DNS Record Types

DNS records store different types of data in the Domain Name System. Each record type serves a specific purpose – from mapping domain names to IP addresses, to configuring email routing and security policies.

Record Types

Record relationships

How DNS record types connect to each other and to higher-level protocols

Address resolution

A→AAAA

IPv4 ↔ IPv6 equivalents. Browsers use Happy Eyeballs to prefer AAAA.

CNAME→A / AAAA

Alias chain: CNAME follows to final A/AAAA. Cannot coexist at zone apex.

PTR→A / AAAA

Reverse of A/AAAA. PTR lives in .in-addr.arpa or .ip6.arpa zone.

Email routing & authentication

MX→A / AAAA

MX names must resolve to A/AAAA – cannot point to CNAME.

TXT (SPF)→MX

SPF v=spf1 authorizes IPs that deliver mail for this domain.

TXT (DKIM)→selector._domainkey

DKIM public key at selector._domainkey.domain for signature verification.

TXT (DMARC)→SPF + DKIM

DMARC at _dmarc.domain enforces policy when SPF/DKIM fail or are unaligned.

DNSSEC chain of trust

DNSKEY→DS

Zone's public key. DS record in parent zone contains its hash, linking trust chain.

RRSIG→DNSKEY

Signature over every RRset. Verified with DNSKEY. Resolvers with DO bit get RRSIG.

NSEC / NSEC3→RRSIG

Authenticated denial of existence. NSEC3 hashes names to prevent zone walking.

Service discovery & policies

SRV→A / AAAA

Service location: SRV names the host, A/AAAA resolves it. Used by SIP, XMPP, gRPC.

CAA→Certificate issuance

Restricts which CAs may issue TLS certificates for this domain.

TLSA→DANE / TLS

Pins a TLS certificate or key to a domain via DNSSEC (DANE).

Type	Description	RFC	Status
A	A Record The A record maps a domain name to an IPv4 address.	RFC 1035	Active
AAAA	AAAA Record The AAAA record maps a domain name to an IPv6 address.	RFC 3596	Active
MX	MX Record The MX (Mail Exchanger) record specifies the mail servers responsible for accepting email on behalf of a domain.	RFC 1035	Active
CNAME	CNAME Record The CNAME (Canonical Name) record creates an alias from one domain name to another.	RFC 1035	Active
TXT	TXT Record The TXT record stores arbitrary text associated with a domain.	RFC 1035	Active
NS	NS Record The NS (Name Server) record specifies the authoritative name servers for a domain zone.	RFC 1035	Active
SOA	SOA Record The SOA (Start of Authority) record is the first record in any DNS zone.	RFC 1035	Active
PTR	PTR Record The PTR (Pointer) record enables reverse DNS lookups – mapping an IP address back to a domain name.	RFC 1035	Active
SRV	SRV Record The SRV (Service) record specifies the hostname and port for a specific service on a domain.	RFC 2782	Active
CAA	CAA Record The CAA (Certification Authority Authorization) record specifies which Certificate Authorities are permitted to issue SSL/TLS certificates for a domain.	RFC 8659	Active
NAPTR	NAPTR Record The NAPTR (Naming Authority Pointer) record is used to map telephone numbers, SIP URIs, and other identifiers to services using regular expression substitution rules.	RFC 3403	Active
DNSKEY	DNSKEY Record The DNSKEY record holds a public cryptographic key used in DNSSEC (DNS Security Extensions).	RFC 4034	Active
DS	DS Record The DS (Delegation Signer) record creates the chain of trust between a parent zone and a child zone in DNSSEC.	RFC 4034	Active
TLSA	TLSA Record The TLSA record (part of DANE – DNS-Based Authentication of Named Entities) pins a TLS certificate or public key to a domain name in DNS.	RFC 6698	Active
SSHFP	SSHFP Record The SSHFP (SSH Fingerprint) record stores a fingerprint of an SSH server's public key in DNS.	RFC 4255	Active
HTTPS	HTTPS Record The HTTPS record (a special case of SVCB) provides service binding information for HTTPS connections.	RFC 9460	Active
SVCB	SVCB Record The SVCB (Service Binding) record is the generalized form of the HTTPS record.	RFC 9460	Active
LOC	LOC Record The LOC (Location) record stores the geographic location of a host – latitude, longitude, altitude, and the accuracy of the measurement.	RFC 1876	Active
HINFO	HINFO Record The HINFO (Host Information) record stores the CPU type and operating system of a host.	RFC 1035	Active
CERT	CERT Record The CERT record stores certificates and certificate revocation lists (CRLs) in DNS.	RFC 4398	Active
NSEC	NSEC Record The NSEC (Next Secure) record is a DNSSEC record type that proves the non-existence of a DNS name or type.	RFC 4034	Active
NSEC3	NSEC3 Record NSEC3 is the hashed version of NSEC that prevents zone walking.	RFC 5155	Active
RRSIG	RRSIG Record The RRSIG (Resource Record Signature) record contains the DNSSEC cryptographic signature for a set of DNS records.	RFC 4034	Active
DNAME	DNAME Record The DNAME (Delegation Name) record redirects an entire subtree of the DNS namespace to another domain.	RFC 6672	Active
URI	URI Record The URI DNS record maps a hostname to a URI.	RFC 7553	Active
APL	APL Record The APL (Address Prefix List) DNS record stores a list of IP address prefixes (IPv4 or IPv6 CIDR notation) associated with a domain name.	RFC 3123	Active