DNS Helper
A back-to-basics explanation of DNS records, for the willing amateur setting up their first domain and the professional who has just met a record they haven't needed before. No screenshots: every explanation is written to make sense whether your panel is Cloudflare, cPanel, GoDaddy, TransIP or anything else, because the record itself never changes, only what your provider happens to call the field.
Provider panels change their own wording over time, and this site cannot promise to track every rename the moment it happens. Where a card names a specific provider's field, treat it as a close match rather than a guaranteed, current, one to one mapping.
Start here
Interface
How your panel's own fields map to what actually ends up in the zone: name versus host, value versus content, and what an empty name field, @, or the bare domain all mean.
Zone file & SOA
What a zone file actually looks like underneath any panel, and the SOA record that opens every zone, whether you ever touch its numbers or not.
Read more about Zone file & SOAExample setups
Two complete zones for one domain, a basic one and one with everything switched on, every record linked to its own page.
Read more about Example setupsCore records
A / AAAA
Points a name straight at an IPv4 or IPv6 address, and why a name sometimes has more than one.
Read more about A / AAAACNAME
Makes one hostname follow another instead of pointing at an address itself. Not allowed on the domain's own root.
Read more about CNAMENS
Names which servers are authoritative for this zone. Almost never touched by hand once your provider is set, except when delegating a subdomain elsewhere.
Read more about NSMX
Says which mail servers receive mail for a domain. A routing record, not an authentication one, which is why it lives here rather than under Mail authentication.
Read more about MXSRV
Like MX, it helps a client find a service, but for almost any protocol: server, port, priority and weight. Used by Matrix, Minecraft servers, Microsoft Teams federation and more.
Read more about SRVTXT
A blank container for arbitrary text, given meaning only by whatever convention uses it. SPF, DKIM and DMARC are all really just TXT records underneath.
Read more about TXTMail authentication
SPF
Says which servers are authorised to send mail for your domain, so receiving servers can check whether the sending server is authorised.
Read more about SPFDKIM
Adds a cryptographic signature to outgoing mail, so a receiving server can verify that the signed parts haven't been altered.
Read more about DKIMDMARC
Tells receiving servers what to do when neither SPF nor DKIM gives an aligned pass, and where to send reports about what actually happened.
Read more about DMARCMail trust
MTA-STS
Tells other mail servers to require a valid, trusted TLS connection when delivering to this domain, instead of accepting one that's easily downgraded.
Read more about MTA-STSTLS-RPT
Asks other mail servers to report back when a TLS connection to this domain fails, so a delivery problem doesn't go unnoticed.
Read more about TLS-RPTBIMI
Lets a brand logo appear next to authenticated mail, in the inboxes that support it.
Read more about BIMIOwnership and verification
CAA
Names which certificate authorities are allowed to issue a certificate for this domain, and can rule out wildcard certificates entirely.
Read more about CAA_acme-challenge
The record a certificate tool asks you to add, to prove you control a domain before it issues a certificate.
Read more about _acme-challengeTransport and security
TLSA / DANE
Publishes certificate or public-key information in DNS, adding a DNSSEC-backed way to verify a TLS connection.
Read more about TLSA / DANESVCB / HTTPS
Tells a browser more about a server before it connects, such as which endpoint, port or protocol to prefer, helping it avoid unnecessary lookups or round trips.
Read more about SVCB / HTTPSSpecial and modern
_for-sale
A public, machine-readable note that a domain name is for sale, with optional contact, price and remarks.
Read more about _for-saleALIAS / ANAME
The workaround providers offer for pointing the bare domain at a hostname, since a CNAME is not allowed there. A provider feature, not a standard.
Read more about ALIAS / ANAMESmaller special records
The less common underscore names in IANA's registry, from mail-address keys to DNSSEC bootstrapping, each with its status: standard, experimental or neither.
Read more about Smaller special recordsAround DNS
SSL / TLS certificates
What a certificate is, DV, OV and EV, and where certificates meet DNS: proving control, CAA, TLSA and ever shorter lifetimes.
Read more about SSL / TLS certificatesRDAP / WHOIS
What a domain's registration says about its DNS: the nameservers at the registry, DNSSEC, and status codes that stop it resolving or moving.
Read more about RDAP / WHOIS