Resource records

DNS stores typed RRsets, not arbitrary name-to-value pairs

A record is identified by owner name, class and type. Records with the same owner, class and type form an RRset and should be treated as one signed and cached unit.

AAddressing

IPv4 address

www  300  IN  A  192.0.2.80

Maps a name to an IPv4 address. Multiple A records are one RRset; ordering alone is not a robust load-balancing guarantee.

AAAAAddressing

IPv6 address

www  300  IN  AAAA  2001:db8::80

Maps a name to an IPv6 address. IPv4 and IPv6 are independent RRsets and can have different answers and TTLs.

CNAMEAddressing

Canonical-name alias

docs  300  IN  CNAME  www.example.com.

Makes one owner name an alias for another. A CNAME owner cannot normally hold other data, and a conventional CNAME cannot exist at a zone apex that also needs SOA and NS records.

NSAuthority

Authoritative name server

@  3600  IN  NS  ns1.example.net.

Identifies servers authoritative for a zone or delegated child. Parent and child copies serve different protocol roles.

SOAAuthority

Start of authority

@ IN SOA ns1.example.net. hostmaster.example.com. (
  2026080301 3600 900 1209600 300 )

Contains the primary server name, responsible mailbox, serial, refresh, retry, expire and negative-caching parameters.

DSSecurity

Delegation signer

example.com. IN DS 12345 13 2 <digest>

Lives in the parent zone and identifies a child DNSKEY. It is the link that makes the child part of the DNSSEC chain of trust.

MXServices

Mail exchanger

@  3600  IN  MX  10  mail.example.com.

Routes mail to a host name, not directly to an IP address. Lower preference values are tried first. The target must resolve through address records.

SRVServices

Service location

_xmpp._tcp IN SRV 10 5 5222 xmpp.example.com.

Publishes priority, weight, port and target for protocols that define SRV discovery.

HTTPS / SVCBServices

Service binding

@ 300 IN HTTPS 1 . alpn="h2,h3" ipv4hint=192.0.2.80

Advertises alternative service endpoints and parameters. HTTPS records can accelerate connection setup and signal capabilities such as HTTP/3.

TXTServices

Text strings

@  300  IN  TXT  "v=spf1 -all"

A generic text container now used by many application protocols. One logical value can be split across quoted character strings.

CAASecurity

Certificate authority authorisation

@  3600  IN  CAA  0  issue  "letsencrypt.org"

States which certificate authorities may issue for a name. It constrains issuance policy but does not replace certificate validation.

TLSASecurity

DANE certificate association

_25._tcp.mail IN TLSA 3 1 1 <sha256>

Associates a TLS service with a certificate or public key. Meaningful security depends on DNSSEC validation.

DNSKEY / RRSIGSecurity

DNSSEC key and signature

@ IN DNSKEY 257 3 13 <public-key>
www IN RRSIG A 13 3 300 ...

DNSKEY publishes verification keys; RRSIG covers an RRset with a time-bounded digital signature.

NSEC / NSEC3Security

Authenticated denial

host IN NSEC next.example.com. A AAAA RRSIG NSEC

Proves that a name or type does not exist. NSEC3 hashes owner names but does not make zone contents secret.

Zone-file syntax

Small punctuation errors can change meaning

@ represents the current origin. An owner name omitted at the start of a record repeats the previous owner. A trailing dot makes a domain name absolute; without it, the origin is appended.

Parentheses continue a record across lines. Semicolons begin comments. TTL and class may be inherited, but explicit values often make maintenance safer.

A compact, safe example

$ORIGIN example.com.
$TTL 3600

@  IN SOA ns1.example.net. hostmaster.example.com. (
      2026080301 ; serial
      3600       ; refresh
      900        ; retry
      1209600    ; expire
      300        ; negative TTL
)

@     IN NS    ns1.example.net.
@     IN NS    ns2.example.net.
@     IN MX 10 mail.example.com.
www   IN A     192.0.2.80
www   IN AAAA  2001:db8::80
mail  IN A     192.0.2.25

Common mistakes

Records are constrained by protocol semantics

Using an IP address as an MX target

MX points to a domain name. Publish A and/or AAAA records for that target.

Combining CNAME with other data

A CNAME owner is an alias and generally cannot also carry MX, TXT, A or other records.

Forgetting the trailing dot

ns1.example.net inside the example.com. zone becomes ns1.example.net.example.com. unless written as an absolute name.

Assuming TXT is one string

Long TXT RDATA may be stored as multiple character strings that applications concatenate.

Changing the zone without the serial

Secondaries use the SOA serial to determine whether a newer version exists.