DNS Glossary

An A record is a DNS resource record that stores an IPv4 address for its owner name. A name can have more than one A record, allowing the same name to return multiple IPv4 addresses.

An AAAA record, commonly called a “quad-A” record, stores an IPv6 address for its owner name. Each AAAA record contains one 128-bit IPv6 address, and a name can have multiple AAAA records.

An authoritative DNS server answers for DNS zones for which it has authority, using the authoritative data for those zones. “Authoritative” describes the server’s role for particular DNS data; the same DNS software can sometimes perform other roles as well.

A CNAME record identifies its owner name as an alias and points to another domain name, called the canonical name. DNS resolution continues using that target name when the requested data is not present at the alias.

A CNAME is a DNS aliasing mechanism, not an HTTP redirect.

A delegation creates a separate child DNS zone beneath a parent zone. It occurs when the parent publishes an NS RRset for the child zone, directing resolvers toward the name servers responsible for that child.

The Domain Name System (DNS) is a distributed, hierarchical query-response system for storing and retrieving data associated with domain names. Mapping names to IP addresses is one common use, but DNS supports many other record types and purposes.

DNS caching is the reuse of DNS data that a resolver has already learned. Cached records can normally be reused until their TTL expires, reducing repeated queries to upstream and authoritative servers.

Negative answers such as NXDOMAIN can also be cached.

DNS filtering applies policy during DNS resolution. A policy-enforcing resolver can allow normal resolution or change the response based on domain rules, content categories, threat intelligence, or other policy inputs.

The DNS protocol does not define a universal filtering policy model.

DNS over HTTPS (DoH) carries DNS queries and responses over HTTPS. It encrypts the DNS transport between the client and the DoH server and uses HTTP as the application-layer transport for DNS messages.

DoH changes how DNS messages are transported, not the meaning of the DNS records being queried.

A DNS zone is a portion of the DNS namespace managed as a unit of administrative authority. It begins at a zone apex and extends downward until reaching delegations to child zones.

A DNS zone and a domain are related concepts, but they are not always the same boundary.

DNS Security Extensions (DNSSEC) add cryptographic authentication and data integrity to DNS data, including authenticated denial of existence. DNSSEC can help a validating resolver determine whether DNS data is authentic and unmodified.

DNSSEC does not encrypt DNS queries or responses.

A domain name is an ordered sequence of labels in the DNS namespace, such as www.example.com. Domain names can identify hosts, zones, services, mail infrastructure, and other DNS objects, so a domain name is not necessarily a hostname.

A fully qualified domain name (FQDN) contains all of the labels needed to identify a name relative to the DNS root. In DNS presentation format, the trailing dot makes the root explicit, as in www.example.com.

The trailing dot is often omitted in ordinary application interfaces.

A hostname is a domain name used to identify a host and generally follows the hostname syntax defined for Internet hosts. Not every DNS domain name is a hostname because DNS names can also identify zones, services, mail exchangers, and other objects.

An NS record identifies a name server associated with a DNS zone. NS records at a delegation point in a parent zone direct resolvers to the authoritative name servers for the delegated child zone.

NXDOMAIN is a DNS response code indicating that the queried domain name does not exist. It is different from a response where the name exists but has no record of the requested type, commonly called NODATA.

NXDOMAIN responses can be cached.

Protective DNS uses recursive DNS as a security control by applying threat intelligence and security policy during resolution. It can prevent resolution of domains associated with malicious activity and produce DNS telemetry that supports investigation and monitoring.

Specific protective DNS capabilities and policy models vary by implementation.

RDATA, short for resource data, is the type-specific data portion of a DNS resource record. Its format depends on the record type: an A record contains an IPv4 address in its RDATA, while a CNAME record contains another domain name.

A recursive resolver receives a DNS query from a client and works to obtain the answer on the client’s behalf, querying other DNS servers as needed. Recursive resolvers commonly cache the answers they learn, although recursion and caching are separate behaviors.

A resource record (RR) is a basic unit of data in DNS. A resource record contains an owner name, record type, class, TTL, and type-specific RDATA.

Examples include A, AAAA, CNAME, NS, and SOA records.

An RRset, or Resource Record Set, is the group of DNS resource records that share the same owner name, class, and record type while containing different data. For example, multiple A records for the same name form one A RRset.

The records in an RRset use the same TTL. RRSIG records are the standards-defined exception: signatures at one name that cover different record types do not form a single RRset.

An SOA record, or Start of Authority record, contains administrative and timing information for a DNS zone. Its fields include the zone’s primary source name, responsible-party field, serial number, refresh, retry, and expire timers, plus a minimum field whose modern defined use is the TTL for negative caching.

A zone has an SOA record at its apex.

A stub resolver is the client-side DNS component that sends queries to a recursive resolver rather than performing the full DNS resolution process itself. Operating systems commonly provide stub-resolver functionality for applications.

Time to Live (TTL) is the value in a DNS resource record that specifies how long the record may be cached before the source of the information should be consulted again. A resolver can discard cached data earlier, and defined stale-answer behavior can allow expired data to be served in some failure conditions.

The zone apex is the domain name at the top of a DNS zone. It is the point from which the zone’s authoritative data begins and is the owner name of the zone’s SOA and authoritative NS RRsets.

In zone-file terminology, the same name is often called the zone origin.