# DNS records, explained

Every DNS record type, one by one: what it does, its fields and accepted values, examples, common mistakes and how to enter it at your DNS host. Each type has its own page, also available as Markdown.

A record has five parts: name, TTL, class, type and value. For example `www 3600 IN A 192.0.2.10` points www at 192.0.2.10 for up to an hour.

## Websites

| Type | What it does | How common |
| --- | --- | --- |
| [A](https://lemon.domains/dns-records/a.md) | Points a name at an IPv4 address | Everyday |
| [AAAA](https://lemon.domains/dns-records/aaaa.md) | Points a name at an IPv6 address | Everyday |
| [CNAME](https://lemon.domains/dns-records/cname.md) | Makes a name an alias of another name | Everyday |
| [ALIAS](https://lemon.domains/dns-records/alias.md) | A CNAME-like pointer that works at the root (provider feature) | Common |
| [HTTPS](https://lemon.domains/dns-records/https.md) | Tells browsers how to connect: HTTP/3, addresses, ECH | Common |

## Email

| Type | What it does | How common |
| --- | --- | --- |
| [MX](https://lemon.domains/dns-records/mx.md) | Says which servers receive the domain's email | Everyday |
| [TXT](https://lemon.domains/dns-records/txt.md) | Free text: SPF, DKIM, DMARC, verification tokens | Everyday |
| [SPF](https://lemon.domains/dns-records/spf.md) | Lists the servers allowed to send email as the domain (TXT record) | Everyday |
| [DKIM](https://lemon.domains/dns-records/dkim.md) | Publishes the public key that signs your email (TXT record) | Everyday |
| [DMARC](https://lemon.domains/dns-records/dmarc.md) | What to do with mail that fails SPF and DKIM, and where to report it (TXT record) | Everyday |
| [MTA-STS](https://lemon.domains/dns-records/mta-sts.md) | Makes other servers use encrypted connections to deliver your mail (TXT record) | Common |
| [TLS-RPT](https://lemon.domains/dns-records/tls-rpt.md) | Asks senders to report TLS problems delivering your mail (TXT record) | Common |
| [BIMI](https://lemon.domains/dns-records/bimi.md) | Shows your logo next to your email in supporting inboxes (TXT record) | Specialist |
| [Verification](https://lemon.domains/dns-records/verification.md) | Tokens that prove to a service that you control the domain (TXT record) | Everyday |

## Delegation

| Type | What it does | How common |
| --- | --- | --- |
| [DNAME](https://lemon.domains/dns-records/dname.md) | Aliases a whole subtree of names | Rare |
| [NS](https://lemon.domains/dns-records/ns.md) | Names the servers that answer for a domain | Everyday |
| [SOA](https://lemon.domains/dns-records/soa.md) | The zone's header: primary server, contact, version and timers | Common |

## Services

| Type | What it does | How common |
| --- | --- | --- |
| [SVCB](https://lemon.domains/dns-records/svcb.md) | Service binding for any protocol | Specialist |
| [PTR](https://lemon.domains/dns-records/ptr.md) | Reverse DNS: the name for an IP address | Common |
| [SRV](https://lemon.domains/dns-records/srv.md) | Says which host and port run a service | Common |
| [NAPTR](https://lemon.domains/dns-records/naptr.md) | Rewrite rules that turn a name or number into a service address | Specialist |
| [URI](https://lemon.domains/dns-records/uri.md) | Publishes a URI for a service | Rare |

## Certificates and keys

| Type | What it does | How common |
| --- | --- | --- |
| [CAA](https://lemon.domains/dns-records/caa.md) | Says which certificate authorities may issue certificates | Common |
| [TLSA](https://lemon.domains/dns-records/tlsa.md) | DANE: pins the TLS certificate or key for a service | Specialist |
| [SSHFP](https://lemon.domains/dns-records/sshfp.md) | Publishes SSH host key fingerprints | Specialist |
| [SMIMEA](https://lemon.domains/dns-records/smimea.md) | Publishes an S/MIME certificate for an email address | Rare |
| [OPENPGPKEY](https://lemon.domains/dns-records/openpgpkey.md) | Publishes an OpenPGP public key for an email address | Rare |
| [CERT](https://lemon.domains/dns-records/cert.md) | Stores a certificate or revocation list | Rare |

## DNSSEC

| Type | What it does | How common |
| --- | --- | --- |
| [DNSKEY](https://lemon.domains/dns-records/dnskey.md) | DNSSEC: the zone's public signing keys | Common |
| [DS](https://lemon.domains/dns-records/ds.md) | DNSSEC: the parent's fingerprint of your key | Common |
| [RRSIG](https://lemon.domains/dns-records/rrsig.md) | DNSSEC: the signature on a set of records | Common |
| [NSEC](https://lemon.domains/dns-records/nsec.md) | DNSSEC: signed proof that a name or type doesn't exist | Specialist |
| [NSEC3](https://lemon.domains/dns-records/nsec3.md) | DNSSEC: hashed proof of non-existence | Specialist |
| [NSEC3PARAM](https://lemon.domains/dns-records/nsec3param.md) | DNSSEC: the NSEC3 settings for a zone | Specialist |
| [CDS](https://lemon.domains/dns-records/cds.md) | DNSSEC: asks the parent to update your DS automatically | Specialist |
| [CDNSKEY](https://lemon.domains/dns-records/cdnskey.md) | DNSSEC: the key the parent should trust | Specialist |

## Information

| Type | What it does | How common |
| --- | --- | --- |
| [LOC](https://lemon.domains/dns-records/loc.md) | Publishes a geographical location | Rare |
| [HINFO](https://lemon.domains/dns-records/hinfo.md) | Host hardware and operating system; also the reply to ANY queries | Rare |
| [RP](https://lemon.domains/dns-records/rp.md) | Who is responsible for a name | Rare |

## More

- [DNS TTL (time to live)](https://lemon.domains/dns-records/ttl.md)
- [Zone playground](https://lemon.domains/dns-records/playground): check a whole zone file and simulate lookups
- Interactive guide with live lookup and record checker: https://lemon.domains/dns-records