14 record types with a real zone-file line for each — and, more usefully, the specific mistake that makes each one fail in production.
Maps a hostname to an IPv4 address. The most common record on the internet.
www.example.com. 3600 IN A 203.0.113.10Watch out: Multiple A records for one name are valid and give crude round-robin load balancing — but DNS has no health checking, so a dead server keeps receiving a share of traffic until you remove its record.
Maps a hostname to an IPv6 address. Called 'quad-A' because IPv6 addresses are four times the size of IPv4.
www.example.com. 3600 IN AAAA 2001:db8::10Watch out: Publishing an AAAA record commits you to working IPv6. Clients on dual-stack networks generally prefer IPv6, so a broken v6 path causes slow or failed connections even though v4 is perfectly healthy.
Aliases one name to another name, which the resolver then looks up in turn.
shop.example.com. 3600 IN CNAME www.example.com.Watch out: A name with a CNAME cannot hold any other record. That makes a CNAME illegal at a zone apex (example.com itself), because the apex must carry SOA and NS records — which is why providers invented ALIAS and ANAME workarounds.
Names the mail servers that accept email for a domain, with a preference value.
example.com. 3600 IN MX 10 mail1.example.com.Watch out: Lower preference wins — 10 is tried before 20. The target must be a hostname with an A or AAAA record, never an IP address and never a CNAME.
Holds arbitrary text. In practice it carries SPF, DKIM, DMARC, and domain ownership verification.
example.com. 3600 IN TXT "v=spf1 include:_spf.example.net -all"Watch out: A domain must have only one SPF TXT record. Adding a second when you onboard a new mail provider is a leading cause of sudden delivery failures — merge the include statements into one record instead.
Declares which servers are authoritative for a zone. Also delegates a subdomain to a different set of servers.
example.com. 172800 IN NS ns1.example.net.Watch out: NS records exist in two places: in the parent zone (the delegation) and in the child zone itself. When they disagree, resolution becomes inconsistent in ways that are painful to diagnose.
Marks the beginning of a zone and carries its serial number, refresh and retry timers, and negative-caching TTL.
example.com. 3600 IN SOA ns1.example.net. admin.example.com. 2026080101 7200 3600 1209600 3600Watch out: The final field is the negative TTL — how long resolvers cache the fact that a name does NOT exist. Set it high and a newly created record stays invisible long after you added it.
Maps an IP address back to a hostname — the reverse of an A record.
10.113.0.203.in-addr.arpa. 3600 IN PTR www.example.com.Watch out: Reverse zones are delegated by whoever owns the IP block, so you usually cannot create a PTR yourself — you ask your provider. Mail servers commonly reject mail from addresses with no matching reverse DNS.
Advertises the host and port of a specific service, with priority and weight for selection.
_sip._tcp.example.com. 3600 IN SRV 10 60 5060 sipserver.example.com.Watch out: The name encodes the service and protocol with leading underscores, and the format is easy to get wrong. Active Directory depends on SRV records heavily — broken ones break domain logon, not just one application.
Lists which certificate authorities are permitted to issue certificates for the domain.
example.com. 3600 IN CAA 0 issue "letsencrypt.org"Watch out: CAs are required to check this before issuing. A stale CAA record is a common reason a certificate request suddenly fails after you switch providers.
Publishes the public key used to validate DNSSEC signatures in the zone.
example.com. 3600 IN DNSKEY 257 3 13 mdsswUyr3DPW132mOi8V9xESWE8o...Sits in the parent zone and fingerprints the child's key, forming the DNSSEC chain of trust.
example.com. 86400 IN DS 12345 13 2 49FD46E6C4B45C55D4AC...Watch out: Rolling a key without updating the DS record in the parent breaks validation for every DNSSEC-aware resolver — which fails closed, taking the whole domain offline rather than degrading.
The DNSSEC signature over a record set, proving it has not been tampered with.
example.com. 3600 IN RRSIG A 13 2 3600 20260901000000 ...Watch out: Signatures carry expiry dates. If re-signing automation stops, the zone fails validation on a schedule rather than immediately — an outage that arrives days after the actual breakage.
Publishes connection parameters — supported protocols, ports, and encryption hints — before the client connects.
example.com. 3600 IN HTTPS 1 . alpn="h3,h2"Watch out: The HTTPS record lets a browser go straight to HTTP/3 and skip the HTTP-to-HTTPS redirect. It is also what carries Encrypted Client Hello parameters.
Records are easier to reason about once you have seen the lookup happen. In the lab you can configure a DNS server, query it from a PC, and watch the request and response cross the wire.
Open the labEvery line in a zone file has the same five parts: name TTL class type data. The class is almost always IN for internet, which is why it looks like decoration. The TTL is the part people underestimate — it is how long every resolver on the internet is entitled to keep serving the old answer after you change it.
The trailing dot matters more than it looks. A name ending in a dot is fully qualified; one without gets the zone's origin appended. Omit it in a CNAME target and www.example.com quietly becomes www.example.com.example.com — a classic outage that looks like a typo nobody made.
Records are also served as sets, not individually. Every record sharing a name and type is returned together, which is why three A records give you round-robin, and why DNSSEC signs the set rather than each line.
An A record points a name directly at an IPv4 address. A CNAME points a name at another name, which the resolver must then look up separately. Use an A record when you control the address, and a CNAME when you want to follow whatever a provider's hostname resolves to.
Because a name carrying a CNAME cannot carry any other record, and the apex must hold SOA and NS records to exist as a zone at all. Providers work around this with non-standard ALIAS or ANAME records that resolve the target server-side and answer with an A record.
Up to the TTL of the record you changed, because resolvers keep serving the cached answer until it expires. Lower the TTL well before a planned migration — lowering it at the same time as the change does not help, since resolvers are still holding the old value with the old, longer TTL.
MX to say where mail is delivered, and TXT records for SPF, DKIM, and DMARC to prove your mail is legitimate. A matching PTR record on the sending IP matters too — many receivers reject mail from addresses with no reverse DNS.
It fails closed. A validating resolver that cannot verify the chain of trust returns SERVFAIL rather than the unverified answer, so a mismatched DS record or an expired RRSIG takes the domain offline for every DNSSEC-aware client at once.
More free tools: Port Number Lookup · IP to Binary Converter · MTU & MSS Calculator · All tools