DNS Record Types Explained: A, AAAA, CNAME, MX and More for Network+

DNS record types are pure recall, and they turn up on Network+, Security+, and A+ alike. The list is short enough to own in an evening, and several of them carry security implications that exams test separately.

A record maps a name to an IPv4 address. Almost everything else is a variation on that idea — different address family, different purpose, or a pointer to another name.

The Records You Must Know

Record	Maps	Notes
A	Hostname → IPv4 address	The fundamental record. "Address record."
AAAA	Hostname → IPv6 address	Called a "quad-A" record. Four As because IPv6 addresses are four times the size of IPv4.
CNAME	Alias → another hostname	Canonical name. Points a name at another name, never at an IP address.
MX	Domain → mail server	Mail exchanger. Carries a priority value; lower numbers are preferred.
NS	Domain → authoritative name server	Delegates a zone to the servers responsible for it.
PTR	IP address → hostname	Pointer. The reverse of an A record, used for reverse DNS lookups.
SOA	Zone metadata	Start of Authority. Primary name server, admin email, serial number, and the refresh, retry, expire and TTL timers. Exactly one per zone.
TXT	Arbitrary text	Originally free text; now the workhorse for SPF, DKIM and DMARC, and for domain ownership verification.
SRV	Service → host and port	Service record. Used heavily by Active Directory, SIP and XMPP to locate services.
CAA	Domain → permitted certificate authorities	Certification Authority Authorization. Restricts which CAs may issue certificates for the domain.

The Three That Cause Confusion

A versus AAAA. Easy once you hear why: IPv6 addresses are four times the length of IPv4 addresses, so the record name gets four As. That mnemonic is worth having ready.

CNAME's restriction. A CNAME points to another name, and it cannot coexist with other records for the same name. In particular, you cannot put a CNAME at the zone apex — the bare domain — because the apex must hold SOA and NS records. This is why providers invented non-standard workarounds such as ALIAS and ANAME records, and it is a genuine real-world constraint worth knowing.

PTR records live in a special zone. Reverse lookups do not search forward zones; they query in-addr.arpa for IPv4 and ip6.arpa for IPv6, and the address is reversed. This matters practically because mail servers check reverse DNS — a sending server with no valid PTR record frequently has its mail rejected as spam.

The Security-Relevant Records

TXT deserves separate attention because it carries the entire email authentication stack:

• SPF — lists the IP addresses authorized to send mail for the domain.
• DKIM — publishes the public key used to verify message signatures, at a selector-based subdomain.
• DMARC — published at _dmarc.yourdomain.com, sets the policy for failures and requests reports.

CAA limits which certificate authorities may issue for your domain, which reduces the risk of a mis-issued certificate.

And the zone transfer record types matter for a different reason: AXFR (full transfer) and IXFR (incremental) are legitimate replication mechanisms between name servers, but a misconfigured server that allows AXFR to anyone hands an attacker a complete map of your internal hosts. Testing for open zone transfers is standard reconnaissance, and restricting them to authorized secondaries is standard hardening.

TTL and Why It Matters Operationally

Every record carries a time to live telling resolvers how long to cache it. Long TTLs reduce query load and improve performance; short TTLs mean changes propagate quickly.

The practical habit: lower the TTL a day or two before a planned migration, make the change, then raise it again. A record with a 24-hour TTL that you change at noon will still be sending some users to the old address the following day, and there is nothing you can do about it after the fact.

Other Records Worth Recognizing

• DNSKEY, RRSIG, DS, NSEC/NSEC3 — the DNSSEC records, which add cryptographic signatures so resolvers can verify a response has not been forged. DNSSEC provides authenticity and integrity, not confidentiality — a commonly tested distinction, and the reason DoH and DoT exist separately for privacy.
• SPF — an obsolete dedicated record type; SPF is now published as TXT.
• ALIAS / ANAME — vendor-specific, to work around the CNAME apex restriction.

Network+ (N10-009) Exam Tips

• Memorize the table. Given a record type, state its purpose, and vice versa. This is straightforward recall and it appears reliably.
• A is IPv4, AAAA is IPv6.
• CNAME points to a name, not an address, and cannot sit at the zone apex.
• MX priority: lower is preferred.
• PTR is reverse lookup, and mail servers check it.
• SOA holds the zone timers and there is one per zone.
• Know the tools: nslookup, dig, and querying a specific record type with them.
• Know DNS ports: UDP 53 for queries, TCP 53 for zone transfers and large responses.

Security+ and CySA+ Angles

Security+ (SY0-701) focuses on TXT records carrying SPF, DKIM and DMARC; CAA for certificate control; DNSSEC for response integrity; and DNS attacks — cache poisoning, spoofing, hijacking, and DNS tunnelling as a covert channel.

CySA+ (CS0-004) treats DNS logs as a primary analyst data source: detecting tunnelling by query length and entropy, spotting domain-generation algorithms through NXDOMAIN patterns, identifying newly registered domains, and using passive DNS to pivot during an investigation.

Key Takeaways

• A = IPv4, AAAA = IPv6, CNAME = alias to another name.
• MX for mail with lower priority preferred; NS delegates the zone; SOA holds its metadata.
• TXT carries SPF, DKIM and DMARC — the whole email authentication stack.
• PTR is reverse lookup and missing PTR records get mail rejected.
• CNAME cannot sit at the zone apex.
• Restrict zone transfers, or you publish a map of your network.
• Lower the TTL before a migration, not after.