DNS Records & Lookups Cheat Sheet
DNS record types (A, AAAA, CNAME, MX, TXT, NS, PTR, SOA), lookup commands, and troubleshooting flows.
Web & Network
dns
records
lookup
DNS translates human-readable names into the records that drive routing, email, and service discovery. Each record type answers a different question; knowing which one to query is half the job.
Common record types
Table
| Type | Purpose | Example value |
|---|---|---|
A | IPv4 address | 93.184.216.34 |
AAAA | IPv6 address | 2606:2800:220:1:248:1893:25c8:1946 |
CNAME | Alias to another name | www.example.com. |
MX | Mail server + priority | 10 mail.example.com. |
TXT | Arbitrary text (SPF, DKIM, verification) | v=spf1 include:_spf.example.com ~all |
NS | Authoritative name server | ns1.example.com. |
PTR | Reverse lookup (IP → name) | 34.216.184.93.in-addr.arpa. |
SOA | Zone authority + serial | ns1.example.com. hostmaster... |
SRV | Service location (port/weight) | 10 5 443 sip.example.com. |
CAA | Allowed certificate authorities | 0 issue "letsencrypt.org" |
Lookup with dig
dig is the standard query tool. It shows the full answer section, authority, and timing by default.
bash
dig example.com
dig example.com A
dig example.com MX
dig example.com TXT
dig example.com NS
dig -x 93.184.216.34 # reverse (PTR)
dig @8.8.8.8 example.com # query a specific resolver
dig example.com +short # terse answer only
dig example.com +trace # follow delegation from the root
Table
| Flag | Meaning |
|---|---|
+short | Print only the answer values. |
+trace | Show the full resolution path from root servers. |
+noall +answer | Suppress everything except the answer section. |
@server | Query a specific DNS server. |
-x IP | Reverse lookup (PTR). |
Lookup with nslookup and host
bash
nslookup example.com
nslookup -type=MX example.com
host example.com
host -t TXT example.com
Troubleshooting flow
- Confirm the record exists:
dig example.com A +short - Check the authoritative server:
dig example.com NS +short, then query it directly. - Verify propagation: query multiple public resolvers (
8.8.8.8,1.1.1.1,9.9.9.9). - Inspect TTL to estimate how long stale caches persist.
- Check DNSSEC/validation with
dig example.com +dnssec.
Table
| Symptom | Likely cause |
|---|---|
| New record not visible | TTL cache, wrong nameserver |
| NXDOMAIN | Record missing or wrong zone |
| SERVFAIL | DNSSEC or upstream resolver error |
| Timeout | Firewall blocking port 53 |