Name the common DNS record types and what each one is for.
Show the answer
Say this first
A maps a name to an IPv4 address, AAAA to IPv6. CNAME makes a name an alias of another name. MX names a domain's mail servers with a preference (lower wins). NS lists a zone's authoritative servers. PTR maps an address back to a name. SOA holds the zone's admin data and timers. TXT carries text such as SPF, DKIM, DMARC and domain verification tokens. SRV locates a service with priority, weight, port and target host.
Go deeper
In zone file form
example.com. 3600 IN SOA ns1.example.com. hostmaster.example.com. 2026111001 7200 3600 1209600 3600
example.com. 3600 IN NS ns1.example.com.
example.com. 3600 IN NS ns2.example.net.
example.com. 3600 IN MX 10 mail1.example.com.
example.com. 3600 IN MX 20 mail2.example.com.
example.com. 3600 IN TXT "v=spf1 mx -all"
www.example.com. 300 IN A 203.0.113.80
www.example.com. 300 IN AAAA 2001:db8:80::80
shop.example.com. 300 IN CNAME www.example.com.
_sip._tcp.example.com. 3600 IN SRV 10 60 5060 sip1.example.com.And in the reverse zone 113.0.203.in-addr.arpa:
80.113.0.203.in-addr.arpa. 3600 IN PTR www.example.com.SRV fields
priority weight port target. Lower priority is tried first. Among equal priorities, weight sets the
share of traffic. Active Directory clients find domain controllers this way, through names like
_ldap._tcp.dc._msdcs.corp.example.com.
Others worth naming
- CAA: which certificate authorities may issue certificates for the domain. CAs must check it.
- DS, DNSKEY, RRSIG, NSEC, NSEC3: DNSSEC.
- HTTPS and SVCB (RFC 9460): connection hints such as ALPN, so a browser can learn that a site speaks HTTP/3 before it connects.
- NAPTR: used with SRV in SIP and ENUM.
They will ask next
Why must Active Directory clients use the AD DNS servers?
They find domain controllers, Kerberos and LDAP through SRV records that only the AD DNS zones hold. Point a domain member at a public resolver and logons, GPOs and domain joins fail.
How do SPF, DKIM and DMARC use TXT records?
SPF lists which servers may send mail for the domain. DKIM publishes the public key used to check message signatures, under a selector name. DMARC, at
_dmarc.example.com, tells receivers what to do when SPF or DKIM fail and where to send reports.
Traps
- Saying the higher MX preference wins. Lower is preferred.
- Pointing an MX or NS record at a CNAME. RFC 2181 forbids it and some mail servers fail on it.