What each DNS record does, how it is written, and how real domains use it, with a working lookup for every type.
A DNS zone is a list of resource records. Every record has the same five parts, in this order in a zone file:
www.example.com. 3600 IN A 192.0.2.10
; owner name TTL class type RDATA$ORIGIN is appended.IN (internet).All records with the same name, class and type form an RRset. Resolvers cache, return and (with DNSSEC) sign them as a unit, which is why two MX records for one domain always arrive together and share a TTL. Names that begin with an underscore, such as _dmarc, _25._tcp or selector._domainkey, are not hostnames. They are a convention for attaching protocol-specific data to a domain without clashing with real hosts (RFC 8552).
Several important email standards (SPF, DKIM, DMARC, BIMI, MTA-STS and TLS-RPT) define no record type of their own. They are TXT records at agreed names, so they are listed here alongside the types they depend on.
A stub resolver on your device asks a recursive resolver (your ISP's, or a public one like 1.1.1.1 or 8.8.8.8). On a cache miss, the recursive resolver starts at the root servers, follows the NS records that delegate com and then example.com, and asks the authoritative server for the type it needs. Along the way it may follow CNAMEs, validate DNSSEC signatures (DS, DNSKEY and RRSIG), and cache every answer for its TTL, negative answers included (SOA minimum).
Every type page shows records fetched live from well-known domains, with the time they were checked, and a lookup you can run yourself.
Records that turn a name into somewhere to connect.
The A (address) record maps a name to one IPv4 address. It is the record a browser needs before it can open a connection to an IP…
A CNAME (canonical name) record says "this name is an alias; look up that other name instead". Resolvers follow it and return the…
The AAAA ("quad-A") record is the IPv6 counterpart of the A record: it maps a name to one 128-bit IPv6 address.
Records that define who is authoritative for a zone and how it is cached.
Where mail is delivered, and the TXT-based records that prove who may send it.
An MX (mail exchanger) record names a host that accepts email for the domain, with a preference number that sets the order sender…
A TXT record holds arbitrary text. DNS itself gives it no meaning; SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI and site-ownership ch…
SPF (Sender Policy Framework) is a TXT record at the domain that lists the servers allowed to send mail using that domain in the …
DMARC ties SPF and DKIM to the address people actually see, the From header, and tells receivers what to do with mail that fails,…
A DKIM record publishes the public key that receivers use to verify the DKIM-Signature header on a message. It lives at <selector…
MTA-STS lets a domain tell sending mail servers to deliver only over TLS with a valid certificate, and to refuse delivery rather …
TLS-RPT asks sending mail servers to send you a daily report of TLS connection successes and failures to your MX hosts, so MTA-ST…
BIMI (Brand Indicators for Message Identification) points mailbox providers to a logo to display next to mail that passes DMARC, …
Records that tell clients which host, port or protocol to use for a service.
An SRV (service) record tells clients which host and port provide a service, with priorities for failover and weights for load sharing.
The HTTPS record tells browsers, before they connect, which protocols a site supports (HTTP/2, HTTP/3), which addresses to use, a…
SVCB (service binding) is the general form of the HTTPS record: it tells a client which endpoints, protocols and parameters a ser…
A NAPTR (Naming Authority Pointer) record holds a rewrite rule. VoIP uses it to choose a transport for SIP, and ENUM uses it to t…
A URI record maps a service name to a complete URI, including scheme and path, where SRV could only give a host and port.
Records that sign DNS data or pin certificates, keys and issuing CAs.
A CAA (Certification Authority Authorization) record lists the certificate authorities allowed to issue TLS certificates for a do…
A DS (delegation signer) record sits in the parent zone and holds a hash of the child zone's key-signing key. It is what makes DN…
DNSKEY records at a zone apex publish the public keys used to verify the zone's DNSSEC signatures (RRSIG records).
A TLSA record pins the TLS certificate or public key a service must present, protected by DNSSEC. This is DANE (DNS-based Authent…
An RRSIG record is a DNSSEC signature over one RRset (all records of one type at one name). Validating resolvers check it with th…
NSEC records let a signed zone prove a negative: that a name does not exist, or that it exists but has no record of the requested type.
An SSHFP record publishes the fingerprint of a server's SSH host key, so clients can verify the key on first connection instead o…
Name-from-address lookups and descriptive records.
A PTR (pointer) record maps an IP address back to a hostname. The address is written in reverse under in-addr.arpa (IPv4) or ip6.…
A LOC record gives the physical location of a host or network as latitude, longitude and altitude, with size and precision values.
HINFO (host information) holds two strings, a CPU type and an operating system. Today you mostly see it as the placeholder answer…