The DNS records cheat sheet

Quick reference

Address

$dig example.com A +short
$dig example.com AAAA +short
$dig example.com A +noall +answer
$dig @1.1.1.1 example.com A
$dig example.com AAAA +noall +answer

Alias

$dig www.example.com CNAME +short
$dig example.com NS +short
$dig www.example.com CNAME +noall +answer
$dig +trace example.com
$dig www.example.com A +short

Mail

$dig example.com MX +short
$dig example.com TXT +short
$dig _dmarc.example.com TXT +short
$dig default._domainkey.example.com TXT
$dig example.com MX +noall +answer

Policy

$dig example.com CAA +short
$dig example.com DS +short
$dig example.com DNSKEY +short
$dig +dnssec example.com A
$dig example.com SOA +short

Explained

Address

An A record holds one IPv4 address, and AAAA holds one IPv6 address. Ask with dig example.com A +short and you get the value alone; drop +short when you need the TTL and the section it came from.

A second resolver is a second opinion. dig @1.1.1.1 example.com A asks Cloudflare instead of your local resolver, which separates a zone problem from a cache problem.

Alias

A CNAME points one name at another and must be the only data record at that name. dig www.example.com CNAME +short shows the target. NS shows the delegation, and dig +trace example.com walks root, TLD and zone in one command. dig www.example.com A +short shows what the chain resolves to.

Mail

MX carries a preference and a mail host. TXT carries SPF and other policy text; DMARC lives at _dmarc.example.com, and DKIM at selector._domainkey.example.com.

Policy

CAA names the certificate authorities allowed to issue for the name and its subdomains. DS and DNSKEY build the DNSSEC chain, and +dnssec asks for the signatures. SOA holds the serial and the negative-cache timer.

In one line

Check the delegation

$dig +trace example.com