Records: per-type lessons
One page per record type (HTTPS and SVCB share one). Each page covers what the type holds, when to use it (and, for most types, when not to), a live
digexample, and a DoH curl. The curls use the JSON API (application/dns-json) that Cloudflare and Google expose; JSON is a resolver convenience, not part of RFC 8484, which only requires the binaryapplication/dns-messageformat.
The cheat-sheet view (every type you're likely to encounter, from daily-use to obsolete) lives at record-types.
Daily-use types#
| Type | What it holds | Detail |
|---|---|---|
| A | IPv4 address | A → |
| AAAA | IPv6 address | AAAA → |
| CNAME | Alias to another name | CNAME → |
| PTR | Reverse (IP → name) | PTR → |
| NS | Authoritative nameserver | NS → |
| SOA | Zone metadata | SOA → |
| MX | Mail exchange | MX → |
| TXT | Arbitrary text: SPF/DKIM/DMARC/ACME | TXT → |
Modern essentials#
| Type | What it holds | Detail |
|---|---|---|
| SRV | Service location (priority weight port target) | SRV → |
| CAA | Allowed certificate authorities | CAA → |
| HTTPS / SVCB | HTTPS endpoint hints (port, ECH, ALPN) | HTTPS / SVCB → |
| TLSA | DANE certificate pinning | TLSA → |
| SSHFP | SSH host key fingerprint | SSHFP → |
DNSSEC mechanics#
No per-type pages for DNSKEY, RRSIG, NSEC/NSEC3, or the parent-side DS: you don't usually hand-author these, your authoritative signer generates them (and the parent zone publishes the DS derived from your key). Covered in: