What a DNS record contains
A DNS record, formally a resource record, is one entry in a zone. Each has an owner name, a TTL, a class (almost always IN, for internet) and a type, followed by data whose meaning depends on the type. An A record's data is an IPv4 address, while an MX record's data names a mail server.
Records with the same name and type form a record set (RRset), which resolvers cache and return together. The examples below use the zone file syntax from RFC 1035, where a trailing dot marks a fully qualified name.
; owner name TTL class type data
www.example.com. 3600 IN A 192.0.2.10Address and alias records: A, AAAA and CNAME
An A record maps a name to an IPv4 address, and an AAAA record maps it to an IPv6 address. A name can have several of each, and clients choose among them.
A CNAME (canonical name) record makes one name an alias for another. The resolver restarts the lookup at the target and returns the target's records, so a CNAME always points to a hostname, never to an IP address.
The coexistence rule is strict. A name that has a CNAME record can have no other records, apart from the DNSSEC records (RRSIG and NSEC) that sign it. It can also have only one CNAME.
So an MX or TXT record cannot sit beside a CNAME at www. A CNAME also cannot sit at the zone apex, which must hold SOA and NS records.
example.com. 3600 IN A 192.0.2.10
example.com. 3600 IN AAAA 2001:db8::10
www.example.com. 3600 IN CNAME example.com.Mail and text records: MX and TXT
An MX record names a server that accepts email for the domain, together with a preference number. Senders try the lowest number first and fall back to higher ones. The target must be a hostname with its own A or AAAA records, never an IP address or a name that is a CNAME.
A TXT record holds one or more text strings of up to 255 bytes each, and longer values are split into several strings within one record. TXT records carry SPF policies, DMARC policies at _dmarc names, DKIM public keys at selector._domainkey names, and tokens that prove you control the domain.
A name should have at most one SPF record. Two TXT records at the same name that both start with v=spf1 make SPF checks fail with a permanent error.
example.com. 3600 IN MX 10 mail1.example.com.
example.com. 3600 IN MX 20 mail2.example.com.
example.com. 3600 IN TXT "v=spf1 include:_spf.example.net -all"
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"Zone and delegation records: NS and SOA
NS records list the authoritative nameservers for a zone. They appear in two places: in the parent zone, where they delegate the domain, and at the apex of the zone itself. The two sets should match.
Every zone has exactly one SOA (start of authority) record at its apex. It names the primary nameserver and an administrator mailbox, written with a dot in place of the @ sign, followed by five numbers.
- Serial is a version number that secondary nameservers compare to decide whether to copy the zone again.
- Refresh and retry set how often secondaries check for a new serial, and how soon they try again after a failed check.
- Expire is how long a secondary keeps answering for the zone without a successful refresh.
- Minimum, together with the SOA record's own TTL, sets how long resolvers cache negative answers such as NXDOMAIN.
example.com. 86400 IN NS ns1.example.net.
example.com. 86400 IN NS ns2.example.net.
example.com. 3600 IN SOA ns1.example.net. hostmaster.example.com. (
2026102501 ; serial
7200 ; refresh
3600 ; retry
1209600 ; expire
300 ) ; minimumService and security records: CAA, SRV, PTR, HTTPS and SVCB
These types are less common, and each answers a specific question that the basic records cannot.
- CAA lists the certificate authorities allowed to issue certificates for the domain. Public certificate authorities must check it before issuing, and a CAA set that leaves out your authority blocks issuance.
- SRV gives the host and port for a service under a name such as _sip._tcp.example.com, with priority and weight fields for choosing between servers.
- PTR maps an IP address back to a name for reverse DNS, under in-addr.arpa for IPv4 and ip6.arpa for IPv6. Whoever controls the address block, usually your hosting provider or ISP, manages it rather than your DNS host.
- HTTPS and SVCB (RFC 9460) tell clients how to connect before they do, including supported protocols such as HTTP/3 and keys for Encrypted Client Hello. An HTTPS record can sit at the zone apex, but only clients that query HTTPS records use it.
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
_sip._tcp.example.com. 3600 IN SRV 10 60 5060 sip.example.com.
10.2.0.192.in-addr.arpa. 3600 IN PTR mail.example.com.
example.com. 3600 IN HTTPS 1 . alpn="h3,h2"