in-addr.arpa for IPv4 and ip6.arpa for IPv6.

Note: The owner of the IP block (the hosting or internet service provider) adds it; it cannot be added in your domain's DNS panel. Servers that send email need it, and the PTR name is expected to resolve back to the same IP address (forward confirmation).

Restricts which certificate authorities (CAs) may issue certificates for the domain.

Note: With no CAA record any CA may issue. The tags are issue, issuewild (wildcard certificates) and iodef (incident reporting). If you leave out the CA you use, certificate renewal fails.

Lives in the parent zone (for example .com) and ties the DNSSEC chain of trust to the child zone's DNSKEY.

Note: You usually add the DS record at your domain registrar, not in your DNS panel. If you change the key and do not update the DS, resolvers that validate DNSSEC cannot resolve your domain.

The public keys that validate the zone's DNSSEC signatures.

Note: Flag 257 marks the key signing key (KSK) and 256 the zone signing key (ZSK). The DS record points at the KSK.

The DNSSEC signature of each record set. It has an inception and an expiration date.

Note: Signatures must be renewed before they expire; an expired signature makes the domain unresolvable for resolvers that validate DNSSEC.

Proves with a signature that a name (or record type) does not exist. NSEC3 (type 50) makes it harder to list the names in a zone (zone walking).

Note: The provider that signs your zone generates them; they are not written by hand.

Lets the child zone ask for the DS record in the parent zone to be updated (CDNSKEY is type 60). It automates key rollovers.

Note: It only helps if your registrar or TLD operator scans for it; ask your registrar whether it is supported.

DANE: pins a service's TLS certificate or certificate authority in DNS (for example for an SMTP server).

Note: It is only secure if the zone is signed with DNSSEC; a TLSA record in an unsigned zone cannot be trusted.

Publishes the fingerprint of an SSH server key in DNS; a client can check the fingerprint here on first connection.

Note: Without DNSSEC it is informational only.

States which server and port a service runs on (SIP, XMPP, Microsoft 365 and game servers, for example).

Note: The fields are priority, weight, port and target name in that order. The target must not be a CNAME. The name has the form _service._protocol.domain.

Rule-based name rewriting: used for telephone number mapping (ENUM) and in SIP/VoIP setups to decide which service is at which address.

Note: Most websites and email setups do not need it; publish it only if your VoIP provider asks for it.

Redirects every name below a name to the same position under another name (CNAME covers a single name, DNAME the whole subtree).

Note: DNAME redirects only the names below the owner name, not the owner name itself. Your provider may not support it.