📜 RFC index and official sources
DNS is defined by RFCs, not by any one vendor. This page is the map: the documents behind every concept in this wiki, plus the authoritative non-RFC sources (IANA registries, the root-server operators, and the canonical implementation docs). When a page here makes a claim, this is where the claim comes from.
Read the RFCs at rfc-editor.org. Each link below points at the canonical text.
Core protocol#
| RFC | Title | Covers |
|---|---|---|
| 1034 | Domain Names: Concepts and Facilities | The model: the name tree, zones, resolvers, the CNAME-is-exclusive rule (§3.6.2) |
| 1035 | Domain Names: Implementation and Specification | The wire format, message sections, and the original record types (A, NS, CNAME, SOA, PTR, MX, TXT) |
| 2181 | Clarifications to the DNS Specification | TTL rules, ranking of data, and §10.3: MX/NS targets must not be a CNAME |
| 2308 | Negative Caching of DNS Queries (DNS NCACHE) | How NXDOMAIN and NODATA are cached, and the SOA minimum field. Caching of resolution failures (SERVFAIL, timeouts) is separately specified in RFC 9520 |
| 4592 | The Role of Wildcards in the Domain Name System | The precise * matching rules: a wildcard applies only where no explicit name matches, and never across a delegation |
| 6303 | Locally Served DNS Zones | Resolvers answer private-address reverse zones (RFC 1918 space and friends) locally instead of sending them toward the root |
| 6895 | Domain Name System (DNS) IANA Considerations | How the parameter registries (types, rcodes, classes) are governed |
| 9499 | DNS Terminology | The definitive glossary (BCP 219, 2024; obsoletes RFC 8499, which had already obsoleted RFC 7719). The source for "authoritative", "recursive", "stub" |
| 7766 | DNS Transport over TCP: Implementation Requirements | When and how DNS uses TCP, not just UDP |
| 8482 | Providing Minimal-Sized Responses to DNS Queries That Have QTYPE=ANY | The end of ANY as "give me everything": responders may answer with a subset or a synthesized HINFO. Some resolvers go further than the RFC and refuse outright (1.1.1.1 answers ANY with NOTIMP) |
Record types#
| RFC | Type(s) | Notes |
|---|---|---|
| 1035 | A, NS, CNAME, SOA, PTR, MX, TXT | The originals |
| 3596 | AAAA | IPv6 address record |
| 2782 | SRV | Service location (priority, weight, port, target) |
| 8659 | CAA | Certification Authority Authorization (obsoletes RFC 6844) |
| 8657 | CAA | The accounturi and validationmethods CAA extensions: restrict issuance to a specific ACME account or validation method |
| 9460 | HTTPS, SVCB | Service binding and HTTPS endpoint hints (port, ALPN, ECH) |
| 6698 | TLSA | DANE: pinning a cert or CA in DNS |
| 7671 | TLSA | DANE operational and updated guidance |
| 4255 | SSHFP | SSH host-key fingerprints in DNS |
| 2317 | PTR | Classless in-addr.arpa delegation (reverse DNS on non-octet boundaries) |
The full, current list of every assigned type lives in the IANA registry (below). See also the cheat sheet at record-types.
Zones and transfer#
| RFC | Title | Covers |
|---|---|---|
| 1982 | Serial Number Arithmetic | SOA serial comparison and wrap-around (which serial counts as "newer") |
| 1996 | A Mechanism for Prompt Notification of Zone Changes (DNS NOTIFY) | The "your zone changed, come refresh" prompt to secondaries |
| 1995 | Incremental Zone Transfer in DNS (IXFR) | Transfer only the diff. A UDP attempt is allowed first; falls back to TCP when the changes do not fit in one packet (§2) |
| 5936 | DNS Zone Transfer Protocol (AXFR) | Full transfer, multi-message framing, the terminal SOA (§2.2) |
| 2136 | Dynamic Updates in the Domain Name System (DNS UPDATE) | Adding and deleting records in a running zone (the nsupdate path), no zone-file reload required |
DNSSEC#
| RFC | Title | Covers |
|---|---|---|
| 4033 | DNS Security Introduction and Requirements | The threat model and what signing does (and does not) protect |
| 4034 | Resource Records for the DNS Security Extensions | DNSKEY, RRSIG, DS, NSEC |
| 4035 | Protocol Modifications for the DNS Security Extensions | The DO, CD, and AD bits, validation, serving signed data |
| 5155 | DNS Security (DNSSEC) Hashed Authenticated Denial of Existence | NSEC3: hashed denial. It hinders zone walking but does not prevent offline hash cracking; parameter guidance is RFC 9276 |
| 6840 | Clarifications and Implementation Notes for DNS Security (DNSSEC) | The corrections every validator follows |
| 6781 | DNSSEC Operational Practices, Version 2 | Key rollover, signing strategy |
| 6605 | Elliptic Curve Digital Signature Algorithm (DSA) for DNSSEC | ECDSA P-256 (algorithm 13), what most modern zones sign with |
| 4509 | Use of SHA-256 in DNSSEC Delegation Signer (DS) Resource Records | The current DS digest (digest type 2) |
| 9904 | DNSSEC Cryptographic Algorithm Recommendation Update Process | Obsoletes RFC 8624 (2025): which algorithms to use and which to retire now lives in the IANA DNSSEC algorithm registries, updated by process instead of by new RFC |
| 7344 / 8078 | CDS / CDNSKEY | Automating the DS update to the parent. RFC 9615 adds automatic bootstrapping of the first DS |
See dnssec for the walkthrough and dnssec-troubleshooting for the failure modes.
Encrypted DNS and privacy#
| RFC | Title | Covers |
|---|---|---|
| 7858 | Specification for DNS over Transport Layer Security (TLS) | DoT: DNS on a dedicated TLS port (853) |
| 8484 | DNS Queries over HTTPS (DoH) | DNS wire format inside HTTPS on 443 |
| 9250 | DNS over Dedicated QUIC Connections | DoQ: DNS over QUIC on UDP port 853, low-latency encrypted transport |
| 8310 | Usage Profiles for DNS over TLS and DNS over DTLS | Authentication and certificate handling for DoT (DoH authentication is covered in RFC 8484) |
| 9076 | DNS Privacy Considerations | What does and does not leak (obsoletes RFC 7626) |
See dot-doh for the hands-on comparison.
EDNS and extensions#
| RFC | Title | Covers |
|---|---|---|
| 6891 | Extension Mechanisms for DNS (EDNS(0)) | The OPT pseudo-record: larger messages, flags, options |
| 7871 | Client Subnet in DNS Queries | ECS: passing client-network hints to authoritative servers |
| 7873 | Domain Name System (DNS) Cookies | Lightweight off-path spoofing defense |
| 8914 | Extended DNS Errors | The EDE option: machine-readable error causes riding along with SERVFAIL and friends |
See query-types for how EDNS, ECS, and extension options interact with the query cycle.
Email authentication (DNS-adjacent)#
These live in TXT records, so they are DNS in practice. See email-records.
| RFC | Title | Notes |
|---|---|---|
| 7208 | Sender Policy Framework (SPF) | Which hosts may send for a domain |
| 6376 | DomainKeys Identified Mail (DKIM) Signatures | Cryptographic signing of mail, public key in DNS |
| 7505 | Null MX | MX 0 . signals a domain that accepts no mail; senders should bounce immediately |
| 7489 | DMARC | Original 2015 Informational spec, now obsoleted by RFCs 9989, 9990, and 9991 (2026); treat 7489 as historical. |
| 9989 | DMARC (current) | The 2026 Standards Track successor; obsoletes RFC 7489 and RFC 9091 (DMARC PSD). Policy and alignment live here; aggregate reporting moved to RFC 9990 and failure reporting to RFC 9991 |
Official non-RFC sources#
The registries and operators that hold the live, authoritative state:
- IANA DNS parameters: every assigned record type, rcode, and class: iana.org/assignments/dns-parameters
- IANA root servers: the 13 root server identities: iana.org/domains/root/servers
- Root zone management (ICANN/PTI): how the root zone is edited: iana.org/domains/root
- Root hints file: the
named.rootbootstrap list: internic.net/domain/named.root - IANA Special-Use Domain Names:
.example,.invalid,.localhost,.test: iana.org/assignments/special-use-domain-names. The registry itself is defined by RFC 6761; the original names were reserved by RFC 2606 - Root Server Technical Operations (root-servers.org): live root operator status: root-servers.org
Implementation and tool docs#
The canonical references for the software you will actually run:
- ISC BIND 9 (named, dig, delv): bind9.readthedocs.io
- Unbound (validating recursive resolver): unbound.docs.nlnetlabs.nl
- Knot DNS / kdig (CZ.NIC): knot-dns.cz/documentation
- PowerDNS: doc.powerdns.com
- DNSViz (visual DNSSEC analysis): dnsviz.net
- Cloudflare Learning Center: DNS: cloudflare.com/learning/dns
- Verisign DNSSEC debugger: dnssec-debugger.verisignlabs.com
Adjacent standards (the stack beneath DNS)#
Not DNS RFCs, but referenced by the foundations pages:
- ARP (address resolution): RFC 826
- NTP (network time): RFC 5905
- IPv4 private ranges (
10.0.0.0/8,172.16.0.0/12,192.168.0.0/16): RFC 1918 - IPv6 documentation prefix
2001:db8::/32: RFC 3849 (RFC 9637 later added3fff::/20) - IPv4 documentation ranges (
192.0.2.0/24,198.51.100.0/24,203.0.113.0/24): RFC 5737 - The OSI model is ISO/IEC 7498-1; VLAN tagging is IEEE 802.1Q. Neither is an RFC.
See also#
- 📖 Glossary: the terms, defined
- 🔬 DNS wiki home