This is a reference list. To see the records a live domain has right now, use the DNS Lookup tool. TTLs are common starting points, not rules: lower them a day before you change a record.
36 / 36
| Type | Name | Kind | What it does | Typical TTL | Example |
|---|---|---|---|---|---|
| A | Address record | Record type | Points a hostname to an IPv4 address. | 300 to 3600 s | example.com → 192.0.2.10 |
| AAAA | IPv6 address record | Record type | Points a hostname to an IPv6 address. | 300 to 3600 s | example.com → 2001:db8::10 |
| CNAME | Canonical name | Record type | Makes one name an alias of another. A name with a CNAME cannot hold any other records, so it cannot sit at the domain apex. | 300 to 3600 s | www.example.com → example.com |
| MX | Mail exchange | Record type | Names the servers that accept email for the domain. The lowest preference number is tried first. | 3600 s | 10 mail.example.com |
| TXT | Text record | Record type | Free text. Used for SPF, DKIM, DMARC and domain verification strings. | 300 to 3600 s | v=spf1 include:_spf.example.com ~all |
| NS | Name server | Record type | Lists the authoritative name servers for the zone. | 86400 s (1 day) or more | ns1.example.com |
| SOA | Start of authority | Record type | Zone details: primary name server, admin mailbox, serial number and refresh timers. | 3600 s | ns1.example.com hostmaster.example.com 2024010101 7200 3600 1209600 3600 |
| PTR | Pointer | Record type | Reverse DNS: maps an IP address back to a hostname. Set by whoever controls the IP block. Mail servers need one. | 3600 s or more | 10.2.0.192.in-addr.arpa → mail.example.com |
| SRV | Service locator | Record type | Gives the host and port for a service, with priority and weight. Used by SIP, XMPP and some Microsoft services. | 3600 s | _sip._tcp.example.com 10 60 5060 sip.example.com |
| CAA | Certification authority authorization | Record type | Lists which certificate authorities may issue certificates for the domain. | 3600 s | 0 issue "letsencrypt.org" |
| HTTPS | HTTPS service binding | Record type | Tells browsers before they connect which protocols a site supports, such as HTTP/3, and can point to another endpoint. Allowed at the apex. | 300 to 3600 s | example.com HTTPS 1 . alpn="h3,h2" |
| SVCB | Service binding | Record type | The general form of the HTTPS record, for other protocols such as encrypted DNS. | 300 to 3600 s | _dns.example.com SVCB 1 dns.example.com alpn="dot" |
| TLSA | TLS authentication (DANE) | Record type | Pins the certificate or public key a TLS service should present. Needs DNSSEC. Mostly used for mail servers. | 3600 s | _25._tcp.mail.example.com TLSA 3 1 1 <sha-256 hash> |
| SSHFP | SSH fingerprint | Record type | Publishes SSH host key fingerprints so clients can verify a server on first connect. Needs DNSSEC to be trusted. | 3600 s | server.example.com SSHFP 4 2 <sha-256 fingerprint> |
| NAPTR | Naming authority pointer | Record type | Rewrite rules that map a name to a service. Used in VoIP, SIP and ENUM phone number lookups. | 3600 s | 100 10 "S" "SIP+D2U" "" _sip._udp.example.com |
| URI | Uniform resource identifier | Record type | Maps a service name to a URI, with priority and weight like SRV. | 3600 s | _ftp._tcp.example.com URI 10 1 "ftp://ftp.example.com/" |
| DNAME | Delegation name | Record type | Redirects a whole subtree of names to another domain, unlike CNAME which aliases one name. | 3600 s | old.example.com DNAME new.example.net |
| DNSKEY | DNS key | Record type | Public key used to verify DNSSEC signatures in the zone. | 3600 to 86400 s | 257 3 13 <public key> |
| DS | Delegation signer | Record type | Hash of the child zone's key, published in the parent zone to link the DNSSEC chain of trust. | 86400 s, set by the parent | 12345 13 2 <sha-256 digest> |
| RRSIG | Resource record signature | Record type | The DNSSEC signature over a set of records. Created by the signing software, not by hand. | Same as the signed records | A 13 2 300 20261001000000 20260901000000 12345 example.com. <signature> |
| NSEC | Next secure record | Record type | Proves that a name or record type does not exist in a signed zone by naming the next name. | Zone minimum TTL | a.example.com NSEC c.example.com A AAAA RRSIG NSEC |
| NSEC3 | Hashed next secure record | Record type | Like NSEC, but uses hashed names so the zone cannot be listed by walking it. | Zone minimum TTL | <hash>.example.com NSEC3 1 0 0 - <next hash> A RRSIG |
| CDS | Child DS | Record type | Published by the child zone so the parent can update its DS record automatically. | 3600 s | 12345 13 2 <sha-256 digest> |
| CDNSKEY | Child DNSKEY | Record type | The key form of CDS, used for automated DNSSEC key rollovers with the parent. | 3600 s | 257 3 13 <public key> |
| OPENPGPKEY | OpenPGP public key | Record type | Publishes a user's OpenPGP key under a hashed local part, for email encryption. Needs DNSSEC. | 3600 s | <sha-224 of local part>._openpgpkey.example.com OPENPGPKEY <key> |
| SMIMEA | S/MIME certificate association | Record type | Binds an S/MIME certificate to an email address, like TLSA for mail content. Needs DNSSEC. | 3600 s | <hash>._smimecert.example.com SMIMEA 3 0 1 <hash> |
| LOC | Location | Record type | Stores latitude, longitude and altitude for a host. Rarely used today. | 3600 s | 52 22 23.000 N 4 53 32.000 E -2.00m 0.00m 10000m 10m |
| HINFO | Host information | Record type | Describes the CPU and operating system of a host. Rarely published; Cloudflare uses it to answer ANY queries (RFC 8482). | 3600 s | "RFC8482" "" |
| RP | Responsible person | Record type | Names the mailbox of the person responsible for a host, with a TXT record for more details. | 3600 s | admin.example.com. info.example.com. |
| CERT | Certificate | Record type | Stores certificates or certificate revocation lists, such as PKIX or PGP. | 3600 s | CERT PGP 0 0 <base64> |
| SPF | Sender Policy Framework (type 99) | Obsolete | The dedicated SPF record type is deprecated (RFC 7208). Publish SPF as a TXT record instead. | n/a | TXT: v=spf1 ip4:192.0.2.0/24 -all |
| DMARC | Email authentication policy | TXT convention | Not a record type. A TXT record at _dmarc.yourdomain that tells receivers what to do when SPF and DKIM fail. | 3600 s | _dmarc TXT v=DMARC1; p=reject; rua=mailto:r@example.com |
| DKIM | DomainKeys Identified Mail | TXT convention | Not a record type. A TXT record at selector._domainkey.yourdomain holding the public key that signs your mail. | 3600 s | s1._domainkey TXT v=DKIM1; k=rsa; p=<public key> |
| MTA-STS | Mail transfer agent strict transport security | TXT convention | Not a record type. A TXT record at _mta-sts.yourdomain that signals a policy file requiring TLS for incoming mail. | 3600 s | _mta-sts TXT v=STSv1; id=20260901 |
| BIMI | Brand indicators for message identification | TXT convention | Not a record type. A TXT record at default._bimi.yourdomain pointing to a logo that some inboxes show next to your mail. Needs DMARC enforcement. | 3600 s | default._bimi TXT v=BIMI1; l=https://example.com/logo.svg |
| ALIAS | Alias / ANAME / CNAME flattening | Provider feature | Not a record type on the wire. The DNS provider resolves the target and answers with A and AAAA records, so it works at the apex. Names vary by provider. | Set by the provider | @ ALIAS app.hosting-provider.net |
How to use
01
Pick a task or filter
Choose a task in Which record do I need, such as Stop my email going to spam, or press a filter such as Email or DNSSEC. You can also search by type or by a word such as certificate.
02
Read the Kind, TTL and example
Check the Kind column first: Record type, TXT convention, Provider feature or Obsolete. Then read what the record does, its typical TTL, and compare your value with the Example column.
03
Check your live records
Press Copy next to a type if you need it for a ticket or config, then use the DNS Lookup link above the table to see which records your domain publishes.
Why DNS Record Types
- 36 entries, including HTTPS, SVCB, TLSA, SSHFP, URI and every DNSSEC record.
- A task picker that shows exactly which records a job needs.
- Typical TTLs and a Kind column that separates real types from TXT conventions.
- Links to a live DNS lookup when you need a domain's actual records.
A vs CNAME vs ALIAS
All three can send visitors from a hostname to a server, but they work differently and have different limits. Picking the wrong one is a common cause of broken apex domains and email.
Use A or AAAA when you control the IP address and it rarely changes. Use a CNAME for subdomains such as www that should follow a host's name. At the apex, where a CNAME is not allowed, use your provider's ALIAS feature if it has one, or the host's IP addresses. Remember that a CNAME moves every lookup for that name, including MX and TXT, which is why it cannot share the name with other records.
| Record | Points to | Allowed at the apex | Other records on the same name |
|---|---|---|---|
| A or AAAA | An IP address | Yes | Allowed |
| CNAME | Another hostname | No | Not allowed |
| ALIAS or ANAME | Another hostname, resolved by the provider | Yes | Allowed |
| HTTPS | Another hostname plus connection details | Yes | Allowed |
Email records: what to add and in which order
Email needs several records working together. Add them in this order, and check each one with the DNS Lookup tool before you move on.
| Step | Record | Why |
|---|---|---|
| 1 | MX | Tells other servers where to deliver your mail |
| 2 | SPF (TXT) | Lists the servers allowed to send as your domain |
| 3 | DKIM (TXT) | Publishes the key that signs your outgoing mail |
| 4 | DMARC (TXT) | Tells receivers what to do when checks fail; start with p=none |
| 5 | MTA-STS and TLS-RPT (TXT) | Optional: require TLS for incoming mail and get reports |
| 6 | BIMI (TXT) | Optional: show your logo in supporting inboxes, once DMARC is enforced |
Common questions
What do A and AAAA records point to?
An A record maps a hostname to an IPv4 address, such as 192.0.2.10, and an AAAA record maps it to an IPv6 address, such as 2001:db8::10. Many domains publish both so visitors on either kind of network can connect.
Why can't I put a CNAME at my domain's apex?
A CNAME cannot share its name with any other record, and the apex must hold SOA and NS records, so the standard forbids it. Some providers offer ALIAS, ANAME or CNAME flattening to get the same effect, and the newer HTTPS record can also sit at the apex.
How do MX records decide where email goes?
Each MX record has a preference number, and sending servers try the lowest number first, falling back to higher ones if it is unreachable. An MX target must be a hostname with an A or AAAA record, not a CNAME.
What is the difference between an MX record and a CNAME?
They do different jobs. MX says which servers receive email for a domain, while CNAME makes one hostname an alias of another for every kind of lookup. You can have MX records on a domain, but the MX target itself should not be a CNAME.
Are SPF records still a real DNS record type?
The dedicated SPF record type (type 99) is obsolete under RFC 7208. Publish your v=spf1 policy as a TXT record at the domain instead, which is what mail servers check.
Are DKIM and DMARC separate DNS record types?
No. Both are TXT records at special names. DKIM keys live at selector._domainkey.yourdomain, and the DMARC policy lives at _dmarc.yourdomain.
In what order should I set up email DNS records?
Add MX records first so mail can arrive, then an SPF TXT record listing the servers allowed to send for you, then the DKIM TXT record from your email provider. Add DMARC last, usually starting with p=none to collect reports before tightening the policy.
What is the HTTPS DNS record used for?
The HTTPS record tells browsers, before they connect, which protocols a site supports, such as HTTP/3, and can point them to another endpoint. Unlike a CNAME, it is allowed at the domain apex.
Does this reference include DNSSEC record types?
Yes. DNSKEY holds the public key that signs a zone, DS sits in the parent zone to link the chain of trust, RRSIG holds the signatures, NSEC and NSEC3 prove that a name does not exist, and CDS and CDNSKEY automate key changes with the parent. TLSA, SSHFP, OPENPGPKEY and SMIMEA also depend on DNSSEC.
Can this page look up my domain's DNS records?
No, it is a static reference. Use the DNS Lookup tool, linked above the table, to query the live records for any domain.