Cheat Sheets Networking

DNS Record Types Cheat Sheet

DNS record types with their type numbers, purpose and zone-file examples, from A, AAAA, MX and TXT to SRV, CAA, HTTPS and DNSSEC records, plus response codes.

Last reviewed:

AdSense Placeholder
Slot: header_reference_page
On this page

Every DNS record has a name, a TTL, a class (almost always IN, number 1), a type and data. The type numbers below are the IANA values as reported by dnspython 2.8, and every example was parsed by it. Query any of them with the DNS Record Lookup; the full walk-through is in How DNS Works.

Everyday records

Type Number Purpose Zone-file example
A 1 Name to IPv4 address example.com. 300 IN A 192.0.2.10
AAAA 28 Name to IPv6 address example.com. 300 IN AAAA 2001:db8::10
CNAME 5 Alias: this name is another name www.example.com. 300 IN CNAME example.com.
MX 15 Mail servers, with a preference (lower first) example.com. 3600 IN MX 10 mail.example.com.
TXT 16 Free text: SPF, DKIM, DMARC, ownership checks example.com. 3600 IN TXT "v=spf1 -all"
NS 2 Authoritative name servers of a zone example.com. 86400 IN NS ns1.example.net.
SOA 6 Start of authority: primary server, contact, timers see below
PTR 12 Reverse lookup: address to name 10.2.0.192.in-addr.arpa. IN PTR mail.example.com.
SRV 33 Service location: priority, weight, port, host _sip._tcp.example.com. IN SRV 10 5 5060 sip.example.com.
CAA 257 Which CAs may issue certificates example.com. IN CAA 0 issue "letsencrypt.org"

Modern and specialised records

Type Number Purpose Example data
HTTPS 65 Connection hints for HTTPS: ALPN, ports, ECH; also works at the zone apex 1 . alpn="h2,h3"
SVCB 64 The same for other services 1 svc.example.com. port="8443"
DNAME 39 Redirects a whole subtree to another domain example.net.
NAPTR 35 Rewrite rules (VoIP, ENUM) 100 10 "U" "E2U+sip" "!^.*$!sip:[email protected]!" .
TLSA 52 DANE: certificate pinning for a port 3 1 1 <SHA-256 hex>
SSHFP 44 SSH host key fingerprint 4 2 <SHA-256 hex> (Ed25519, SHA-256)
HINFO 13 Host information; also returned for ANY queries (RFC 8482) "x86-64" "Linux"
LOC 29 Geographic location 52 22 23.000 N 4 53 32.000 E -2.00m
URI 256 Maps a name to a URI 10 1 "https://example.com/"
SPF 99 Obsolete: publish SPF in TXT instead

DNSSEC records

Type Number Purpose
DNSKEY 48 Public keys of the zone
RRSIG 46 Signature over a set of records
DS 43 Hash of a child zone's key, published in the parent (12345 13 2 <hex>: key tag, algorithm 13 = ECDSA P-256, digest type 2 = SHA-256)
NSEC 47 Proves a name or type does not exist
NSEC3 50 Same, with hashed names
NSEC3PARAM 51 Parameters for NSEC3
CDS / CDNSKEY 59 / 60 Child asks the parent to update its DS

Query-only and meta types

Type Number Use
OPT 41 EDNS(0) pseudo-record: bigger UDP sizes, DNSSEC OK flag
TSIG 250 Signs zone transfers and updates with a shared key
IXFR 251 Incremental zone transfer
AXFR 252 Full zone transfer; should be restricted to secondaries
ANY 255 "All types"; many servers now return a minimal answer

The SOA record

example.com. 3600 IN SOA ns1.example.net. hostmaster.example.com. (
    2026101001 ; serial (often YYYYMMDDnn)
    7200       ; refresh: secondaries check every 2 h
    3600       ; retry after a failed refresh: 1 h
    1209600    ; expire: secondaries stop answering after 14 days
    3600 )     ; negative-caching TTL: how long "does not exist" is cached

The contact hostmaster.example.com. means the email address [email protected].

Reverse lookup names

Address PTR name
192.0.2.10 10.2.0.192.in-addr.arpa.
2001:db8::10 0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.

IPv4 octets are reversed; IPv6 is fully expanded to 32 hex digits, then reversed one digit at a time. Find the name behind an address with the Reverse DNS Lookup.

Response codes (RCODE)

Code Name Meaning
0 NOERROR Success (possibly with no records of that type: "NODATA")
1 FORMERR The server could not parse the query
2 SERVFAIL The server failed, often a DNSSEC validation error or an unreachable authority
3 NXDOMAIN The name does not exist
4 NOTIMP Query type not implemented
5 REFUSED The server will not answer this query (policy)

Rules worth remembering

  • No CNAME next to other data. A name with a CNAME cannot have other records, so the zone apex (example.com) cannot be a CNAME; use A/AAAA, an HTTPS record or your provider's alias feature.
  • MX and NS point to names, never to IP addresses or CNAMEs.
  • One SPF record per name, published as TXT. Syntax for SPF, DKIM and DMARC is in SPF, DKIM and DMARC Syntax Cheat Sheet.
  • Changes wait for the TTL. Watch caches catch up with the DNS Propagation Checker.

Try these tools

DNS Record Lookup

Look up A, AAAA, MX, TXT, NS, or CNAME DNS records for any domain in real time.

Reverse DNS Lookup

Perform a reverse DNS lookup to find the hostname associated with any IPv4 or IPv6 address.

DNS Propagation Checker

Check a DNS record against Google, Cloudflare, Quad9, and OpenDNS public resolvers simultaneously to see if a change has fully propagated.

See also

  • Guide How DNS Works
    How a name becomes an IP address through resolvers, root, TLD and authoritative servers, the record types, TTL and caching.
  • Glossary DNS
    DNS (Domain Name System) is the internet's directory that translates domain names like example.com into IP addresses and holds other.
  • Glossary TTL
    TTL (time to live) is how long, in seconds, a DNS record or cached item may be reused before it must be fetched again.
  • Glossary MX record
    An MX (mail exchanger) record is a DNS record that names the servers that accept email for a domain, with a priority number.
  • Cheat sheet SPF, DKIM and DMARC Syntax Cheat Sheet
    Record syntax for SPF mechanisms and qualifiers, DKIM signature and key tags (RFC 6376) and DMARC tags (RFC 7489 and RFC 9989).
Back to the cheat sheets
AdSense Placeholder
Slot: footer_leaderboard