APL

APL Record

Active

The APL (Address Prefix List) DNS record stores a list of IP address prefixes (IPv4 or IPv6 CIDR notation) associated with a domain name.

name TTL IN APL [!]afi:address/prefix ...

In one line

The APL (Address Prefix List) DNS record stores a list of IP address prefixes (IPv4 or IPv6 CIDR notation) associated with a domain name. It was designed for address-based access control lists distributed via DNS. APL records are rarely used in practice – network access control has moved to dedicated systems. The record is defined in RFC 3123.

Description

APL records encode one or more address prefix entries, each with an address family (1=IPv4, 2=IPv6), a CIDR prefix, and a negation flag. The intended use was distributing IP allowlists and blocklists via DNS for lightweight access control. The concept was sound but never saw widespread adoption. Modern CDNs and firewalls use dedicated IP reputation feeds rather than DNS APL records.

Examples

IPv4 prefix list

shell

example.com. 3600 IN APL 1:192.0.2.0/24 1:198.51.100.128/25

With negation

shell

example.com. 3600 IN APL 1:192.0.2.0/24 !1:192.0.2.100/32

Query APL

shell

dig example.com APL

Related Record Types

TXT

Specification

RFC 3123 – DNS APL record specification →