Record Types

The types you will actually meet

Address and alias records

example.com.        300  IN  A      93.184.215.14
example.com.        300  IN  A      93.184.215.15
example.com.        300  IN  AAAA   2606:2800:21f:cb07:6820:80da:af6b:8b2c
www.example.com.    300  IN  CNAME  example.com.

Two A records for the same name is round-robin load balancing. The resolver returns both and the client picks, usually the first, so this balances poorly.

A CNAME must be alone at its name. No other record type may sit beside it, which is why you cannot CNAME a zone apex: the apex already has SOA and NS.

The apex CNAME problem and ALIAS

Providers work around the apex restriction with a non-standard record that resolves the target server side and answers with A records.

; not portable, resolves server side to A/AAAA
example.com.        300  IN  ALIAS  lb-1234.us-east-1.elb.amazonaws.com.

; the standardised replacement, AliasMode is priority 0
example.com.        300  IN  HTTPS  0 lb.example.net.
example.com.        300  IN  HTTPS  1 . alpn="h3,h2" ipv4hint=93.184.215.14

None of the ALIAS variants appear on the wire. dig example.com ALIAS returns nothing useful, because the authoritative server answers the A query directly.

MX, SRV, and CAA

All three pack multiple fields into the RDATA, in a fixed order.

; MX: priority target.   Lower priority wins, equal priorities share load.
example.com.  3600  IN  MX  10 mx1.example.com.
example.com.  3600  IN  MX  20 mx2.example.com.

; SRV: _service._proto.name  priority weight port target
_sip._tcp.example.com.        3600 IN SRV 10 60 5060 sip1.example.com.
_xmpp-server._tcp.example.com. 3600 IN SRV 5 0 5269 xmpp.example.com.
_ldap._tcp.example.com.       3600 IN SRV 0 100 389 dc1.example.com.

; CAA: flags tag value
example.com.  3600  IN  CAA  0 issue "letsencrypt.org"
example.com.  3600  IN  CAA  0 issuewild ";"
example.com.  3600  IN  CAA  0 iodef "mailto:security@example.com"

- SRV weight only applies within one priority level. Higher weight gets proportionally more connections. - MX 0 . means "this domain sends and receives no mail" (a null MX). It is the correct way to say so, and example.com publishes exactly that. - CAA is checked at issuance time only, by the CA, not by browsers. An empty CAA set means any CA may issue. 0 issuewild ";" forbids wildcards outright.

SOA and PTR

example.com. 3600 IN SOA ns1.example.com. hostmaster.example.com. (
                          2026091501  ; serial
                          7200        ; refresh
                          3600        ; retry
                          1209600     ; expire
                          300 )       ; minimum, the negative-caching TTL

The email address uses a dot for the @, so hostmaster.example.com. means hostmaster@example.com. A literal dot in the local part is escaped as \..

Reverse DNS lives in special zones and the address is reversed label by label:

8.8.8.8       ->  8.8.8.8.in-addr.arpa.        PTR  dns.google.
2001:db8::1   ->  1.0.0....8.b.d.0.1.0.0.2.ip6.arpa.  PTR  host.example.com.

dig -x 8.8.8.8 +short            # dns.google.
dig -x 2001:4860:4860::8888 +short

Reverse DNS is delegated by whoever owns the IP block, so you set it at your hosting provider, not in your own zone. A mail server without matching forward and reverse records gets its mail rejected.

TXT and the 255-byte rule

A single TXT string is capped at 255 bytes. Longer values are split into several quoted strings inside one record, and the receiver concatenates them with no separator.

; one long DKIM key, split because it exceeds 255 bytes
sel._domainkey.example.com. 3600 IN TXT (
  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1x"
  "8kQ2Vh7Wm3pR4tYuIoP5aSdFgHjKlZxCvBnM6qWeRtYuIoP1234567890abcdefg" )

- Multiple separate TXT records at one name are all returned, unordered. This is fine for verification tokens and fatal for SPF, which permits exactly one policy record. - dig +short TXT prints each string with its quotes, so strip them before comparing. - Some UIs accept a 400-character value and split it for you. Others reject it.

Gotchas

- dig ANY is not a way to list a zone. Cloudflare, Google, and most authoritative servers return NOTIMP, REFUSED, or a minimal HINFO reply, because ANY was an amplification vector. - Trailing dots matter in zone files. mail.example.com without the dot becomes mail.example.com.example.com. after origin expansion. In a web UI it usually does not, which is why the same value behaves differently. - CNAME chains cost a round trip each and many resolvers cap the depth. Two hops is fine, five is a latency bug. - A CNAME target's own TTL wins, not the CNAME's, for how long the final address is cached. - NS records exist in both the parent and the child zone and must agree. Disagreement is a lame delegation. - Records are returned as an unordered RRset. Never rely on the order of multiple A, MX, or TXT records.