DNS glossary

Terms used in the rest of the wiki, defined once. Cross-linked where deeper coverage exists.

Test yourself#

Three one-liners that exercise terms defined below. example.isitdns.net is a real public zone; paste and run.

1. Recursion (RD, RA): rd ra in the flags line means the client asked for recursion and the server offered it.

dig @1.1.1.1 example.isitdns.net A

;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

1. AD bit: ad in the flags line means the resolver validated the DNSSEC chain (RFC 4035). Queried over DoH (+https) so nothing on the path can strip the flag.

dig @1.1.1.1 +https +dnssec example.isitdns.net A

;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

1. TTL: ask twice and the number in the second column drops, because the answer is counting down in a cache.

dig @1.1.1.1 +noall +answer example.isitdns.net A

example.isitdns.net.	13	IN	A	192.0.2.1
example.isitdns.net.	10	IN	A	192.0.2.1

A: F#

0x20 encoding: Query-name case randomization. The client mixes the case of the name it asks for (ExAmPlE.CoM) and requires the response to echo it back byte for byte, adding entropy against off-path spoofing. It works because DNS matching is case-insensitive while the wire format preserves the case as sent (RFC 4343). A middlebox that rewrites the name to lowercase shows up in the answer.

A record: Resource record mapping a name to an IPv4 address. See a and How do I use dig? Every record type, live.

AAAA record: Resource record mapping a name to an IPv6 address. Pronounced "quad-A." See aaaa and How do I use dig? Every record type, live.

AA (Authoritative Answer): Flag set in a DNS response when the responder is authoritative for the zone containing the answer. Always check before trusting an answer is canonical.

AD (Authenticated Data): Flag set in a response when the resolver successfully validated the DNSSEC signature chain. See dnssec.

Aggressive NSEC use: A validating resolver using an NSEC/NSEC3 record it already has cached to answer other names it can prove do not exist, without asking the authoritative server again (RFC 8198). Cuts junk queries to the authority; it also means a signed wildcard can be synthesized locally instead of fetched. See dnssec.

Anycast: Routing technique where multiple servers share the same IP address; clients reach the topologically nearest one. Used by major public resolvers (1.1.1.1, 8.8.8.8, 9.9.9.9). See fundamentals.

Authoritative server: Server that holds the master copy of a zone and answers definitively for it. Opposite of recursive.

AXFR: Full zone transfer. Used to seed a secondary nameserver from the primary. Almost always restricted by ACL or TSIG. See transfer.

CAA record: Tells public certificate authorities which CA may issue certificates for the zone. Compliant CAs must check it. See caa and caa-policy.

Cache hit: A resolver answering from its in-memory cache without going upstream. The cheapest possible answer.

Caching resolver: Same as a recursive resolver. The "recursive" part refers to how it answers; the "caching" part refers to what it remembers. See anatomy-of-a-query.

CD (Checking Disabled): Flag a client can set to ask the resolver NOT to validate DNSSEC. Rare; mostly for debugging.

CNAME: Canonical Name. An alias from one name to another. The resolver chases CNAMEs transparently. See cname and How do I use dig? Every record type, live.

Delegation: A parent zone handing authority for a subtree to a child zone, via NS records at the cut point. Glue records carry the addresses when the nameservers live inside the child. See delegations.

dig: The standard DNS query tool, shipped with most Linux distros. See dig-flags and nslookup-and-dig.

DNS Cookie: An EDNS(0) option (RFC 7873, updated by RFC 9018) that gives a server cheap evidence the client address is not spoofed. A UDP query carrying a client cookie but no valid server cookie leaves the server three choices (RFC 7873 §5.2.3): drop it silently, answer BADCOOKIE (rcode 23) with a fresh server cookie for the client to come back with, or just answer it. A spoofed source never sees the BADCOOKIE reply, so it cannot come back with the right cookie. The presence of a cookie option is not the same as a valid one.

DNSSEC: DNS Security Extensions. Adds cryptographic signatures to records so a validating resolver can prove an answer wasn't tampered with. See dnssec.

DNSKEY: DNSSEC public key record published in a zone. Resolvers use it to verify RRSIG records. See dnssec.

DoH: DNS over HTTPS. Encrypted DNS over port 443. See DoT, DoH, DoQ.

DoT: DNS over TLS. Encrypted DNS over port 853. See DoT, DoH, DoQ.

DoQ: DNS over QUIC (RFC 9250). Encrypted DNS transport using QUIC on UDP port 853; QUIC provides its own TLS-based security and multiplexing. See DoT, DoH, DoQ.

dnstap: Protocol for streaming DNS query/response events from a resolver to an analysis tool, using Protocol Buffers over a Unix or TCP socket. The modern replacement for syslog-based query logging. Defined at dnstap.info; supported by BIND, Knot, Unbound, and PowerDNS.

DS record: Delegation Signer. Published in the parent zone to fingerprint the child zone's DNSKEY. Builds the DNSSEC chain across delegation boundaries. See dnssec and delegations.

Ed25519: EdDSA signature scheme over Curve25519 (RFC 8032): 32-octet public keys, 64-octet signatures, verifiable offline against a published key. Registered as DNSSEC algorithm 15 (RFC 8080). See dnssec.

EDE (Extended DNS Error): An EDNS(0) option carrying a machine-readable reason code alongside the rcode, so a SERVFAIL can say why it failed instead of leaving you to guess (RFC 8914). See extended-dns-errors for the code table, and dnssec-troubleshooting for the DNSSEC ones.

EDNS(0): Extension Mechanisms for DNS (RFC 6891). Adds an OPT pseudo-record carrying options the original protocol could not: large UDP buffer sizes, the DNSSEC OK bit, and optional extensions such as COOKIE (RFC 7873) and CLIENT_SUBNET/ECS (RFC 7871, privacy-sensitive). See fundamentals and dnssec.

Forwarder: A resolver that sends every query to another recursive server upstream instead of walking the hierarchy itself. Common in enterprise networks and home routers. See forward.

FQDN: Fully Qualified Domain Name. A name with the trailing dot, fully resolved relative to root. isitdns.net. (with trailing dot) is an FQDN. Most applications and UIs omit the trailing dot by convention; zone files require it to prevent the $ORIGIN suffix from being appended. See fundamentals.

G: O#

Glue record: An A/AAAA record published in a parent zone for a nameserver of a child zone, used to break the chicken-and-egg of "how do I look up the NS for example.com when example.com's NS records are example.com names?" See delegations.

HTTPS / SVCB records: Service Binding records (RFC 9460). Let a name advertise connection parameters up front: ALPN protocols, address hints, ECH config. SVCB is type 64; the HTTPS record is its type-65 sibling, which browsers now query alongside A and AAAA. See https-svcb.

Insecure delegation: A delegation where the parent publishes NS records for the child but no DS, and proves the DS is absent with signed NSEC/NSEC3 (RFC 4035 §5.2). That authenticated denial is what tells a validator the child is provably unsigned, so it accepts the child's unsigned answers instead of returning SERVFAIL. See delegations.

IXFR: Incremental zone transfer. Like AXFR but only the records that changed since a given serial number. See transfer.

Lame delegation: When a zone's NS records point to nameservers that don't actually serve the zone. Common cause of intermittent SERVFAILs. See delegations.

Master / Primary / Slave / Secondary: Old terms (master/slave) and modern terms (primary/secondary) for the authoritative nameservers in a zone-transfer relationship. The primary holds the master copy; secondaries pull AXFR/IXFR. See transfer and authoritative zones.

MX record: Mail Exchanger. Names the mail server(s) for a domain, with a priority. See mx and email-records.

Negative cache: Resolver behavior of remembering a negative answer, both NXDOMAIN (name does not exist) and NODATA (name exists, type does not), for a bounded time. The actual negative cache TTL used is min(SOA MINIMUM field, SOA record TTL): RFC 2308 §5 says the TTL "is taken from the minimum of the SOA.MINIMUM field and SOA's TTL". Lowering either value shortens negative caching; raising MINIMUM above the SOA record's own TTL changes nothing, because that TTL is then the ceiling. Prevents the resolver from re-asking authoritative servers for typos. See soa and fundamentals.

NODATA: Not a real rcode: shorthand for a NOERROR response with an empty answer section. The name exists, but not with the type you asked for. Cached like NXDOMAIN per RFC 2308.

NOERROR: DNS rcode 0. The query was handled successfully: even if the answer section is empty.

Nonce: A number used once. In DNS diagnostics, a fresh random label placed in the query name so that no cache, forwarder, or precomputed answer can hold the response in advance: getting an answer at all means the query reached an authoritative server. See check-an-auth.

NS record: Names an authoritative nameserver for a zone. See ns, delegations, and How do I use dig? Every record type, live.

NSEC / NSEC3: DNSSEC records used to prove that a name does not exist (the cryptographic version of NXDOMAIN). Without these, an attacker could forge NXDOMAIN. See dnssec and dnssec-troubleshooting.

NSID: Name Server Identifier (RFC 5001). An EDNS(0) option asking the server which instance answered (dig +nsid). Handy behind anycast, but unauthenticated: anything on the path can strip or forge it, so treat it as a hint, not proof.

NXDOMAIN: DNS rcode 3. "Name does not exist." Definitive negative answer. Caveat: some hosted zones never emit it. DNSSEC-signed Cloudflare-hosted zones answer missing names with NOERROR plus a proving NSEC record instead, so an empty NOERROR can be the same verdict in disguise. Cloudflare shipped this as "black lies" before it had a standard; it is now RFC 9824, Compact Denial of Existence in DNSSEC, and the NXNAME meta-type (code 128) in the NSEC type bitmap is the signal that the name truly does not exist. Unsigned Cloudflare zones still return a real NXDOMAIN. See dnssec.

OPT pseudo-record: The EDNS extension record. Lives in the additional section of every EDNS-enabled query.

P: Z#

PTR record: Reverse DNS. Maps an IP back to a name. Stored under *.in-addr.arpa (IPv4) or *.ip6.arpa (IPv6). See ptr, reverse-dns, and How do I use dig? Every record type, live.

QName: Question Name. The name being asked about in a DNS query. See query-types and anatomy-of-a-query.

QNAME minimization: Resolver behaviour of sending each server only as much of the query name as it needs to give a referral, walking down the delegation one label at a time instead of handing the full name to every server on the way (RFC 9156, which obsoletes RFC 7816). Limits what each server learns. It relies on intermediate names answering NODATA rather than NXDOMAIN, because an NXDOMAIN at any cut denies everything below it (RFC 8020). See anatomy-of-a-query.

QType: Question Type. The record type being asked about (A, AAAA, MX, …). See query-types.

RA (Recursion Available): Response flag. The server is willing to recurse on behalf of the client. Authoritative-only servers should NOT set this.

rcode: Response code. The verdict in a DNS answer. Common values: NOERROR (0), FORMERR (1), SERVFAIL (2), NXDOMAIN (3), NOTIMP (4), REFUSED (5). See DNS fundamentals: refresher.

RD (Recursion Desired): Query flag. The client wants the resolver to do the recursion. Default for most stub-resolver queries.

Recursive resolver: Server that walks the DNS hierarchy on behalf of a client, caching results. The one in your /etc/resolv.conf. Opposite of authoritative. See anatomy-of-a-query and forward.

REFUSED: DNS rcode 5. The server refused to answer. Usually means the client is outside the recursion ACL, or recursion is off and the question was not for an owned zone.

Root server: One of the 13 logical name servers (a.root-servers.net through m.root-servers.net) that serve the root zone (.). Operated by 12 different organizations. Implemented as anycast: the 13 letters are backed by more than 2,000 server instances worldwide in total as of July 2026 (live count at root-servers.org). See anatomy-of-a-query.

RPZ: Response Policy Zone. A mechanism for a resolver to rewrite responses based on a policy zone: used for threat-feed blocking, DNS firewall, captive-portal redirection. Visible in dnstap output as policy_* fields (policy_action, policy_type, policy_value). Specified in the ISC RPZ draft; supported by BIND, Unbound, Knot Resolver, and PowerDNS Recursor. See forward for resolver configuration context.

RRSIG: DNSSEC signature record. Cryptographically signs an RRset. Verified against the zone's DNSKEY. See dnssec.

RRset: A set of resource records sharing the same name, class, and type. Signed (in DNSSEC) and cached together.

SERVFAIL: DNS rcode 2. "Server failure." Could mean upstream broken, DNSSEC validation failed, recursion timeout, or a software bug. Always investigate. See when-its-dns.

SOA record: Start of Authority. Zone metadata: primary NS, admin contact, serial, refresh/retry/expire timers, negative-cache TTL. Every zone has exactly one at its apex. See soa and How do I use dig? Every record type, live.

Split-horizon DNS (also called DNS views): A name resolves to different answers depending on who is asking. Common pattern: internal clients get RFC1918 addresses, external clients get public ones. Implemented via an ACL that matches clients to a view, where each view holds its own copy of the zone. See split-horizon and authoritative zones for working examples.

SRV record: Service location. Names a host and port for a service, with priority + weight. Used by XMPP, SIP, LDAP, etc. See srv and How do I use dig? Every record type, live.

Stub resolver: Minimal client-side resolver, usually built into the OS. Asks a recursive resolver a single question and relays the answer back to the application. Never recurses itself. See anatomy-of-a-query and stub.

TC (Truncated): Response flag set when a UDP answer does not fit in the packet. Tells the client to retry over TCP. RFC 1035 defines the flag; EDNS(0) raises the practical limit of UDP payload size, reducing how often truncation occurs. See fundamentals.

TLD: Top-Level Domain. The last label of an FQDN: .com, .net, .org, ccTLDs like .uk, new gTLDs like .cafe.

TSIG: Transaction Signature. HMAC-based authentication for DNS messages, used to authorize AXFR/IXFR/UPDATE. See transfer and ddns.

TTL: Time To Live. How long, in seconds, resolvers may cache a record before re-asking authoritative. See DNS fundamentals: refresher.

TXT record: Arbitrary text. Used for SPF, DKIM, DMARC, domain verification. See txt, email-records, and How do I use dig? Every record type, live.

View (DNS view): A scoped set of zones served only to clients that match a given ACL. BIND implements views directly (the view statement), as does Unbound (the view: clause); other servers reach the same effect through modules or scripted backends. Views are the mechanism behind split-horizon DNS: same zone name, different copies per view, ACL chooses which. See split-horizon and authoritative zones for working examples.

Wildcard record: A record at *.zone that matches any name below that node for which no closer explicit record exists, at any depth (RFC 4592). The common belief that a wildcard only matches one label is incorrect; a closer explicit node stops synthesis for names in that subtree. See How do I use dig? Every record type, live.

Zone: A contiguous portion of the DNS namespace administered as a unit. isitdns.net is a zone; so is example.isitdns.net if it has been delegated separately. See authoritative zones and delegations.

Zone apex: The top of a zone: the name that matches the zone itself (isitdns.net for the isitdns.net zone). Must contain SOA and NS records. See soa, ns, and authoritative zones.

Acronym quick-reference#

See also#

• DNS fundamentals
• The dig-along
• Record-type cheat sheet
• dig flag reference
• nslookup and dig
• Anatomy of a query
• RFC index
• DNS wiki home