DNS record types list: A, AAAA, CNAME, MX, TXT, NS, SOA, SRV, CAA, HTTPS and their numbers
verified onenvironmentlocal · windows 10.0.26200 arm64 · GNU bash 5.3.15 (Git Bash)updated
- tool
- DNS
- versions
- RFC 1035, IANA DNS parameters
- os
- any
Every DNS resource record has a type, a 16-bit number registered by IANA, with a mnemonic used in zone files and tools (A is 1, AAAA is 28, MX is 15). The type decides what the record data contains: an IPv4 address, a host name, a mail server with a priority, free text. The table lists the types you meet in practice; the IANA registry has the full list.
Common record types
| Type | Number | Contains | Example data |
|---|---|---|---|
| A | 1 | IPv4 address | 192.0.2.10 |
| NS | 2 | Authoritative name server for the zone | ns1.example.com. |
| CNAME | 5 | Alias: the canonical name to look up instead | app.example.net. |
| SOA | 6 | Start of authority: primary server, contact, serial, timers | ns1 hostmaster 2026102101 7200 3600 1209600 3600 |
| PTR | 12 | Reverse lookup: name for an address (in in-addr.arpa / ip6.arpa) | host.example.com. |
| MX | 15 | Mail server with a preference (lower wins) | 10 mail.example.com. |
| TXT | 16 | Free text: SPF, DKIM, DMARC, domain verification | "v=spf1 -all" |
| AAAA | 28 | IPv6 address | 2001:db8::10 |
| SRV | 33 | Service location: priority, weight, port, target | 10 5 5060 sip.example.com. |
| NAPTR | 35 | Rewrite rules (SIP, ENUM) | 100 10 "U" "E2U+sip" "!^.*$!sip:info@example.com!" . |
| DS | 43 | DNSSEC: hash of the child zone key, stored in the parent | 12345 13 2 (hex digest) |
| RRSIG | 46 | DNSSEC signature over a record set | (signature data) |
| DNSKEY | 48 | DNSSEC public key of the zone | 257 3 13 (base64 key) |
| TLSA | 52 | DANE: certificate association for a TLS service | 3 1 1 (hex digest) |
| SVCB | 64 | Service binding: endpoints and parameters for a service | 1 svc.example.net. alpn=h2 |
| HTTPS | 65 | SVCB for HTTPS: ALPN, ports, ECH, works at the zone apex | 1 . alpn=h3,h2 |
| CAA | 257 | Which certificate authorities may issue for the name | 0 issue "letsencrypt.org" |
Check the numbers
The dnspython library carries the IANA table; this prints the number for each mnemonic:
uv run -q --no-project --python 3.13 --with dnspython==2.8.0 python - <<'EOF'
import dns.rdatatype as t
for name in ["A", "NS", "CNAME", "SOA", "PTR", "MX", "TXT", "AAAA", "SRV", "NAPTR", "DS", "RRSIG", "DNSKEY", "TLSA", "SVCB", "HTTPS", "CAA"]:
print(f"{name:7} {t.from_text(name).value}")
EOFOutput
A 1 NS 2 CNAME 5 SOA 6 PTR 12 MX 15 TXT 16 AAAA 28 SRV 33 NAPTR 35 DS 43 RRSIG 46 DNSKEY 48 TLSA 52 SVCB 64 HTTPS 65 CAA 257
Notes
- Types without a mnemonic in a tool can be written generically as
TYPE65(RFC 3597), for exampledig example.com TYPE65. ANY(255) is a query type, not a record type; many servers now answer it with a minimal response (RFC 8482).SPF(99) as a separate type is deprecated: publish SPF policies inTXTrecords.- A name that has a
CNAMEcannot have other record types (except DNSSEC ones), which is why the zone apex cannot be aCNAME.
Sources
Related pages
codes · dnsDNS response codes (RCODE): NOERROR, NXDOMAIN, SERVFAIL, REFUSEDDNS RCODE values from 0 NOERROR to 23 BADCOOKIE: what NXDOMAIN, SERVFAIL, REFUSED and FORMERR mean, NODATA vs NXDOMAIN, and what to check for each one.compare · dnsA record vs CNAME record: differences and when to use eachAn A record maps a name to an IP; a CNAME makes it an alias of another name. A CNAME cannot share a name with other records, so the zone apex needs A or ALIAS.errors · dnsError: getaddrinfo ENOTFOUND (DNS lookup failed)Node.js throws getaddrinfo ENOTFOUND when DNS cannot resolve the host: a typo, a full URL passed as host, a name only in /etc/hosts, or no working DNS.cheat sheets · digdig cheat sheet: DNS lookups from the command linedig cheat sheet: query A, AAAA, MX, TXT and NS records, ask a specific server, use +short, +trace and -x, and read NOERROR, NXDOMAIN and SERVFAIL statuses.