DNS Record Types Reference

A working reference for every DNS record type you'll actually run into — what it does, roughly what it looks like, and when you'd reach for it. Useful whether you're migrating a domain, setting up email authentication, or just trying to remember what a PTR record is for the third time this year.

How a lookup actually resolves

DNS is the internet's address book — it turns example.com into an IP address. A recursive resolver walks the hierarchy: root servers, then the TLD servers for .com or .co.uk, then the authoritative nameservers for the specific domain, which finally return the requested record. All of that typically finishes in well under 100ms, cached at multiple layers along the way so it doesn't have to happen from scratch every time.

Email authentication — the three records everyone eventually has to configure

• SPF (TXT) — lists which servers are authorised to send mail as your domain. v=spf1 include:_spf.google.com ~all is a typical example.
• DKIM (TXT) — cryptographically signs outgoing mail so recipients can verify it wasn't tampered with in transit.
• DMARC (TXT) — tells receiving servers what to do when a message fails SPF or DKIM: monitor, quarantine, or reject. This is the one that actually stops spoofed mail rather than just detecting it.

TTL — the setting people forget until they need it

TTL controls how long resolvers cache a record before re-checking it. A TTL of 3600 means an hour of stale answers persisting after you make a change. The habit worth building: drop the TTL to something short — 300 seconds — a day before any planned change (host migration, MX record swap), then put it back up once the change has settled. It shrinks the blast radius if something needs rolling back, and it means the change actually takes effect quickly instead of dribbling out over the old TTL window.

Commands worth having in muscle memory

• dig example.com MX — query a specific record type
• dig +trace example.com — walk the full resolution chain, root to authoritative
• dig @8.8.8.8 example.com — query a specific resolver directly, bypassing whatever your system is configured to use
• dig -t TXT _dmarc.example.com — check the DMARC record specifically