DNS glossary

Terms used in the rest of the wiki, defined once. Cross-linked where deeper coverage exists.

A: F#

A record: Resource record mapping a name to an IPv4 address. See a and The dig-along.

AAAA record: Resource record mapping a name to an IPv6 address. Pronounced "quad-A." See aaaa and The dig-along.

AA (Authoritative Answer): Flag set in a DNS response when the responder is authoritative for the zone containing the answer. Always check before trusting an answer is canonical.

AD (Authenticated Data): Flag set in a response when the resolver successfully validated the DNSSEC signature chain. See dnssec.

Anycast: Routing technique where multiple servers share the same IP address; clients reach the topologically nearest one. Used by major public resolvers (1.1.1.1, 8.8.8.8, 9.9.9.9). See fundamentals.

Authoritative server: Server that holds the master copy of a zone and answers definitively for it. Opposite of recursive.

AXFR: Full zone transfer. Used to seed a secondary nameserver from the primary. Almost always restricted by ACL or TSIG. See transfer.

CAA record: Tells public certificate authorities which CA may issue certificates for the zone. Compliant CAs must check it. See caa and caa-policy.

Cache hit: A resolver answering from its in-memory cache without going upstream. The cheapest possible answer.

Caching resolver: Same as a recursive resolver. The "recursive" part refers to how it answers; the "caching" part refers to what it remembers. See anatomy-of-a-query.

CD (Checking Disabled): Flag a client can set to ask the resolver NOT to validate DNSSEC. Rare; mostly for debugging.

CNAME: Canonical Name. An alias from one name to another. The resolver chases CNAMEs transparently. See cname and The dig-along.

Delegation: A parent zone handing authority for a subtree to a child zone, via NS records at the cut point. Glue records carry the addresses when the nameservers live inside the child. See delegations.

dig: The standard DNS query tool, shipped with most Linux distros. See dig-flags and nslookup-and-dig.

DNSSEC: DNS Security Extensions. Adds cryptographic signatures to records so a validating resolver can prove an answer wasn't tampered with. See dnssec.

DNSKEY: DNSSEC public key record published in a zone. Resolvers use it to verify RRSIG records. See dnssec.

DoH: DNS over HTTPS. Encrypted DNS over port 443. See DoT, DoH, DoQ.

DoT: DNS over TLS. Encrypted DNS over port 853. See DoT, DoH, DoQ.

DoQ: DNS over QUIC (RFC 9250). Encrypted DNS transport using QUIC on UDP port 853; QUIC provides its own TLS-based security and multiplexing. See DoT, DoH, DoQ.

dnstap: Protocol for streaming DNS query/response events from a resolver to an analysis tool, using Protocol Buffers over a Unix or TCP socket. The modern replacement for syslog-based query logging. Defined at dnstap.info; supported by BIND, Knot, Unbound, and PowerDNS.

DS record: Delegation Signer. Published in the parent zone to fingerprint the child zone's DNSKEY. Builds the DNSSEC chain across delegation boundaries. See dnssec and delegations.

EDNS(0): Extension Mechanisms for DNS (RFC 6891). Adds an OPT pseudo-record carrying options the original protocol could not: large UDP buffer sizes, the DNSSEC OK bit, and optional extensions such as COOKIE (RFC 7873) and CLIENT_SUBNET/ECS (RFC 7871, privacy-sensitive). See fundamentals and dnssec.

Forwarder: A resolver that sends every query to another recursive server upstream instead of walking the hierarchy itself. Common in enterprise networks and home routers. See forward.

FQDN: Fully Qualified Domain Name. A name with the trailing dot, fully resolved relative to root. isitdns.net. (with trailing dot) is an FQDN. Most applications and UIs omit the trailing dot by convention; zone files require it to prevent the $ORIGIN suffix from being appended. See fundamentals.

G: O#

Glue record: An A/AAAA record published in a parent zone for a nameserver of a child zone, used to break the chicken-and-egg of "how do I look up the NS for example.com when example.com's NS records are example.com names?" See delegations.

HTTPS / SVCB records: Service Binding records (RFC 9460). Let a name advertise connection parameters up front: ALPN protocols, address hints, ECH config. SVCB is type 64; the HTTPS record is its type-65 sibling, which browsers now query alongside A and AAAA. See https-svcb.

IXFR: Incremental zone transfer. Like AXFR but only the records that changed since a given serial number. See transfer.

Lame delegation: When a zone's NS records point to nameservers that don't actually serve the zone. Common cause of intermittent SERVFAILs. See delegations.

Master / Primary / Slave / Secondary: Old terms (master/slave) and modern terms (primary/secondary) for the authoritative nameservers in a zone-transfer relationship. The primary holds the master copy; secondaries pull AXFR/IXFR. See transfer and authoritative zones.

MX record: Mail Exchanger. Names the mail server(s) for a domain, with a priority. See mx and email-records.

Negative cache: Resolver behavior of remembering a negative answer, both NXDOMAIN (name does not exist) and NODATA (name exists, type does not), for a bounded time. The actual negative cache TTL used is min(SOA MINIMUM field, SOA record TTL). Per RFC 2308 §5, lowering only the MINIMUM field while leaving the SOA record's own TTL high will not shorten negative caching. Prevents the resolver from re-asking authoritative servers for typos. See soa and fundamentals.

NODATA: Not a real rcode: shorthand for a NOERROR response with an empty answer section. The name exists, but not with the type you asked for. Cached like NXDOMAIN per RFC 2308.

NOERROR: DNS rcode 0. The query was handled successfully: even if the answer section is empty.

NS record: Names an authoritative nameserver for a zone. See ns, delegations, and The dig-along.

NSEC / NSEC3: DNSSEC records used to prove that a name does not exist (the cryptographic version of NXDOMAIN). Without these, an attacker could forge NXDOMAIN. See dnssec and dnssec-troubleshooting.

NXDOMAIN: DNS rcode 3. "Name does not exist." Definitive negative answer. Caveat: some hosted zones never emit it. Cloudflare-hosted zones answer missing names with NOERROR plus a proving NSEC record instead (the "black lies" scheme), so an empty NOERROR can be the same verdict in disguise.

OPT pseudo-record: The EDNS extension record. Lives in the additional section of every EDNS-enabled query.

P: Z#

PTR record: Reverse DNS. Maps an IP back to a name. Stored under *.in-addr.arpa (IPv4) or *.ip6.arpa (IPv6). See ptr, reverse-dns, and The dig-along.

QName: Question Name. The name being asked about in a DNS query. See query-types and anatomy-of-a-query.

QType: Question Type. The record type being asked about (A, AAAA, MX, …). See query-types.

RA (Recursion Available): Response flag. The server is willing to recurse on behalf of the client. Authoritative-only servers should NOT set this.

rcode: Response code. The verdict in a DNS answer. Common values: NOERROR (0), FORMERR (1), SERVFAIL (2), NXDOMAIN (3), NOTIMP (4), REFUSED (5). See DNS fundamentals: refresher.

RD (Recursion Desired): Query flag. The client wants the resolver to do the recursion. Default for most stub-resolver queries.

Recursive resolver: Server that walks the DNS hierarchy on behalf of a client, caching results. The one in your /etc/resolv.conf. Opposite of authoritative. See anatomy-of-a-query and forward.

REFUSED: DNS rcode 5. The server refused to answer. Usually means the client is outside the recursion ACL, or recursion is off and the question was not for an owned zone.

Root server: One of the 13 logical name servers (a.root-servers.net through m.root-servers.net) that serve the root zone (.). Operated by 12 different organizations. Implemented as anycast: the 13 letters are backed by more than 2,000 server instances worldwide in total (live count at root-servers.org). See anatomy-of-a-query.

RPZ: Response Policy Zone. A mechanism for a resolver to rewrite responses based on a policy zone: used for threat-feed blocking, DNS firewall, captive-portal redirection. Visible in dnstap output as policy_* fields (policy_action, policy_type, policy_value). Specified in the ISC RPZ draft; supported by BIND, Unbound, Knot Resolver, and PowerDNS Recursor. See forward for resolver configuration context.

RRSIG: DNSSEC signature record. Cryptographically signs an RRset. Verified against the zone's DNSKEY. See dnssec.

RRset: A set of resource records sharing the same name, class, and type. Signed (in DNSSEC) and cached together.

SERVFAIL: DNS rcode 2. "Server failure." Could mean upstream broken, DNSSEC validation failed, recursion timeout, or a software bug. Always investigate. See when-its-dns.

SOA record: Start of Authority. Zone metadata: primary NS, admin contact, serial, refresh/retry/expire timers, negative-cache TTL. Every zone has exactly one at its apex. See soa and The dig-along.

Split-horizon DNS (also called DNS views): A name resolves to different answers depending on who is asking. Common pattern: internal clients get RFC1918 addresses, external clients get public ones. Implemented via an ACL that matches clients to a view, where each view holds its own copy of the zone. See split-horizon and authoritative zones for working examples.

SRV record: Service location. Names a host and port for a service, with priority + weight. Used by XMPP, SIP, LDAP, etc. See srv and The dig-along.

Stub resolver: Minimal client-side resolver, usually built into the OS. Asks a recursive resolver a single question and relays the answer back to the application. Never recurses itself. See anatomy-of-a-query and stub.

TC (Truncated): Response flag set when a UDP answer does not fit in the packet. Tells the client to retry over TCP. RFC 1035 defines the flag; EDNS(0) raises the practical limit of UDP payload size, reducing how often truncation occurs. See fundamentals.

TLD: Top-Level Domain. The last label of an FQDN: .com, .net, .org, ccTLDs like .uk, new gTLDs like .cafe.

TSIG: Transaction Signature. HMAC-based authentication for DNS messages, used to authorize AXFR/IXFR/UPDATE. See transfer and ddns.

TTL: Time To Live. How long, in seconds, resolvers may cache a record before re-asking authoritative. See DNS fundamentals: refresher.

TXT record: Arbitrary text. Used for SPF, DKIM, DMARC, domain verification. See txt, email-records, and The dig-along.

View (DNS view): A scoped set of zones served only to clients that match a given ACL. Most commercial DNS servers and the major open-source ones support views as a first-class feature. Views are the mechanism behind split-horizon DNS: same zone name, different copies per view, ACL chooses which. See split-horizon and authoritative zones for working examples.

Wildcard record: A record at *.zone that matches any name below that node for which no closer explicit record exists, at any depth (RFC 4592). The common belief that a wildcard only matches one label is incorrect; a closer explicit node stops synthesis for names in that subtree. See The dig-along.

Zone: A contiguous portion of the DNS namespace administered as a unit. isitdns.net is a zone; so is example.isitdns.net if it has been delegated separately. See authoritative zones and delegations.

Zone apex: The top of a zone: the name that matches the zone itself (isitdns.net for the isitdns.net zone). Must contain SOA and NS records. See soa, ns, and authoritative zones.

Acronym quick-reference#

See also#

• DNS fundamentals
• The dig-along
• Record-type cheat sheet
• dig flag reference
• nslookup and dig
• Anatomy of a query
• RFC index
• DNS wiki home