Every DNS record type you will encounter, with what it does, its format, and a real-world example. Use the DNS Lookup tool to check records for any domain.
| Type | Purpose | Example Value |
|---|---|---|
| A | Maps a domain name to an IPv4 address. The most fundamental record type. | 93.184.216.34 |
| AAAA | Maps a domain name to an IPv6 address. Same as A but for the 128-bit address space. | 2606:2800:220:1:248:1893:25c8:1946 |
| CNAME | Alias that points one domain to another. The resolver follows the chain to the final A or AAAA record. Cannot be placed at the zone apex. | www.example.com -> example.com |
| MX | Specifies the mail server responsible for accepting email for the domain. The priority value determines preference, with lower numbers tried first. | 10 mail.example.com |
| TXT | Holds arbitrary text. Used for SPF, DKIM, DMARC, domain verification, and other machine-readable metadata. | v=spf1 include:_spf.google.com -all |
| NS | Lists the authoritative nameservers for the zone. These are the servers that hold the definitive records for the domain. | ns1.example.com |
| SOA | Start of Authority. Contains the primary nameserver, admin contact, serial number, and timing parameters for zone transfers and caching. | ns1.example.com admin.example.com 2024010101 3600 900 604800 86400 |
| CAA | Certificate Authority Authorization. Specifies which CAs are allowed to issue certificates for the domain. CAs must check this before issuance. | 0 issue "letsencrypt.org" |
| PTR | Reverse DNS record. Maps an IP address back to a hostname. Used for verifying server identity and email sender validation. | 34.216.184.93.in-addr.arpa -> example.com |
| SRV | Service locator. Specifies the host, port, priority, and weight for a particular service. Used by SIP, XMPP, LDAP, and other protocols. | 10 5 5060 sip.example.com |
| NAPTR | Name Authority Pointer. Supports regex-based rewrite rules for URI resolution. Used in ENUM (telephone number to URI mapping) and SIP routing. | Regex-based rewrite rules for URI resolution |
| DNSKEY | Contains the public key used to verify DNSSEC signatures for the zone. Resolvers use this to validate that DNS responses have not been tampered with. | Base64-encoded public key with algorithm and flags |
| DS | Delegation Signer. Stored in the parent zone to establish a chain of trust to the child zone's DNSKEY. Links the DNSSEC trust chain across zone boundaries. | Key tag, algorithm, digest type, and hash of child DNSKEY |
| RRSIG | DNSSEC signature over a resource record set. Contains the cryptographic signature, signing algorithm, expiration, and the signer's key tag. | Signature covering a specific record set with validity period |
| TLSA | DANE TLS Association. Pins a TLS certificate or public key in DNS, allowing clients to verify server certificates without relying solely on the CA system. | Certificate usage, selector, matching type, and certificate hash |
SPF, DKIM, and DMARC are all stored as TXT records, but they serve distinct roles in email authentication. SPF declares which IP addresses are authorized to send mail for the domain. DKIM attaches a cryptographic signature to each message, verified against a public key published in DNS. DMARC ties SPF and DKIM together with a policy that tells receivers what to do when checks fail.
Learn more: SPF Records, DKIM, DMARC.
DNSSEC adds cryptographic authentication to DNS responses. The DNSKEY, DS, and RRSIG record types work together to create a chain of trust from the root zone down to individual records. When a resolver validates DNSSEC, it can confirm that a DNS response was not modified in transit and that the data genuinely came from the zone owner.
Learn more: DNSSEC.
Query any record type for any domain, with results from multiple resolvers.
Look up DNS recordsSee also: CNAME Records.