Introduction: DNS records and resource data
The Domain Name System (DNS) translates human-readable domain names such as www.google.com into IP addresses used by network software. The DNS database also stores mail, service, and domain-policy data. Each structured entry, called a or Resource Record (RR), has a name, class, type, and type-specific data.
A record type defines a record's function. A and AAAA store host addresses, MX identifies a mail server, and TXT can carry an SPF policy or verification data. DNS records also support VoIP service discovery, spam filtering, and other applications. Different record types share fields identifying the resource, while their RDATA format depends on the type and class.
The anatomy of a DNS record
While different record types hold different kinds of data, nearly all of them share a common underlying structure, typically presented in a standard format within a domain's zone file. In zone-file notation, the fields are the name, TTL, class, type, and RDATA. Records with the same name, class, and type form an RRset, and their TTL values should agree. This structure consists of several key fields:
- 1. Name (or Hostname)
- This is the domain name the record applies to. It can be the root domain itself (e.g.,
example.com) or a subdomain (e.g.,www.example.com,mail.example.com). A fully qualified name can end with a dot that denotes the DNS root. The "@" symbol is often used in zone files as a shorthand to represent the root domain. - 2. TTL (Time-To-Live)
- is a value in seconds that tells DNS resolvers how long they are allowed to cache (store) this record. After the TTL expires, the resolver treats cached data as stale and obtains a fresh copy through a new query to the appropriate source. A longer TTL reduces DNS traffic and queries to the authoritative zone, but a shorter TTL allows for faster propagation of changes.
- 3. Class
- This field specifies the data class. Typical internet zones use
IN, which stands for Internet. Other classes exist, such asCHfor Chaos, but current domain deployments rarely use them. - 4. Type
- The Type field identifies the data format and record function, such as A, AAAA, MX, or CNAME.
- 5. Data (or Value)
- This is the actual content of the record. Its format depends entirely on the record's Type. For an A record, this will be an IPv4 address. For an MX record, it will be a priority number and a mail server's domain name.
; Name TTL Class Type Data
www.example.com. 3600 IN A 93.184.216.34Basic DNS record types
The following record types occur in typical zones that support websites and email.
A record: IPv4 address
The A recordstores a 32-bit IPv4 address associated with a domain name. The address is part of the record's RDATA. A resolver can return one A record or a set of records for the same name. A browser or another client uses this record while resolving a host name.
Record structure:
hostname TTL IN A IPv4-addressPractical example:
An example query for the IPv4 address of cloudflare.com uses the command-line tool nslookup.
> nslookup cloudflare.com
Server: one.one.one.one
Address: 1.1.1.1
Non-authoritative answer:
Name: cloudflare.com
Address: 104.16.132.229
Name: cloudflare.com
Address: 104.16.133.229The example response contains two A records for cloudflare.com, with IP addresses and . Multiple A records can direct traffic to several servers for load balancing and redundancy.
AAAA record: IPv6 address
The AAAA recordstores a 128-bit IPv6 address associated with a domain name. The address is encoded in network byte order in the record data. It serves a role similar to an A record while using a different address format. The name "AAAA" refers to the fourfold difference in bit length between IPv6 addresses and 32-bit IPv4 addresses.
Record structure:
hostname TTL IN AAAA IPv6-addressPractical example:
Let's query for the AAAA record of google.com.
> nslookup -type=AAAA google.com
Server: one.one.one.one
Address: 1.1.1.1
Non-authoritative answer:
Name: google.com
Address: 2a00:1450:4025:807::8b
Name: google.com
Address: 2a00:1450:4025:807::65
Name: google.com
Address: 2a00:1450:4025:807::66
Name: google.com
Address: 2a00:1450:4025:807::8aDNS responses depend on the resolver and query time, so a later lookup may return different addresses. The presence of A and AAAA records does not define connection order. A client network stack can use one address or both, depending on its selection algorithm, such as Happy Eyeballs.
CNAME record: alias
A CNAME record maps an alias to another name, called the canonical name. The target usually exists as a separate DNS node. When a resolver encounters a CNAME, it continues resolution at the target name for the requested type. The response can contain an A, AAAA, or another record type associated with that canonical name. One alias can have only one CNAME, while multiple aliases can point to the same target.
Record structure:
alias.hostname TTL IN CNAME canonical.hostnamePractical example:
Many websites point their "www" subdomain to their root domain. Let's look at www.github.com.
> nslookup -type=CNAME www.github.com
Server: one.one.one.one
Address: 1.1.1.1
Non-authoritative answer:
www.github.com canonical name = github.com.The response identifies www.github.com as an alias for github.com. The address records at the canonical name determine the address used after the alias is resolved.
Important restriction:
A CNAME record cannot coexist with any other record type for the same hostname. This is why you generally cannot place a CNAME record on a root domain (like example.com), because the root domain must also have NS and SOA records.
MX record: mail exchanger
An MX record (Mail Exchanger record) is used exclusively for routing email. It specifies the mail server(s) responsible for accepting email messages on behalf of a domain. When mail is sent to someone@example.com, the sending mail server performs a DNS lookup for the MX records of example.com to determine where to deliver the message.
Record structure:
domain TTL IN MX priority mail.server.hostnameAn MX record contains a priority value and a target name. A mail server selects the reachable target with the lowest value. An MX target should not be a CNAME alias. Additional values identify alternative targets for the same domain.
Practical example:
Let's check the mail servers for Google's gmail.com domain.
> nslookup -type=MX gmail.com
Server: one.one.one.one
Address: 1.1.1.1
Non-authoritative answer:
gmail.com mail exchanger = 5 gmail-smtp-in.l.google.com.
gmail.com mail exchanger = 10 alt1.gmail-smtp-in.l.google.com.
gmail.com mail exchanger = 20 alt2.gmail-smtp-in.l.google.com.
gmail.com mail exchanger = 30 alt3.gmail-smtp-in.l.google.com.
gmail.com mail exchanger = 40 alt4.gmail-smtp-in.l.google.com.The example response identifies gmail-smtp-in.l.google.com with priority . Targets with higher values are considered after it when the lower-priority target cannot be used.
NS record: name server
An NS record identifies an authoritative name server and participates in domain delegation. NS records for a delegated domain are published in the parent TLD zone, such as the .comzone. At a zone's origin, NS records occur together with the SOA record. Domain operators usually publish several servers for redundancy, while the required number follows registry or registrar policy.
Record structure:
domain TTL IN NS nameserver.hostnamePractical example:
> nslookup -type=NS google.com
Server: one.one.one.one
Address: 1.1.1.1
Non-authoritative answer:
google.com nameserver = ns1.google.com.
google.com nameserver = ns2.google.com.
google.com nameserver = ns3.google.com.
google.com nameserver = ns4.google.com.This shows the four authoritative name servers responsible for the google.com domain.
Other important record types
Beyond the essentials, several other record types provide functions used for security, service discovery, and reverse lookups. The meaning of RDATA follows the record type and the specification of the protocol using it.
TXT record: multipurpose text
A TXT record stores character strings associated with a domain name. A single record can contain several strings; their interpretation depends on the application, while SPF concatenates them without adding spaces. A TXT record is used in mail policies and domain-control verification. Examples include:
- Sender Policy Framework (SPF): An SPF policy is published as a TXT record and identifies servers authorized to send mail for a domain.
- DomainKeys Identified Mail (DKIM): A TXT record under a DKIM selector contains the public key used to verify the message signature and the integrity of signed data.
- Domain ownership verification: Services such as Google Search Console or Office 365 often require a specific TXT record to confirm that an administrator controls the domain before enabling their services.
SRV record: service discovery
An SRV record describes a service through a host name, port, priority, and weight. Its owner name has the form _service._protocol.domain. A client selects the lowest reachable priority and can use weight to distribute choices among targets at the same priority. SRV records are used by protocols including VoIP with SIP and instant messaging with XMPP.
Record structure:
_service._proto.name. TTL IN SRV priority weight port target.PTR record: reverse lookup
A PTR record supports reverse DNS lookup. IPv4 records are stored under in-addr.arpa, while IPv6 records use ip6.arpa. An A record maps a name to an IP address, while PTR identifies a name for an IP address in the corresponding reverse zone. Mail servers can use this association as a reputation and configuration check. Some of them reject messages from an address without a valid PTR or without a match to the sending host name.
Record structure:
reversed-IP.in-addr.arpa. TTL IN PTR hostname.