DNS glossary
Asks for one address, so the words on this page have something to point at.
dig @1.1.1.1 example.isitdns.net AGO NOERROR, one A record, 192.0.2.1
NO GO SERVFAIL, or any address that is not 192.0.2.1
A: F#
0x20 encoding: Query-name case randomization: the client mixes the case of the name it asks for (ExAmPlE.CoM) and requires the response to echo it back byte for byte, adding entropy against off-path spoofing (draft-vixie-dnsext-dns0x20).
A record: Resource record mapping a name to an IPv4 address. See a and How do I use dig? Ten record types, live.
AAAA record: Resource record mapping a name to an IPv6 address. Pronounced "quad-A." See aaaa and How do I use dig? Ten record types, live.
Aggressive NSEC use: A validating resolver answers other provably nonexistent names from a cached NSEC/NSEC3 record instead of asking the authority again (RFC 8198). See dnssec.
Anycast: Routing technique where multiple servers share one IP address and clients reach the topologically nearest instance. See fundamentals.
Authoritative server: Server that holds a complete copy of a zone and answers definitively for it (RFC 9499 §6). Opposite of recursive.
AXFR: Full zone transfer, used to seed a secondary nameserver from the primary. See transfer.
CAA record: Tells public certificate authorities which CA is authorized to issue certificates for the zone. See caa and caa-policy.
Cache hit: A resolver answering from its in-memory cache without going upstream. The cheapest possible answer.
Caching resolver: Same as a recursive resolver: "recursive" is how it answers, "caching" is what it remembers. See anatomy-of-a-query.
CNAME: Canonical Name, an alias from one name to another that the resolver chases transparently. See cname and How do I use dig? Ten record types, live.
Delegation: A parent zone handing authority for a subtree to a child zone via NS records at the cut point. See delegations.
dig: The standard DNS query tool, shipped with most Linux distros. See dig-flags and nslookup-and-dig.
DNS Cookie: An EDNS(0) option giving a server cheap evidence a UDP client's address isn't spoofed (RFC 7873, updated by RFC 9018). A request with no valid server cookie is dropped, answered with BADCOOKIE, or answered normally, by server policy (RFC 7873 section 5.2.3); a spoofed source never sees the reply that carries the right server cookie.
DNSSEC: DNS Security Extensions. Adds cryptographic signatures to records so a validating resolver can prove an answer wasn't tampered with. See dnssec.
DNSKEY: DNSSEC public key record published in a zone. Resolvers use it to verify RRSIG records. See dnssec.
DoH: DNS over HTTPS. Encrypted DNS over port 443. See DoT, DoH, DoQ.
DoT: DNS over TLS. Encrypted DNS over port 853. See DoT, DoH, DoQ.
DoQ: DNS over QUIC (RFC 9250), encrypted DNS on UDP port 853. See DoT, DoH, DoQ.
dnstap: Protocol for streaming DNS query/response events from a resolver to an analysis tool, using Protocol Buffers over a Unix or TCP socket. Defined at dnstap.info; supported by BIND, Knot, Unbound, and PowerDNS.
DS record: Delegation Signer, published in the parent zone to fingerprint the child zone's DNSKEY. See dnssec and delegations.
Ed25519: EdDSA signature scheme over Curve25519 (RFC 8032): 32-octet public keys, 64-octet signatures. Registered as DNSSEC algorithm 15 (RFC 8080). See dnssec.
EDE (Extended DNS Error): An EDNS(0) option carrying a machine-readable reason code alongside the rcode, so a SERVFAIL can say why (RFC 8914). See extended-dns-errors and dnssec-troubleshooting.
EDNS(0): Extension Mechanisms for DNS (RFC 6891). Adds an OPT pseudo-record carrying options the original protocol lacked: large UDP buffers, the DNSSEC OK bit, COOKIE, and CLIENT_SUBNET/ECS. See fundamentals and dnssec.
Forwarder: A resolver that sends queries to another recursive server upstream instead of walking the hierarchy itself. See forward.
FQDN: Fully Qualified Domain Name, resolved relative to root with the trailing dot: isitdns.net. is an FQDN. See fundamentals.
G: O#
Glue record: An A/AAAA record published in the parent zone for a nameserver inside the child zone, breaking the lookup's circular dependency. See delegations.
Header flags (qr, aa, tc, rd, ra, ad, cd): the flags line of every answer. What each one says is on dig-flags, the one place this wiki defines them.
HTTPS / SVCB records: Service Binding records (RFC 9460) that let a name advertise connection parameters up front: ALPN, address hints, ECH config. SVCB is type 64; HTTPS is its type-65 sibling. See https-svcb.
Insecure delegation: A delegation where the parent publishes NS records for the child but no DS, proving the absence with signed NSEC/NSEC3 (RFC 4035 §5.2) so a validator accepts the child's unsigned answers instead of SERVFAIL. See delegations.
IXFR: Incremental zone transfer. Like AXFR but only the records changed since a given serial number. See transfer.
Lame delegation: When a zone's NS records point to nameservers that don't actually serve the zone. Common cause of intermittent SERVFAILs. See delegations.
Master / Primary / Slave / Secondary: Old terms (master/slave) and current terms (primary/secondary, RFC 9499 §6) for the nameservers in a zone-transfer relationship: the primary holds the master copy, secondaries pull AXFR/IXFR. See transfer and authoritative zones.
MX record: Mail Exchanger. Names the mail server(s) for a domain, with a priority. See mx and email-records.
Negative cache: Resolver behavior of remembering a negative answer, both NXDOMAIN and NODATA, for a bounded time: min(SOA MINIMUM field, SOA record TTL) (RFC 2308 §5). Raising MINIMUM above the record's own TTL changes nothing, since that TTL is then the ceiling. See soa and fundamentals.
NODATA: Shorthand for a NOERROR response with an empty answer section: the name exists, but not with the type asked for. Cached like NXDOMAIN (RFC 2308).
NOERROR: DNS rcode 0. The query was handled successfully, even if the answer section is empty.
Nonce: A number used once: a fresh random label in the query name so no cache or forwarder can hold the response in advance. See check-an-auth.
NS record: Names an authoritative nameserver for a zone. See ns, delegations, and How do I use dig? Ten record types, live.
NSEC / NSEC3: DNSSEC records used to prove that a name does not exist, the cryptographic version of NXDOMAIN. See dnssec and dnssec-troubleshooting.
NSID: Name Server Identifier (RFC 5001), an EDNS(0) option asking which instance answered (dig +nsid). Unauthenticated: anything on the path can strip or forge it, so treat it as a hint, not proof.
NXDOMAIN: DNS rcode 3, "name does not exist," a definitive negative answer. Some DNSSEC-signed zones never emit it: they answer missing names with NOERROR plus a proving NSEC record instead (RFC 9824, Compact Denial of Existence), with the NXNAME meta-type (code 128) in that bitmap saying the name truly doesn't exist. See dnssec.
OPT pseudo-record: The EDNS extension record. Lives in the additional section of every EDNS-enabled query.
P: Z#
PTR record: Reverse DNS. Maps an IP back to a name, stored under *.in-addr.arpa (IPv4) or *.ip6.arpa (IPv6). See ptr, reverse-dns, and How do I use dig? Ten record types, live.
QName: Question Name. The name being asked about in a DNS query. See query-types and anatomy-of-a-query.
QNAME minimization: Resolver behaviour of sending each server only as much of the query name as it needs for a referral, walking the delegation one label at a time (RFC 9156, obsoletes RFC 7816). Relies on intermediate names answering NODATA rather than NXDOMAIN, since NXDOMAIN at any cut denies everything below it (RFC 8020). See anatomy-of-a-query.
QType: Question Type. The record type being asked about (A, AAAA, MX, …). See query-types.
rcode: Response code, the verdict in a DNS answer. Common values: NOERROR (0), FORMERR (1), SERVFAIL (2), NXDOMAIN (3), NOTIMP (4), REFUSED (5). See DNS fundamentals: refresher.
Recursive resolver: Server that walks the DNS hierarchy on behalf of a client, caching results; the one in your /etc/resolv.conf. See anatomy-of-a-query and forward.
REFUSED: DNS rcode 5 (RFC 1035 §4.1.1). The server refused to answer, usually because the client is outside the recursion ACL, or recursion is off and the question was not for an owned zone.
Root server: One of the 13 logical name servers (a.root-servers.net through m.root-servers.net, 12 operators) serving the root zone (.). Implemented as anycast: thousands of instances worldwide, live count at root-servers.org. See anatomy-of-a-query.
RPZ: Response Policy Zone. A mechanism for a resolver to rewrite responses based on a policy zone: threat-feed blocking, DNS firewall, captive-portal redirection. Visible in dnstap output as policy_* fields. Specified in draft-vixie-dnsop-dns-rpz; supported by BIND, Unbound, Knot Resolver, and PowerDNS Recursor. See forward.
RRSIG: DNSSEC signature record. Cryptographically signs an RRset, verified against the zone's DNSKEY. See dnssec.
RRset: A set of resource records sharing the same name, class, and type. Signed (in DNSSEC) and cached together.
SERVFAIL: DNS rcode 2, "server failure": upstream broken, DNSSEC validation failed, recursion timeout, or a software bug. See when-its-dns.
SOA record: Start of Authority. Zone metadata: primary NS, admin contact, serial, refresh/retry/expire timers, negative-cache TTL. Every zone has exactly one at its apex. See soa and How do I use dig? Ten record types, live.
Split-horizon DNS (also called DNS views): A name resolves to different answers depending on who is asking, via an ACL that matches clients to a view, each view holding its own copy of the zone. Common pattern: internal clients get RFC1918 addresses, external clients get public ones. See split-horizon and authoritative zones.
SRV record: Service location. Names a host and port for a service, with priority + weight. Used by XMPP, SIP, LDAP, etc. See srv and How do I use dig? Ten record types, live.
Stub resolver: Minimal client-side resolver, usually built into the OS, that asks a recursive resolver one question and relays the answer to the application. See anatomy-of-a-query and stub.
TLD: Top-Level Domain. The last label of an FQDN: .com, .net, .org, ccTLDs like .uk, new gTLDs like .cafe.
TSIG: Transaction Signature. HMAC-based authentication for DNS messages, used to authorize AXFR/IXFR/UPDATE. See transfer and ddns.
TTL: Time To Live. The longest, in seconds, a resolver keeps a record in its cache before re-asking authoritative; it can re-ask sooner (RFC 1035 section 3.2.1). A resolver that serves stale data keeps it past that bound (RFC 8767). See DNS fundamentals: refresher.
TXT record: Arbitrary text. Used for SPF, DKIM, DMARC, domain verification. See txt, email-records, and How do I use dig? Ten record types, live.
View (DNS view): The mechanism behind split-horizon DNS: a scoped set of zones served only to clients matching a given ACL. BIND implements views directly (the view statement); Unbound has the view: clause. See split-horizon.
Wildcard record: A record at *.zone that matches any name below that node for which no closer explicit record exists, at any depth, under the closest-encloser rule (RFC 4592 §3.3.1). See How do I use dig? Ten record types, live.
Zone: A contiguous portion of the DNS namespace administered as a unit. isitdns.net is a zone; so is example.isitdns.net if it has been delegated separately. See authoritative zones and delegations.
Zone apex: The top of a zone: the name that matches the zone itself (isitdns.net for the isitdns.net zone). Must contain SOA and NS records. See soa, ns, and authoritative zones.