Reference
📋 Record type cheat sheet
Asks for the type every other row on this page is compared against.
dig @1.1.1.1 example.isitdns.net A; <<>> DiG 9.20.11-0ubuntu0.2-Ubuntu <<>> @1.1.1.1 example.isitdns.net A
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36864
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;example.isitdns.net. IN A
;; ANSWER SECTION:
example.isitdns.net. 300 IN A 192.0.2.1
;; Query time: 35 msec
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
;; WHEN: Mon Sep 14 17:42:30 CDT 2026
;; MSG SIZE rcvd: 64
GO NOERROR and one A record
NO GO NOERROR with no answer, which means the name exists with no address
Common types#
| Type | # | What it holds | RFC | Page |
|---|---|---|---|---|
| A | 1 | IPv4 address | 1035 | A → |
| AAAA | 28 | IPv6 address | 3596 | AAAA → |
| CNAME | 5 | Alias to another name | 1035 | CNAME → |
| MX | 15 | Mail exchange host and priority | 1035 | MX → |
| NS | 2 | Authoritative nameserver | 1035 | NS → |
| SOA | 6 | Zone serial, timers, admin contact | 1035 | SOA → |
| TXT | 16 | Arbitrary text: SPF, DKIM, DMARC, verification | 1035 | TXT → |
| PTR | 12 | Reverse mapping, IP to name | 1035 | PTR → |
Specialized types#
| Type | # | What it holds | RFC | Page |
|---|---|---|---|---|
| CAA | 257 | Certificate authorities allowed to issue for the name | 8659 | CAA → |
| SRV | 33 | Service location: priority, weight, port, target | 2782 | SRV → |
| HTTPS / SVCB | 65 / 64 | HTTPS endpoint hints: ALPN, port, ECH | 9460 | HTTPS/SVCB → |
| TLSA | 52 | Certificate pin for DANE | 6698 | TLSA → |
| SSHFP | 44 | SSH host key fingerprint | 4255 | SSHFP → |
| DNSKEY | 48 | Zone signing keys: KSK (flags 257), ZSK (flags 256) | 4034 | DNSSEC → |
| DS | 43 | Parent's hash of the child's KSK | 4034 | DNSSEC → |
| RRSIG | 46 | Signature over a record set | 4034 | DNSSEC → |
| NSEC | 47 | Ordered name list proving non-existence | 4034 | DNSSEC → |
| NSEC3 | 50 | Hashed non-existence proof. Opt-out for unsigned delegations is a signing/response-size measure, not an enumeration defense (RFC 5155 §6) | 5155 | DNSSEC → |
| CDS / CDNSKEY | 59 / 60 | Child-published DS/DNSKEY for automated KSK rollover | 7344 | DNSSEC → |
| NAPTR | 35 | URI rewriting: ENUM, SIP, S-NAPTR discovery | 3403 | - |
| LOC | 29 | Geographic location | 1876 | - |
| URI | 256 | URI mapping | 7553 | - |
| DNAME | 39 | Alias for an entire subtree, like CNAME for everything under the owner name | 6672 | CNAME → |
| HINFO | 13 | Host/OS info; some servers return it as the synthetic answer to ANY queries (RFC 8482) | 1035 | - |
Obsolete types#
| Type | # | What it holds | RFC | Page |
|---|---|---|---|---|
| SPF | 99 | Duplicate of TXT for SPF policy. RFC 7208 §3.1 requires TXT instead | 7208 | TXT → |
| WKS | 11 | Well-known service list; predates modern service discovery | 1035 | - |
| RP | 17 | Responsible-person contact; unused | 1183 | - |
| AFSDB | 18 | AFS cell server location; AFS is essentially unused | 1183 | - |
| KEY / SIG | 25 / 24 | First-generation DNSSEC keys and signatures. RFC 3755 replaced their type codes with DNSKEY/RRSIG; RFC 4033-4035 supersede them for zone signing. They survive only for SIG(0) transaction signatures (RFC 2931) and TKEY (RFC 2930) | 2535 | - |
| ATMA | 34 | ATM network address; obsolete transport, no RFC (ATM Forum spec) | - | - |
| GPOS | 27 | Geographic position, superseded by LOC | 1712 | - |
See also#
- dig-along for hands-on every type
- dig-flags for flag reference
- nslookup-and-dig for tool comparison
- query-types for recursive vs authoritative
- fundamentals
- reverse-dns for the
.arpastory - dnssec for the signing chain