There are dozens of record types and about nine that carry almost all the security-relevant meaning. This lesson is the reference for those nine, with the fields that matter rather than every field that exists.
SOA — the zone’s own metadata
certadns.com. SOA ns1.certadns.com. hostmaster.certadns.com.2026091002 10800 3600 604800 300
ns1.certadns.com.— MNAME, the primary nameserver. Where secondaries fetch the zone from, and where dynamic updates are sent.hostmaster.certadns.com.— RNAME, the responsible contact as an address with the @ replaced by a dot:hostmaster@certadns.com.2026091002— the serial. Secondaries transfer the zone only when this increases, so a change published without bumping it never reaches them.10800— refresh. How often a secondary checks for a new serial.3600— retry, after a failed check.604800— expire. A secondary that cannot reach the primary for this long stops answering. Seven days here.300— the negative-caching TTL. How long resolvers remember that a name does not exist.
Checked 2026-09-12. The serial in the common YYYYMMDDnn convention reads as the second change made on 10 September 2026 — readable, and not required to be anything in particular beyond increasing.
The rest
| Type | Holds | Security relevance |
|---|---|---|
| NS | A nameserver name for the zone. | The parent’s copy decides who answers for you. Changing it is a total takeover. |
| A / AAAA | An IPv4 / IPv6 address. | Pointing at an address you no longer control is how subdomain takeover starts. |
| CNAME | An alias to another name. | The most common dangling-record type by a wide margin. |
| MX | A mail host and preference. | An MX on a domain that should not receive mail is worth investigating — on a lookalike domain it is a strong signal. |
| TXT | Arbitrary text. | Carries SPF, DKIM, DMARC and verification tokens. Stale verification tokens are a quiet way to keep a third party’s claim on your domain alive. |
| CAA | Which CAs may issue certificates. | Its own module, next but one. |
| PTR | Reverse DNS for an address. | Controlled by whoever owns the address block, not by you. Weak evidence, useful in investigations. |
| SRV | Service, protocol, host, port. | Used by autodiscovery. An attacker-controlled SRV can redirect a client’s configuration. |
The CNAME restriction, and why it matters
A name with a CNAME may have no other records. That is not a convention, it is a protocol rule, and two consequences follow:
- You cannot put a CNAME at a zone apex —
example.comitself — because the apex must carry SOA and NS records. Providers offering "ALIAS" or "CNAME flattening" are resolving the target and serving the result as an A record; it is a provider feature, not a DNS one. - A name with a CNAME cannot also carry MX or TXT. Adding a CNAME to a name that already has a verification TXT record silently breaks one of them, depending on the provider.
Reading a record set by hand
dig ANY example.com is not a reliable way to see everything — many servers deliberately refuse or minimise ANY queries. Ask for the types you care about:
for t in SOA NS A AAAA MX TXT CAA; do dig +noall +answer $t example.com; done
A word on TXT hygiene
TXT records accumulate. A domain of any age carries verification tokens for services cancelled years ago, old SPF fragments, and strings nobody recognises. They look harmless and two of them are not:
- A verification token for a service you no longer use may still let that service’s account holder — possibly a former agency — claim your domain inside their platform.
- An old SPF fragment can become a second
v=spf1record, which permanently breaks SPF evaluation for the domain.
Reviewing TXT records is unglamorous and it is one of the highest-yield things in a first domain assessment.