DNS Record Types
A reference of DNS record types with what each one is for and an example: A, AAAA, CNAME, MX, TXT, NS, SOA, SRV, CAA, PTR, HTTPS, SVCB, DNSSEC records and more.
Free · No sign-up · Your inputs stay in your browser
Reference
DNS record types
| Type | What it is | Example and notes |
|---|---|---|
| A | IPv4 address | example.com. 300 IN A 203.0.113.10 |
| AAAA | IPv6 address | example.com. 300 IN AAAA 2001:db8::10 |
| CNAME | Alias to another name | Must be the only record at its name, so never at the zone apex. |
| ALIAS / ANAME | Apex alias (provider feature) | Not a real record type: the DNS host resolves the target and answers with A/AAAA. Cloudflare calls it CNAME flattening. |
| MX | Mail server, with a priority | 10 mx1.example.net. Lower number is tried first. Must point at a name, never an IP or a CNAME. |
| TXT | Free text | SPF, DKIM, DMARC, domain verification. 255 bytes per string, several strings per record. |
| NS | Delegates a zone to name servers | Must match at the registrar and in the zone. |
| SOA | Start of authority | Primary server, admin email, serial and timers. One per zone. |
| SRV | Service location | _sip._tcp.example.com. SRV 10 60 5060 sip.example.com. (priority weight port target) |
| CAA | Which CAs may issue certificates | 0 issue "letsencrypt.org" |
| PTR | Reverse DNS: IP to name | Set by whoever owns the IP range (your host), not in your zone. Mail servers need one that matches. |
| HTTPS | HTTPS service binding (RFC 9460) | Advertises HTTP/3 (alpn=h3) and ECH keys; also works at the apex like an alias. |
| SVCB | General service binding | The generic form HTTPS is built on. |
| DS | Delegation signer (DNSSEC) | Hash of the child zone's key, published in the parent zone via the registrar. |
| DNSKEY | DNSSEC public key | |
| RRSIG | DNSSEC signature | Generated by signing, never written by hand. |
| TLSA | DANE certificate association | _25._tcp.mx.example.com. Pins the TLS key for SMTP or HTTPS. |
| NAPTR | Naming authority pointer | Used by SIP and ENUM telephony. |
| SSHFP | SSH host key fingerprint | Lets ssh verify a host key from DNSSEC-signed DNS (VerifyHostKeyDNS). |
| SPF (type 99) | Obsolete | RFC 7208 removed it. Publish SPF as TXT. |
TTL is in seconds and is how long resolvers may cache the answer: lower it a day before a migration, raise it afterwards. dig example.com TYPE +short queries one type; dig @1.1.1.1 asks a public resolver instead of your own.
About this tool
Method, assumptions, practical next steps, and limits.
The newer ones
HTTPS and SVCB records (RFC 9460) let a domain advertise HTTP/3 support and Encrypted Client Hello keys in the DNS answer, and an HTTPS record at the apex can point at another name, something CNAME cannot do there. CAA tells certificate authorities which of them may issue. TLSA publishes a TLS key for DANE.
Querying
dig example.com MX +short asks for one type; dig @1.1.1.1 example.com asks a public resolver rather than your own, which helps when testing a change that your resolver still has cached.