everydayapps.io / networkcalc
DNS Record Types
Common, DNSSEC, and modern records with purpose and example shape. Operational reference — SOA fields, TTL conventions, email auth, and PTR naming — on page 2.
Common records
| Type | Purpose | Example |
|---|---|---|
| A | IPv4 address for a name. | www 300 IN A 192.0.2.1 |
| AAAA | IPv6 address for a name. | www 300 IN AAAA 2001:db8::1 |
| CNAME | Alias — "see this other name instead". | cdn 300 IN CNAME example.com. |
| MX | Mail exchanger, with priority (lower wins). | @ 300 IN MX 10 mail.example.com. |
| TXT | Arbitrary text — SPF, DKIM, domain verification. | @ 300 IN TXT "v=spf1 -all" |
| NS | Authoritative name server for the zone. | @ 300 IN NS ns1.example.com. |
| SOA | Zone administrative metadata. One per zone. | @ IN SOA ns1 admin 2024... 7200 3600 1209600 300 |
| PTR | Reverse mapping — address back to name. | 1.2.0.192.in-addr.arpa. IN PTR host.example.com. |
| SRV | Service locator — _service._proto → port + host. | _sip._tcp 300 IN SRV 10 60 5060 sip.example.com. |
| CAA | Which CA may issue certs for this name. | @ 300 IN CAA 0 issue "letsencrypt.org" |
DNSSEC
| DNSKEY | Public key used to sign the zone. @ IN DNSKEY 257 3 13 mdsswUyr... |
|---|---|
| DS | Delegation signer — trust anchor at parent. child IN DS 12345 13 2 ab12... |
| RRSIG | Cryptographic signature over an RRset. www IN RRSIG A 13 3 300 2024... example.com. sig... |
| NSEC / NSEC3 | Authenticated proof a name does NOT exist. a.example. IN NSEC b.example. A RRSIG NSEC |
Modern & specialty
| SVCB / HTTPS | Service binding — ALPN, port, IP hints for HTTPS upgrade. example.com. HTTPS 1 . alpn="h3,h2" ipv4hint=192.0.2.1 |
|---|---|
| TLSA | DANE — binds a cert / hash to a port + protocol. _443._tcp.www IN TLSA 3 1 1 ab12... |
| SSHFP | SSH host key fingerprint (for verifying first connect). host IN SSHFP 4 2 ab12... |
| NAPTR | Regex-based rewrite — ENUM, SIP discovery. @ IN NAPTR 100 10 "u" "E2U+sip" "!^.*$!sip:...!" |
| LOC | Geographic coordinates (rarely set). @ IN LOC 42 21 54 N 71 06 18 W 12m |
| DNAME | Subtree alias — rewrites everything below a name. old.example. DNAME new.example. |
SOA field breakdown
| Field | Purpose |
|---|---|
| MNAME | Primary name server for the zone. |
| RNAME | Admin contact email — first "." replaces "@". |
| SERIAL | Zone version. Secondaries refresh when it grows. |
| REFRESH | Seconds secondary waits before polling primary. |
| RETRY | Seconds secondary waits after a failed refresh. |
| EXPIRE | Seconds secondary serves zone without primary contact. |
| MINIMUM | Negative-cache TTL (and historical default TTL). |
TTL conventions
| TTL | Label | When |
|---|---|---|
| 60 | Very short | Active failover / migration window. |
| 300 | Short (5 min) | Planned change — resolvers repoll fast. |
| 3600 | Standard (1 hr) | Typical production record. |
| 86400 | Long (1 day) | Stable long-lived records (NS, MX). |
| 172800 | Very long (2 d) | Infrastructure that never changes. |
Email authentication TXT patterns
| Record | At name | Value |
|---|---|---|
| SPF | @ | v=spf1 ip4:1.2.3.0/24 include:_spf.google.com ~all |
| DKIM | <selector>._domainkey | v=DKIM1; k=rsa; p=<base64 public key> |
| DMARC | _dmarc | v=DMARC1; p=reject; rua=mailto:dmarc@example.com; adkim=s; aspf=s |
| MTA-STS | _mta-sts | v=STSv1; id=<policy-version> |
| BIMI | default._bimi | v=BIMI1; l=https://…/logo.svg; a=https://…/cert.pem |
PTR (reverse) naming convention
IPv4: reverse the octets and append .in-addr.arpa. ·
IPv6: reverse each nibble, dot-separate, append .ip6.arpa.
| Forward | Reverse name |
|---|---|
| 192.0.2.1 | 1.2.0.192.in-addr.arpa. |
| 10.20.30.40 | 40.30.20.10.in-addr.arpa. |
| 2001:db8::1 | 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa. |