Reference
📜 RFC index and official sources
DNS is defined by RFCs, not by any one vendor. This page is the map: the documents behind every concept in this wiki, plus the authoritative non-RFC sources (IANA registries, the root-server operators, and the canonical implementation docs). When a page here makes a claim, this is where the claim comes from.
Read the RFCs at rfc-editor.org. Each link below points at the canonical text.
Asks for ANY, which RFC 8482 lets a server answer with one small record instead.
dig @1.1.1.1 +https cloudflare.com ANY; <<>> DiG 9.20.11-0ubuntu0.2-Ubuntu <<>> @1.1.1.1 +https cloudflare.com ANY
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: , id: 55124
NOTIMPThe server does not handle this kind of question.
;; flags: ; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
qrThis message is the answer coming back, not the question going out.
rdYou asked this server to go and find the answer for you.
raThis server says it is willing to go and find answers for you.
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; EDE: 21 (Not Supported)
;; QUESTION SECTION:
;cloudflare.com. IN
ANYYou asked for whatever the server feels like handing over.
;; : 31 msec
Query timeHow long this one lookup took, start to finish.
;; SERVER: 1.1.1.1#443(1.1.1.1) (HTTPS)
;; WHEN: Mon Sep 14 17:42:31 CDT 2026
;; MSG SIZE rcvd: 49
good: NOTIMP and an EDE line saying Not Supported. RFC 8482 lists three behaviours and this is not one of them; it does not forbid it either
bad: every record at the name, one after another, which is the pre-RFC-8482 behaviour and the reason the RFC exists
Core protocol#
| RFC | Title | Covers |
|---|---|---|
| 1034 | Domain Names: Concepts and Facilities | The model: the name tree, zones, resolvers, the CNAME-is-exclusive rule (§3.6.2) |
| 1035 | Domain Names: Implementation and Specification | The wire format, message sections, and the original record types (A, NS, CNAME, SOA, PTR, MX, TXT) |
| 2181 | Clarifications to the DNS Specification | TTL rules, ranking of data, and §10.3: MX/NS targets must not be a CNAME |
| 2308 | Negative Caching of DNS Queries (DNS NCACHE) | How NXDOMAIN and NODATA are cached, and the SOA minimum field. Caching of resolution failures (SERVFAIL, timeouts) is separately specified in RFC 9520 |
| 4592 | The Role of Wildcards in the Domain Name System | The precise * matching rules: a wildcard applies only where no explicit name matches, and never across a delegation |
| 6303 | Locally Served DNS Zones | Resolvers answer private-address reverse zones (RFC 1918 space and friends) locally instead of sending them toward the root |
| 6895 | Domain Name System (DNS) IANA Considerations | How the parameter registries (types, rcodes, classes) are governed |
| 9499 | DNS Terminology | The definitive glossary. Best Current Practice, published March 2024, and it is BCP 219; obsoletes RFC 8499, which had already obsoleted RFC 7719. Also updates RFC 2308 by clarifying "forwarder" and "QNAME". The source for "authoritative", "recursive", "stub" |
| 7766 | DNS Transport over TCP: Implementation Requirements | When and how DNS uses TCP, not just UDP |
| 8482 | Providing Minimal-Sized Responses to DNS Queries That Have QTYPE=ANY | The end of ANY as "give me everything": responders may answer with a subset or a synthesized HINFO. Some resolvers go further than the RFC and refuse outright. Cloudflare set out its reasoning in Deprecating the DNS ANY meta-query type, and its DNS FAQ says "it can be complex and even impossible to give correct answers to ANY queries" |
See RFC 8482 in action:
dig @1.1.1.1 +https cloudflare.com ANY;; ->>HEADER<<- opcode: QUERY, status: NOTIMP, id: 47762
; EDE: 21 (Not Supported)+https is used here so a middlebox on the local network cannot answer instead. Reproduced on DiG 9.20.24 2026-08-16; the ID changes every run. The same query over Cloudflare's DoH JSON returns "Status":4 with EDE(21): Not Supported.
Record types#
| RFC | Type(s) | Notes |
|---|---|---|
| 1035 | A, NS, CNAME, SOA, PTR, MX, TXT | The originals |
| 3596 | AAAA | IPv6 address record |
| 2782 | SRV | Service location (priority, weight, port, target) |
| 8659 | CAA | Certification Authority Authorization (obsoletes RFC 6844) |
| 8657 | CAA | The accounturi and validationmethods CAA extensions: restrict issuance to a specific ACME account or validation method |
| 9460 | HTTPS, SVCB | Service binding and HTTPS endpoint hints (port, ALPN, ECH) |
| 6698 | TLSA | DANE: pinning a cert or CA in DNS |
| 7671 | TLSA | DANE operational and updated guidance |
| 4255 | SSHFP | SSH host-key fingerprints in DNS |
| 2317 | PTR | Classless in-addr.arpa delegation (reverse DNS on non-octet boundaries) |
The full, current list of every assigned type lives in the IANA registry (below). See also the cheat sheet at record-types.
The simplest RFC 1035 query there is:
dig @1.1.1.1 +short example.isitdns.net A192.0.2.1Zones and transfer#
| RFC | Title | Covers |
|---|---|---|
| 1982 | Serial Number Arithmetic | SOA serial comparison and wrap-around (which serial counts as "newer") |
| 1996 | A Mechanism for Prompt Notification of Zone Changes (DNS NOTIFY) | The "your zone changed, come refresh" prompt to secondaries |
| 1995 | Incremental Zone Transfer in DNS (IXFR) | Transfer only the diff. A UDP attempt is allowed first; falls back to TCP when the changes do not fit in one packet (§2) |
| 5936 | DNS Zone Transfer Protocol (AXFR) | Full transfer, multi-message framing, the terminal SOA (§2.2) |
| 2136 | Dynamic Updates in the Domain Name System (DNS UPDATE) | Adding and deleting records in a running zone (the nsupdate path), no zone-file reload required |
The serial that RFC 1982 arithmetic compares is the third field of the SOA:
dig @1.1.1.1 +short isitdns.net SOAcoleman.ns.cloudflare.com. dns.cloudflare.com. 2412230330 10000 2400 604800 1800The serial is the third field, 2412230330 in this run on 2026-08-16. Cloudflare bumps it on every zone change, so yours will be higher; that is the whole point of RFC 1982 arithmetic.
DNSSEC#
| RFC | Title | Covers |
|---|---|---|
| 4033 | DNS Security Introduction and Requirements | The threat model and what signing does (and does not) protect |
| 4034 | Resource Records for the DNS Security Extensions | DNSKEY, RRSIG, DS, NSEC |
| 4035 | Protocol Modifications for the DNS Security Extensions | The DO, CD, and AD bits, validation, serving signed data |
| 5155 | DNS Security (DNSSEC) Hashed Authenticated Denial of Existence | NSEC3: hashed denial. It hinders zone walking but does not prevent offline hash cracking; parameter guidance is RFC 9276 |
| 6840 | Clarifications and Implementation Notes for DNS Security (DNSSEC) | The corrections every validator follows |
| 6781 | DNSSEC Operational Practices, Version 2 | Key rollover, signing strategy |
| 6605 | Elliptic Curve Digital Signature Algorithm (DSA) for DNSSEC | ECDSA P-256 (algorithm 13), what most modern zones sign with |
| 4509 | Use of SHA-256 in DNSSEC Delegation Signer (DS) Resource Records | The current DS digest (digest type 2) |
| 9904 | DNSSEC Cryptographic Algorithm Recommendation Update Process | Published December 2025; obsoletes RFC 8624 (June 2019). Which algorithms to use and which to retire now lives in the IANA DNSSEC algorithm registries, updated by process instead of by a new RFC each time. Cite 9904 for the process and the IANA registry for the current answer, never 8624 |
| 7344 / 8078 | CDS / CDNSKEY | Automating the DS update to the parent. RFC 9615 adds automatic bootstrapping of the first DS |
Watch a validator (delv, part of BIND) walk the RFC 4033-4035 chain:
delv @1.1.1.1 example.isitdns.net A; fully validated
example.isitdns.net. 300 IN A 192.0.2.1
example.isitdns.net. 300 IN RRSIG A 13 3 300 [...] isitdns.net. [...]See dnssec for the walkthrough and dnssec-troubleshooting for the failure modes.
Encrypted DNS and privacy#
| RFC | Title | Covers |
|---|---|---|
| 7858 | Specification for DNS over Transport Layer Security (TLS) | DoT: DNS on a dedicated TLS port (853) |
| 8484 | DNS Queries over HTTPS (DoH) | DNS wire format inside HTTPS on 443 |
| 9250 | DNS over Dedicated QUIC Connections | DoQ: DNS over QUIC on UDP port 853, low-latency encrypted transport |
| 8310 | Usage Profiles for DNS over TLS and DNS over DTLS | Authentication and certificate handling for DoT (DoH authentication is covered in RFC 8484) |
| 9076 | DNS Privacy Considerations | What does and does not leak (obsoletes RFC 7626) |
dig +https speaks RFC 8484 wire format over port 443:
dig @1.1.1.1 +https example.isitdns.net A;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
example.isitdns.net. 300 IN A 192.0.2.1See dot-doh for the hands-on comparison.
EDNS and extensions#
| RFC | Title | Covers |
|---|---|---|
| 6891 | Extension Mechanisms for DNS (EDNS(0)) | The OPT pseudo-record: larger messages, flags, options |
| 7871 | Client Subnet in DNS Queries | ECS: passing client-network hints to authoritative servers |
| 7873 | Domain Name System (DNS) Cookies | Lightweight off-path spoofing defense |
| 8914 | Extended DNS Errors | The EDE option: machine-readable error causes riding along with SERVFAIL and friends |
| 5001 | DNS Name Server Identifier (NSID) Option | Ask which server instance answered; the useful question behind anycast |
Ask an anycast resolver which instance you reached (+https so a middlebox cannot answer instead):
dig @1.1.1.1 +https +nsid example.isitdns.net A; NSID: 61 74 6c 31 30 ("atl10")The string is the instance that answered, not a stable value: this run on 2026-08-16 landed on atl10, an earlier one on atl15. Anycast picks a different box whenever routing shifts, which is exactly what NSID exists to expose.
See query-types for how EDNS, ECS, and extension options interact with the query cycle.
Email authentication (DNS-adjacent)#
These live in TXT records, so they are DNS in practice. See email-records.
| RFC | Title | Notes |
|---|---|---|
| 7208 | Sender Policy Framework (SPF) | Which hosts may send for a domain |
| 6376 | DomainKeys Identified Mail (DKIM) Signatures | Cryptographic signing of mail, public key in DNS |
| 7505 | Null MX | MX 0 . signals a domain that accepts no mail; senders should bounce immediately |
| 7489 | DMARC | Original 2015 Informational spec. The RFC Editor now lists it as obsoleted by 9989, 9990, and 9991; treat 7489 as historical (re-verified against rfc-editor.org metadata 2026-08-16) |
| 9989 | DMARC (current) | Published May 2026, Standards Track; obsoletes RFC 7489 and RFC 9091 (DMARC PSD). Policy and alignment live here; aggregate reporting moved to RFC 9990 and failure reporting to RFC 9991 |
An RFC 7208 SPF policy is just a TXT record:
dig @1.1.1.1 +short isitdns.net TXT"apple-domain=eMncnNTeg8mTuWzX"
"v=spf1 include:icloud.com ~all"Official non-RFC sources#
The registries and operators that hold the live, authoritative state:
- IANA DNS parameters: every assigned record type, rcode, and class: iana.org/assignments/dns-parameters
- IANA root servers: the 13 root server identities: iana.org/domains/root/servers
- Root zone management (ICANN/PTI): how the root zone is edited: iana.org/domains/root
- Root hints file: the
named.rootbootstrap list: internic.net/domain/named.root - IANA Special-Use Domain Names:
.example,.invalid,.localhost,.test: iana.org/assignments/special-use-domain-names. The registry itself is defined by RFC 6761; the original names were reserved by RFC 2606 - Root Server Technical Operations (root-servers.org): live root operator status: root-servers.org
Implementation and tool docs#
The canonical references for the software you will actually run:
- ISC BIND 9 (named, dig, delv): bind9.readthedocs.io
- Unbound (validating recursive resolver): unbound.docs.nlnetlabs.nl
- Knot DNS / kdig (CZ.NIC): knot-dns.cz/documentation
- PowerDNS: doc.powerdns.com
- DNSViz (visual DNSSEC analysis): dnsviz.net
- Cloudflare Learning Center: DNS: cloudflare.com/learning/dns
- Verisign DNSSEC debugger: dnssec-debugger.verisignlabs.com
Adjacent standards (the stack beneath DNS)#
Not DNS RFCs, but referenced by the foundations pages:
- ARP (address resolution): RFC 826
- NTP (network time): RFC 5905
- IPv4 private ranges (
10.0.0.0/8,172.16.0.0/12,192.168.0.0/16): RFC 1918 - IPv6 documentation prefix
2001:db8::/32: RFC 3849 (RFC 9637 later added3fff::/20) - IPv4 documentation ranges (
192.0.2.0/24,198.51.100.0/24,203.0.113.0/24): RFC 5737 - The OSI model is ISO/IEC 7498-1; VLAN tagging is IEEE 802.1Q. Neither is an RFC.
See also#
- 📖 Glossary: the terms, defined
- 🔬 DNS wiki home