Explainer cheatsheetFor anyone, no tech background neededSimple, analogy, technical
DNS
Decoded
A, AAAA, CNAME, MX, TXT, NS, TTL. The words on your domain settings page look like a secret code, but each one is a simple idea: an address book entry with a job. Ten short modules take you from "what is DNS?" to reading any record, each explained in plain words, an everyday picture and the full technical detail.
The map of this cheatsheetTap a box to jump to its module
DNS in one minute
Start here. DNS turns the names people remember into the numbers computers use, a few billion times a second around the world.
In simple words
Every website lives on a computer with a numeric address, an IP address such as 104.21.3.7. Nobody wants to remember those, so we use names like letterpad.io. The Domain Name System, DNS for short, is the worldwide service that looks a name up and hands back its number, before your browser even starts loading the page.
Think of it like
DNS is the contacts app of the internet. You tap "Mom", not her number. Your phone looks it up and dials. If Mom gets a new number, you update one contact and everything keeps working. Websites move servers all the time for the same reason, and visitors never notice.
Swipe sideways to see the whole diagram
- 1You type a domain name, the part people remember.
- 2DNS finds the matching record, like a contact entry.
- 3Your device gets the IP address and connects to it.
| Term | In everyday words |
|---|---|
| Domain name | The name you type: letterpad.io |
| IP address | The number a computer really connects to |
| DNS record | One entry in the address book, such as "letterpad.io lives at 104.21.3.7" |
| Resolver | The helper that does the looking up for you |
| Nameserver | The official book that holds a domain's records |
Technical deep diveTap to fold
- DNS
- A distributed, hierarchical database defined in RFC 1034 and RFC 1035 (1987). No single server holds every name; authority is split across millions of servers.
- Query and response
- A small message, usually over UDP port 53, asking for a name and a record type. Larger answers or zone transfers use TCP port 53.
- Speed
- A cached answer returns in about a millisecond; a full lookup from scratch takes tens of milliseconds.
- Scale
- Public resolvers such as Cloudflare 1.1.1.1 and Google 8.8.8.8 each answer well over a trillion queries a day.
Reading a domain name
A domain name is an address written backwards: it starts with the specific part on the left and ends with the most general part on the right.
In simple words
Split a name at its dots. The last part, like .com, .in or .io, is the top level domain. The part before it is the domain someone registered, like letterpad. Anything further left, like blog or www, is a subdomain the owner made up. There is even a hidden dot at the very end, the root, where every lookup begins.
Think of it like
A postal address read from the bottom up. India (TLD), then Delhi (domain), then Connaught Place (subdomain), then flat 4B. The country does not know your flat; it only knows which city to hand the letter to. Each level only knows the next level down.
Swipe sideways to see the whole diagram
- 1Subdomain: free to create, as many as you like: www, blog, api, mail.
- 2Domain (second level): rented yearly from a registrar.
- 3TLD: run by a registry; .io, .com, .in, .dev.
- 4The trailing dot is the root; browsers hide it.
Swipe sideways to see the whole diagram
- 1The root sits at the top of one global tree.
- 2Each TLD is a branch; there are over 1,500.
- 3Your zone is your own branch; you decide what grows on it.
Technical deep diveTap to fold
- Label
- Each part between dots. Up to 63 characters; a full name up to 253. Letters, digits and hyphens; case does not matter.
- FQDN
- Fully qualified domain name: the complete name ending in the root dot,
blog.letterpad.io.. Zone files require that dot; forgetting it is a classic mistake. - gTLD and ccTLD
- Generic TLDs (.com, .org, .dev) and two-letter country code TLDs (.in, .uk, .io, which is technically British Indian Ocean Territory).
- Apex
- The bare domain with no subdomain,
letterpad.io. Also called the root domain or zone apex. It has special rules, see module 04. - IDN
- Internationalised domain names in non-Latin scripts are stored as Punycode, for example
xn--followed by ASCII.
Following one lookup
No server knows every name. A resolver asks a chain of servers, each one pointing closer to the answer, then remembers the result.
In simple words
Your phone hands the question to a resolver, usually run by your internet provider or a public service like 1.1.1.1. The resolver asks a root server "who handles .io?", then asks the .io servers "who handles letterpad.io?", then asks letterpad's own authoritative nameserver, which gives the final answer. The resolver passes it back and keeps a copy for next time.
Think of it like
Asking a librarian for a book. You ask at the front desk (resolver). The librarian checks the building map (root): "Science, second floor." The floor guide (TLD) says "aisle 12." The shelf label (authoritative) shows the exact book. Next time anyone asks, the librarian already knows.
Swipe sideways to see the whole diagram
- 1Your device sends a recursive query: "find this for me."
- 2The root refers the resolver to the TLD servers.
- 3The TLD refers it to the domain's nameservers.
- 4The authoritative server gives the actual record.
- 5The resolver answers and caches it for the record's TTL.
Technical deep diveTap to fold
- Stub resolver
- The tiny DNS client in your OS. It never chases referrals; it sends one recursive query and waits.
- Recursive resolver
- Does the chasing, sending iterative queries that return referrals until it reaches an authoritative answer. Also called a recursive or caching resolver.
- Root servers
- 13 named identities,
a.root-servers.nettom.root-servers.net, served from more than 1,900 sites worldwide using anycast. - Authoritative answer
- Marked with the
AAflag. Answers from a cache are non-authoritative but just as valid until the TTL runs out. - Caching everywhere
- Browsers, operating systems, home routers and resolvers all cache, so most lookups never leave your city.
Try it: dig +trace letterpad.io prints every hop of this chain; dig letterpad.io shows only the final answer.
dig letterpad.io A +noall +answer +stats$ dig letterpad.io A +noall +answer +stats letterpad.io. 300 IN A 104.21.3.7 ;; Query time: 18 msec ;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
A and AAAA: the address records
The two records that answer "where is this name?" A gives an IPv4 address, AAAA gives an IPv6 address.
In simple words
An A record says "this name lives at this address", using the classic four-number format like 104.21.3.7. An AAAA record (say "quad A") does the same for the newer, much longer IPv6 format. Most sites publish both, and your device uses whichever works best.
Think of it like
A house with two addresses: the old postal address everyone knows (A, IPv4) and a new digital address with far more room (AAAA, IPv6). Couriers can use either; both lead to the same front door.
Swipe sideways to see the whole diagram
- 1Name: which domain or subdomain this entry is for.
- 2TTL: how many seconds anyone may cache the answer.
- 3Class: almost always
IN, for internet. - 4Type: what kind of record: A, AAAA, CNAME, MX and so on.
- 5Data: the value; for an A record, an IPv4 address.
Swipe sideways to see the whole diagram
- 1Your device asks for both records at once.
- 2The A record returns a 32 bit IPv4 address; the AAAA record a 128 bit IPv6 address.
- 3Happy Eyeballs races the two connections and keeps the fastest.
| Record | Answer looks like | Use it for |
|---|---|---|
| A | 104.21.3.7 | Pointing a name at an IPv4 server |
| AAAA | 2606:4700::6815:307 | Pointing a name at an IPv6 server |
| Several A records | Two or more IPs | Simple load spreading (round robin) |
Wildcard * | *.letterpad.io A … | Any subdomain not listed explicitly |
Technical deep diveTap to fold
- Why "AAAA"
- An IPv6 address is four times the length of an IPv4 address: 128 bits versus 32. Hence four As.
- Round robin
- With several A records, resolvers rotate their order, roughly spreading visitors across servers. It is not real load balancing: there is no health check.
- Wildcard record
*.letterpad.iomatches any name below letterpad.io that has no record of its own. Explicit records always win.- Private addresses
- An A record can point to 10.x, 172.16 to 31.x or 192.168.x addresses, which only work inside a private network. Useful for internal tools, confusing if published publicly.
dig letterpad.io A +short
dig letterpad.io AAAA +short$ dig letterpad.io A +short 104.21.3.7 172.67.180.12 $ dig letterpad.io AAAA +short 2606:4700:3031::6815:307
CNAME: a name that points to a name
A CNAME says "this name is just another name for that one." The resolver follows the chain until it reaches a real address.
In simple words
Sometimes you do not want to type an address at all. A CNAME (canonical name) record makes www.letterpad.io an alias of letterpad.netlify.app. When the hosting company changes its servers, it updates its own A records, and your alias keeps following it automatically.
Think of it like
Mail forwarding. Letters to your old flat get a sticker: "now at this other address." The postman follows the sticker. You never have to tell every friend about the move, because the forwarding does it for you.
Swipe sideways to see the whole diagram
- 1www.letterpad.io has a CNAME pointing at another name.
- 2The resolver looks up that canonical name and finds its A record.
- 3The apex cannot hold a CNAME; providers offer ALIAS or ANAME records, or CNAME flattening, instead.
| Question | Answer |
|---|---|
| Can a CNAME point to another CNAME? | Yes, resolvers follow chains, but keep them short: each hop is another lookup. |
| Can a name have a CNAME and other records? | No. A CNAME must be the only record at that name. |
| Can the bare domain be a CNAME? | No, because it must also hold NS and SOA. Use A, AAAA or a provider's ALIAS. |
| Is a CNAME a redirect? | No. The browser still shows your name; only the DNS lookup is forwarded. A visible redirect is an HTTP feature. |
Technical deep diveTap to fold
- Canonical name
- The target name a CNAME points to, the "true" name. RFC 1034 forbids other data alongside a CNAME.
- CNAME flattening
- Some DNS hosts (Cloudflare, DNSimple and others) resolve the chain themselves and serve plain A and AAAA records at the apex. Also sold as ALIAS or ANAME.
- DNAME
- A rarely used cousin that aliases an entire subtree, every name under one domain, to another domain.
- SaaS setup
- Most platforms (GitHub Pages, Vercel, Netlify, Shopify) ask you to add a CNAME for
wwwand an A or ALIAS for the apex.
dig www.letterpad.io +noall +answer$ dig www.letterpad.io +noall +answer www.letterpad.io. 300 IN CNAME letterpad.netlify.app. letterpad.netlify.app. 20 IN A 75.2.60.5
MX and TXT: mail and proof
MX records tell the world where to deliver your email. TXT records hold short notes, used to prove ownership and to fight forged mail.
In simple words
When someone emails you@letterpad.io, their server looks up the MX record (mail exchanger) to find which server accepts mail for letterpad.io. Lower numbers are tried first. TXT records are plain text notes on your domain; mail servers read three of them, SPF, DKIM and DMARC, to check a message really came from you.
Think of it like
MX is the sign on a building saying "deliveries at the back gate; if closed, use the side gate." The TXT records are the guard's checklist: a list of couriers allowed to deliver for you (SPF), a wax seal only you can stamp (DKIM), and instructions for what to do with anything suspicious (DMARC).
Swipe sideways to see the whole diagram
- 1The sender asks DNS for the MX records of the recipient's domain.
- 2It tries the lowest priority number first; others are backups.
- 3The receiver checks SPF, DKIM and DMARC before trusting the message.
| Record | Example value | What it says |
|---|---|---|
| MX | 10 mx1.zoho.in. | Deliver mail here first |
| SPF (TXT) | v=spf1 include:_spf.google.com -all | Only these servers may send as us |
| DKIM (TXT) | v=DKIM1; k=rsa; p=MIIBIjAN… | Public key to verify our signature |
| DMARC (TXT) | v=DMARC1; p=quarantine; rua=mailto:… | If checks fail, quarantine and report to us |
| Verification (TXT) | google-site-verification=… | Proof for Google, GitHub, Microsoft that you own the domain |
Technical deep diveTap to fold
- MX priority
- Lower is preferred. Equal priorities share the load. An MX must point to a hostname with A or AAAA records, never directly to an IP or a CNAME.
- SPF
- Sender Policy Framework (RFC 7208): lists allowed sending IPs.
-allrejects others,~allsoft-fails. Limited to 10 DNS lookups per check. - DKIM
- DomainKeys Identified Mail (RFC 6376): the sender signs headers with a private key; the public key lives at
selector._domainkey.letterpad.io. - DMARC
- RFC 7489: at
_dmarc.letterpad.io, it ties SPF and DKIM to the visible From address and sets a policy:none,quarantineorreject. Gmail and Yahoo require it for bulk senders. - TXT limits
- Each string inside a TXT record is at most 255 characters; longer values like DKIM keys are split into several quoted strings.
dig letterpad.io MX +short
dig letterpad.io TXT +short
dig _dmarc.letterpad.io TXT +short$ dig letterpad.io MX +short 10 mx1.zoho.in. 20 mx2.zoho.in. $ dig _dmarc.letterpad.io TXT +short "v=DMARC1; p=quarantine; rua=mailto:dmarc@letterpad.io"
NS and SOA: who is in charge
NS records name the servers that hold the official records for a domain. The SOA record is the zone's title page.
In simple words
You buy a domain from a registrar (like GoDaddy or Namecheap), but your records may be hosted somewhere else (like Cloudflare). The NS records connect the two: they tell the world "the official list for letterpad.io is kept on these nameservers." The SOA record at the top of that list names the main server and a version number.
Think of it like
Buying a flat versus storing its paperwork. The housing authority (registry) records that you own flat 4B and which office keeps its files (NS). That office (nameservers) holds the actual paperwork (records). The cover sheet of the file (SOA) says who maintains it and which edition this is.
Swipe sideways to see the whole diagram
- 1At the registrar you choose which nameservers host your DNS.
- 2The registry for .io publishes that choice as a delegation.
- 3The nameservers hold your zone file, starting with the SOA record.
| SOA field | Meaning |
|---|---|
| Primary nameserver | The main source of truth for the zone |
| Admin email | Written with a dot instead of @: dns.letterpad.io. |
| Serial | Version number, often a date: 2026101901. Bumped on every change |
| Refresh, retry, expire | How often secondary servers check for changes, and when they give up |
| Minimum (negative TTL) | How long resolvers may cache "this name does not exist" |
Technical deep diveTap to fold
- Zone
- The part of the tree one operator controls, from the apex down to where it delegates further.
@in a zone file means the apex itself. - Delegation
- NS records in the parent zone (.io) that hand authority for a child (letterpad.io) to other servers.
- Glue records
- If the nameservers sit inside the domain they serve (
ns1.letterpad.io), the parent also stores their IPs, so resolvers are not stuck in a loop. - Primary and secondary
- Secondary nameservers copy the zone from the primary by zone transfer (AXFR or IXFR) when the SOA serial increases. Most hosted DNS handles this for you.
- Changing DNS host
- Copy every record to the new host first, then change NS at the registrar. The parent's NS TTL is often 1 to 2 days, so keep the old host running meanwhile.
dig letterpad.io NS +short
dig letterpad.io SOA +short
whois letterpad.io | grep -i "name server"$ dig letterpad.io NS +short ns1.cloudflare.com. ns2.cloudflare.com. $ dig letterpad.io SOA +short ns1.cloudflare.com. dns.cloudflare.com. 2026101901 10000 2400 604800 1800
PTR, SRV, CAA and friends
A handful of specialist records do one job each: name an IP backwards, advertise a service, or limit who may issue your HTTPS certificates.
In simple words
Most domains only ever need A, AAAA, CNAME, MX, TXT and NS. The rest are specialists. A PTR record works backwards, turning an IP address into a name, which mail servers check to judge senders. SRV says which server and port run a service like voice calls. CAA lists which certificate companies may issue HTTPS certificates for your domain.
Think of it like
PTR is caller ID: a number shows up, and you see the name. SRV is a building directory: "Accounts, floor 3, room 12." CAA is a note at the bank: "only these two people may sign cheques for this account."
Swipe sideways to see the whole diagram
- 1A forward lookup goes from name to address.
- 2A reverse lookup uses a PTR record to go from address to name.
- 3PTR records live under the special in-addr.arpa domain, with the IP written backwards.
| Record | Example | Job |
|---|---|---|
| PTR | 25.113.0.203.in-addr.arpa. PTR mail.letterpad.io. | Reverse lookup, mail reputation |
| SRV | _sip._tcp.letterpad.io. SRV 10 5 5060 sip.letterpad.io. | Service location: priority, weight, port, host |
| CAA | letterpad.io. CAA 0 issue "letsencrypt.org" | Only Let's Encrypt may issue certificates |
| HTTPS / SVCB | letterpad.io. HTTPS 1 . alpn="h3,h2" | Tells browsers the site supports HTTP/3, before connecting |
| DS, DNSKEY, RRSIG | Long keys and signatures | DNSSEC: proves answers were not tampered with |
| NAPTR, SSHFP, TLSA | Specialist values | Phone numbers, SSH key fingerprints, DANE certificates |
Technical deep diveTap to fold
- in-addr.arpa and ip6.arpa
- Reverse zones for IPv4 and IPv6. The owner of the IP block, not the domain owner, controls them, so you set PTR in your cloud or hosting console.
- Forward-confirmed reverse DNS
- Mail servers check that the PTR name also resolves back to the same IP. Missing or mismatched PTR is a common spam signal.
- SRV fields
- Priority (lower first), weight (share among equal priority), port and target. Used by SIP, XMPP, Minecraft, LDAP and Active Directory.
- CAA
- Certificate authorities must check CAA before issuing (RFC 8659).
issuewildcontrols wildcard certificates;iodefgives a contact for violations. - HTTPS record
- RFC 9460. Lets a browser learn supported protocols and alternative endpoints in the DNS answer, saving a round trip. It also works at the apex, unlike CNAME.
dig -x 8.8.8.8 +short
dig letterpad.io CAA +short
dig cloudflare.com HTTPS +short$ dig -x 8.8.8.8 +short dns.google. $ dig letterpad.io CAA +short 0 issue "letsencrypt.org"
TTL, caching and "propagation"
Every answer comes with an expiry timer. Until it runs out, resolvers keep giving the old answer, which is why DNS changes seem to take time.
In simple words
Each record has a TTL, time to live, in seconds. A resolver that looked up your site may reuse that answer until the TTL runs out. So if you change an address, people whose resolver cached the old one keep seeing it for up to one TTL. This delay is what people call DNS propagation, although nothing is actually spreading: old copies are simply expiring.
Think of it like
Milk with a "best before" date. Once you buy a carton (cache the answer), you use it until the date, even if the shop has fresher milk now. A short date means more trips to the shop but always fresh; a long date means fewer trips but you might be drinking yesterday's news.
Swipe sideways to see the whole diagram
- 1The resolver caches the answer for the TTL.
- 2You change the record midway; cached copies do not know.
- 3When the timer ends, the next lookup fetches the new record.
| TTL | Good for |
|---|---|
| 60 to 300 s (1 to 5 min) | Records you may change soon, failover, during a migration |
| 3,600 s (1 hour) | A sensible default for most records |
| 86,400 s (1 day) | Stable records such as MX and NS; fewer lookups, slower changes |
Technical deep diveTap to fold
- Positive caching
- Successful answers are kept for their TTL. Resolvers may cap very long TTLs, often at one day.
- Negative caching
- "This name does not exist" (NXDOMAIN) is cached too, for the SOA minimum value. Look up a subdomain before creating it and you may wait for that timer.
- Response codes
NOERROR(fine),NXDOMAIN(name does not exist),SERVFAIL(resolver could not get an answer, often DNSSEC or broken nameservers),REFUSED(server will not answer you).- Flushing caches
- Your own device:
sudo resolvectl flush-caches(Linux),ipconfig /flushdns(Windows),sudo dscacheutil -flushcache(macOS). Public resolvers offer purge pages; others you must wait out. - NS TTL
- Changing nameservers depends on the parent TLD's TTL, commonly 1 to 2 days, which you cannot lower.
dig letterpad.io A +noall +answer
sleep 10
dig letterpad.io A +noall +answer$ dig letterpad.io A +noall +answer letterpad.io. 287 IN A 104.21.3.7 $ dig letterpad.io A +noall +answer letterpad.io. 277 IN A 104.21.3.7 # the TTL counts down in the resolver cache
Glossary of DNS terms
Every term from this cheatsheet and a few more, each in plain words and in technical words. Search it or filter by kind.
- A recordRecord
- SimplyPoints a name to an IPv4 address.
- TechnicallyType 1. Data is a 32 bit address.
- AAAA recordRecord
- SimplyPoints a name to an IPv6 address.
- TechnicallyType 28. Data is a 128 bit address.
- ALIAS / ANAMERecord
- SimplyA CNAME-like record allowed at the bare domain.
- TechnicallyProvider feature, not a standard type; resolved server-side into A and AAAA.
- AnycastConcept
- SimplyOne address answered from many places; you reach the nearest.
- TechnicallySame prefix announced via BGP from many sites; used by roots and public resolvers.
- ApexConcept
- SimplyThe bare domain with nothing in front: letterpad.io.
- TechnicallyZone apex, written @ in zone files; holds SOA and NS.
- Authoritative serverServer
- SimplyThe official source of a domain's records.
- TechnicallyAnswers with the AA flag for zones it hosts.
- CAA recordRecord
- SimplyLists who may issue HTTPS certificates for you.
- TechnicallyType 257, RFC 8659; tags issue, issuewild, iodef.
- CacheConcept
- SimplyA remembered answer, reused until it expires.
- TechnicallyKept for the record's TTL by browsers, OSes and resolvers.
- ccTLDConcept
- SimplyA two-letter country ending like .in or .uk.
- TechnicallyCountry code top level domain, managed per ISO 3166 code.
- CNAMERecord
- SimplyMakes one name an alias of another.
- TechnicallyType 5; must be alone at its name; not allowed at the apex.
- DelegationConcept
- SimplyHanding control of a part of the tree to someone else.
- TechnicallyNS records in the parent zone pointing to the child's servers.
- DKIMMail
- SimplyA digital seal on outgoing email.
- TechnicallyTXT at selector._domainkey; public key for signature checks.
- DMARCMail
- SimplyTells receivers what to do with fake mail from you.
- TechnicallyTXT at _dmarc; policy none, quarantine or reject.
- DNSConcept
- SimplyThe internet's system for turning names into addresses.
- TechnicallyDomain Name System, RFC 1034 and 1035.
- DNSSECSecurity
- SimplySignatures that prove answers were not faked.
- TechnicallyDNSKEY, RRSIG, DS records form a chain of trust from the root.
- DoH / DoTSecurity
- SimplyEncrypted DNS, so others cannot read your lookups.
- TechnicallyDNS over HTTPS (RFC 8484, port 443) and over TLS (RFC 7858, port 853).
- DomainConcept
- SimplyA name you register, like letterpad.io.
- TechnicallyA node in the DNS tree plus everything below it.
- FQDNConcept
- SimplyA complete name, all the way to the root.
- TechnicallyEnds in a dot: blog.letterpad.io.
- Glue recordRecord
- SimplyAn address hint stored with the parent.
- TechnicallyA or AAAA for in-domain nameservers, to break lookup loops.
- gTLDConcept
- SimplyA generic ending like .com, .org or .dev.
- TechnicallyGeneric top level domain, contracted with ICANN.
- HTTPS / SVCBRecord
- SimplyTells browsers how best to connect, before they connect.
- TechnicallyTypes 65 and 64, RFC 9460; ALPN, ports, ECH keys.
- IP addressConcept
- SimplyThe numeric address of a device on the internet.
- TechnicallyIPv4 (32 bit) or IPv6 (128 bit).
- MX recordMail
- SimplySays which server accepts email for the domain.
- TechnicallyType 15; preference number plus hostname.
- NameserverServer
- SimplyA server that holds DNS records.
- TechnicallyUsually means authoritative server; listed in NS records.
- NS recordRecord
- SimplyNames the servers in charge of a domain.
- TechnicallyType 2; set at the registrar, published by the registry.
- NXDOMAINResponse
- Simply"That name does not exist."
- TechnicallyRCODE 3; cached for the SOA minimum TTL.
- Port 53Concept
- SimplyThe standard DNS door on a server.
- TechnicallyUDP for most queries, TCP for large answers and transfers.
- PropagationConcept
- SimplyThe wait while old cached answers expire.
- TechnicallyBounded by TTLs, not by anything spreading.
- PTR recordRecord
- SimplyTurns an IP address back into a name.
- TechnicallyType 12, under in-addr.arpa or ip6.arpa.
- RecordConcept
- SimplyOne entry: a name, a type and a value.
- TechnicallyResource record (RR): name, TTL, class, type, RDATA.
- Recursive resolverServer
- SimplyThe helper that looks names up for you.
- TechnicallyFollows referrals from the root, caches results.
- RegistrarConcept
- SimplyThe shop where you rent a domain.
- TechnicallyICANN-accredited reseller; sets NS at the registry.
- RegistryConcept
- SimplyThe organisation running a whole TLD.
- TechnicallyOperates the TLD zone, for example Verisign for .com.
- Root serverServer
- SimplyThe starting point of every lookup.
- Technically13 identities, a to m, over 1,900 anycast sites.
- SERVFAILResponse
- Simply"I could not get you an answer."
- TechnicallyRCODE 2; broken nameservers or DNSSEC failure.
- SOA recordRecord
- SimplyThe zone's title page: owner and version.
- TechnicallyType 6; primary NS, admin, serial, timers.
- SPFMail
- SimplyThe list of servers allowed to send your email.
- TechnicallyTXT starting v=spf1, RFC 7208.
- SRV recordRecord
- SimplySays which server and port run a service.
- TechnicallyType 33; priority, weight, port, target.
- SubdomainConcept
- SimplyA name you create under your domain: blog, api.
- TechnicallyAny label left of the registered domain.
- TLDConcept
- SimplyThe last part of a name: .com, .in, .io.
- TechnicallyTop level domain, directly under the root.
- TTLConcept
- SimplyHow long an answer may be remembered.
- TechnicallySeconds; set per record.
- TXT recordRecord
- SimplyA free text note on a domain.
- TechnicallyType 16; SPF, DKIM, DMARC, ownership proofs.
- WildcardRecord
- SimplyA catch-all for subdomains with no record.
- Technically*.letterpad.io; explicit records take priority.
- ZoneConcept
- SimplyThe part of the tree one owner controls.
- TechnicallyFrom the apex down to any further delegation.
- Zone fileConcept
- SimplyThe text file listing a zone's records.
- TechnicallyMaster file format, RFC 1035 §5.
No terms match. Try a shorter word.
Record types at a glance
| Type | Number | Answer is | Everyday picture |
|---|---|---|---|
| A | 1 | IPv4 address | Street address |
| AAAA | 28 | IPv6 address | New digital address |
| CNAME | 5 | Another name | Mail forwarding |
| MX | 15 | Mail server + priority | Delivery gate |
| TXT | 16 | Free text | Note on the door |
| NS | 2 | Nameserver | Office holding the file |
| SOA | 6 | Zone metadata | File cover sheet |
| PTR | 12 | A name, for an IP | Caller ID |
| SRV | 33 | Host + port for a service | Building directory |
| CAA | 257 | Allowed certificate issuers | Authorised signatories |
| HTTPS | 65 | Connection hints | Directions before you leave |
Frequently asked questions
The questions people ask most once DNS starts to make sense. Tap one to open it.
I changed a record. Why do some people still see the old site?
Their resolver cached the old answer and will keep it until the record's TTL runs out (module 08). Nothing is broken; wait one TTL, or lower the TTL a day before planned changes.
Is DNS the same as web hosting?
No. DNS only says where to go. Hosting is the server that answers when you get there. You can buy a domain at one company, run DNS at a second and host the site at a third.
What is the difference between a registrar and a DNS host?
The registrar rents you the name and tells the TLD which nameservers to trust. The DNS host runs those nameservers and stores your records. Many companies do both, but they are separate jobs.
Can I put a CNAME on my bare domain?
Not by the standard, because the apex must also hold NS and SOA records. Use A and AAAA records, or your provider's ALIAS, ANAME or CNAME flattening (module 04).
What are 1.1.1.1 and 8.8.8.8?
Public recursive resolvers run by Cloudflare and Google. You can set them on your device or router instead of your ISP's resolver, often for speed or privacy.
Can other people see which sites I look up?
Classic DNS travels unencrypted, so your network and ISP can see the names. DNS over HTTPS or TLS (DoH, DoT) encrypts the lookup itself; the site you then connect to can still be inferred from its IP.
What happens if DNS stops working?
Sites stay online, but nobody can find them by name. Large outages, such as the 2016 attack on Dyn, made major sites unreachable for hours. That is why domains use at least two nameservers, ideally on different networks.
Why do I need both A and AAAA?
Some networks only have IPv4, some prefer IPv6. Publishing both lets every visitor connect the best way. If your server has no IPv6 address, publish only A.
How do I check my records without the command line?
Use your DNS provider's dashboard, or a web tool such as Google Admin Toolbox Dig or DNSChecker, which query from many locations at once.
What TTL should I use?
One hour (3600) is a sound default. Drop to 300 before a migration and raise it afterwards. Keep MX and NS long and stable.
Credits and external resources
Where to read more, and the open resources this page is built with.
- RFC 1034 and RFC 1035The original DNS standards (1987): concepts, message format, zone files.IETF (opens in a new tab)
- RFC 9499: DNS TerminologyThe official definitions behind the glossary.IETF (opens in a new tab)
- IANA DNS parametersThe registry of record type numbers and response codes.IANA (opens in a new tab)
- IANA Root Zone DatabaseEvery top level domain and who runs it.IANA (opens in a new tab)
- root-servers.orgLive map of the root server instances.Root server operators (opens in a new tab)
- Cloudflare Learning Center: DNSClear explanations of each record type.Cloudflare (opens in a new tab)
- How DNS worksAn illustrated comic of a lookup, great for beginners.DNSimple (opens in a new tab)
- Julia Evans: How DNS Works zineA friendly zine on DNS concepts and debugging.Wizard Zines (opens in a new tab)
- Google Admin Toolbox: DigBrowser-based dig for checking records.Google (opens in a new tab)
- Email auth RFCs: 7208, 6376, 7489SPF, DKIM and DMARC specifications.IETF (opens in a new tab)
- Phosphor IconsInterface icons used on this page, MIT licence.Phosphor (opens in a new tab)
- Google Fonts: Anton, Inter, JetBrains MonoTypefaces, SIL Open Font Licence.Google Fonts (opens in a new tab)
- LenisSmooth scrolling library, MIT licence.darkroom.engineering (opens in a new tab)