DNS glossary

Terms used in the rest of the wiki, defined once. Cross-linked where deeper coverage exists.

Test yourself#

Three one-liners that exercise terms defined below. example.isitdns.net is a real public zone; paste and run.

1. Recursion (RD, RA): rd ra in the flags line means the client asked for recursion and the server offered it.

   dig @1.1.1.1 example.isitdns.net A

   ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

1. AD bit: ad in the flags line means the resolver validated the DNSSEC chain (RFC 4035). Queried over DoH (+https) so nothing on the path can strip the flag.

   dig @1.1.1.1 +https +dnssec example.isitdns.net A

   ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

1. TTL: ask twice and the number in the second column drops, because the answer is counting down in a cache.

   dig @1.1.1.1 +noall +answer example.isitdns.net A

   example.isitdns.net.	13	IN	A	192.0.2.1
   example.isitdns.net.	10	IN	A	192.0.2.1

A: F#

0x20 encoding: Query-name case randomization. The client mixes the case of the name it asks for (ExAmPlE.CoM) and requires the response to echo it back byte for byte, adding entropy against off-path spoofing. It works because DNS matching is case-insensitive while the wire format preserves the case as sent (RFC 4343). A middlebox that rewrites the name to lowercase shows up in the answer. See path-attestation.

A record: Resource record mapping a name to an IPv4 address. See a and The dig-along.

AAAA record: Resource record mapping a name to an IPv6 address. Pronounced "quad-A." See aaaa and The dig-along.

AA (Authoritative Answer): Flag set in a DNS response when the responder is authoritative for the zone containing the answer. Always check before trusting an answer is canonical.

AD (Authenticated Data): Flag set in a response when the resolver successfully validated the DNSSEC signature chain. See dnssec.

Aggressive NSEC use: A validating resolver using an NSEC/NSEC3 record it already has cached to answer other names it can prove do not exist, without asking the authoritative server again (RFC 8198). Cuts junk queries to the authority; it also means a signed wildcard can be synthesized locally instead of fetched. See dnssec.

Anycast: Routing technique where multiple servers share the same IP address; clients reach the topologically nearest one. Used by major public resolvers (1.1.1.1, 8.8.8.8, 9.9.9.9). See fundamentals.

Authoritative server: Server that holds the master copy of a zone and answers definitively for it. Opposite of recursive.

AXFR: Full zone transfer. Used to seed a secondary nameserver from the primary. Almost always restricted by ACL or TSIG. See transfer.

CAA record: Tells public certificate authorities which CA may issue certificates for the zone. Compliant CAs must check it. See caa and caa-policy.

Cache hit: A resolver answering from its in-memory cache without going upstream. The cheapest possible answer.

Caching resolver: Same as a recursive resolver. The "recursive" part refers to how it answers; the "caching" part refers to what it remembers. See anatomy-of-a-query.

CD (Checking Disabled): Flag a client can set to ask the resolver NOT to validate DNSSEC. Rare; mostly for debugging.

CNAME: Canonical Name. An alias from one name to another. The resolver chases CNAMEs transparently. See cname and The dig-along.

Delegation: A parent zone handing authority for a subtree to a child zone, via NS records at the cut point. Glue records carry the addresses when the nameservers live inside the child. See delegations.

dig: The standard DNS query tool, shipped with most Linux distros. See dig-flags and nslookup-and-dig.

DNS Cookie: An EDNS(0) option (RFC 7873, updated by RFC 9018) that gives a server cheap evidence the client address is not spoofed. A UDP query carrying no valid server cookie can be answered with TC=1 to force a TCP retry, which a spoofed source cannot complete. The presence of a cookie option is not the same as a valid one.

DNSSEC: DNS Security Extensions. Adds cryptographic signatures to records so a validating resolver can prove an answer wasn't tampered with. See dnssec.

DNSKEY: DNSSEC public key record published in a zone. Resolvers use it to verify RRSIG records. See dnssec.

DoH: DNS over HTTPS. Encrypted DNS over port 443. See DoT, DoH, DoQ.

DoT: DNS over TLS. Encrypted DNS over port 853. See DoT, DoH, DoQ.

DoQ: DNS over QUIC (RFC 9250). Encrypted DNS transport using QUIC on UDP port 853; QUIC provides its own TLS-based security and multiplexing. See DoT, DoH, DoQ.

dnstap: Protocol for streaming DNS query/response events from a resolver to an analysis tool, using Protocol Buffers over a Unix or TCP socket. The modern replacement for syslog-based query logging. Defined at dnstap.info; supported by BIND, Knot, Unbound, and PowerDNS.

DS record: Delegation Signer. Published in the parent zone to fingerprint the child zone's DNSKEY. Builds the DNSSEC chain across delegation boundaries. See dnssec and delegations.

Ed25519: EdDSA signature scheme over Curve25519 (RFC 8032): 32-octet public keys, 64-octet signatures, verifiable offline against a published key. Registered as DNSSEC algorithm 15 (RFC 8080), and the primitive behind the signed receipts in path-attestation.

EDE (Extended DNS Error): An EDNS(0) option carrying a machine-readable reason code alongside the rcode, so a SERVFAIL can say why it failed instead of leaving you to guess (RFC 8914). See dnssec-troubleshooting.

EDNS(0): Extension Mechanisms for DNS (RFC 6891). Adds an OPT pseudo-record carrying options the original protocol could not: large UDP buffer sizes, the DNSSEC OK bit, and optional extensions such as COOKIE (RFC 7873) and CLIENT_SUBNET/ECS (RFC 7871, privacy-sensitive). See fundamentals and dnssec.

Forwarder: A resolver that sends every query to another recursive server upstream instead of walking the hierarchy itself. Common in enterprise networks and home routers. See forward.

FQDN: Fully Qualified Domain Name. A name with the trailing dot, fully resolved relative to root. isitdns.net. (with trailing dot) is an FQDN. Most applications and UIs omit the trailing dot by convention; zone files require it to prevent the $ORIGIN suffix from being appended. See fundamentals.

G: O#

Glue record: An A/AAAA record published in a parent zone for a nameserver of a child zone, used to break the chicken-and-egg of "how do I look up the NS for example.com when example.com's NS records are example.com names?" See delegations.

HTTPS / SVCB records: Service Binding records (RFC 9460). Let a name advertise connection parameters up front: ALPN protocols, address hints, ECH config. SVCB is type 64; the HTTPS record is its type-65 sibling, which browsers now query alongside A and AAAA. See https-svcb.

Insecure delegation: A delegation where the parent publishes NS records for the child but no DS, and proves the DS is absent with signed NSEC/NSEC3 (RFC 4035 §5.2). That authenticated denial is what tells a validator the child is provably unsigned, so it accepts the child's unsigned answers instead of returning SERVFAIL. See delegations and path-attestation.

IXFR: Incremental zone transfer. Like AXFR but only the records that changed since a given serial number. See transfer.

Lame delegation: When a zone's NS records point to nameservers that don't actually serve the zone. Common cause of intermittent SERVFAILs. See delegations.

Master / Primary / Slave / Secondary: Old terms (master/slave) and modern terms (primary/secondary) for the authoritative nameservers in a zone-transfer relationship. The primary holds the master copy; secondaries pull AXFR/IXFR. See transfer and authoritative zones.

MX record: Mail Exchanger. Names the mail server(s) for a domain, with a priority. See mx and email-records.

Negative cache: Resolver behavior of remembering a negative answer, both NXDOMAIN (name does not exist) and NODATA (name exists, type does not), for a bounded time. The actual negative cache TTL used is min(SOA MINIMUM field, SOA record TTL). Per RFC 2308 §5, lowering only the MINIMUM field while leaving the SOA record's own TTL high will not shorten negative caching. Prevents the resolver from re-asking authoritative servers for typos. See soa and fundamentals.

NODATA: Not a real rcode: shorthand for a NOERROR response with an empty answer section. The name exists, but not with the type you asked for. Cached like NXDOMAIN per RFC 2308.

NOERROR: DNS rcode 0. The query was handled successfully: even if the answer section is empty.

Nonce: A number used once. In DNS diagnostics, a fresh random label placed in the query name so that no cache, forwarder, or precomputed answer can hold the response in advance: getting an answer at all means the query reached an authoritative server. See path-attestation.

NS record: Names an authoritative nameserver for a zone. See ns, delegations, and The dig-along.

NSEC / NSEC3: DNSSEC records used to prove that a name does not exist (the cryptographic version of NXDOMAIN). Without these, an attacker could forge NXDOMAIN. See dnssec and dnssec-troubleshooting.

NSID: Name Server Identifier (RFC 5001). An EDNS(0) option asking the server which instance answered (dig +nsid). Handy behind anycast, but unauthenticated: anything on the path can strip or forge it, so treat it as a hint, not proof.

NXDOMAIN: DNS rcode 3. "Name does not exist." Definitive negative answer. Caveat: some hosted zones never emit it. DNSSEC-signed Cloudflare-hosted zones answer missing names with NOERROR plus a proving NSEC record instead (the "black lies" scheme), so an empty NOERROR can be the same verdict in disguise. Unsigned Cloudflare zones still return a real NXDOMAIN.

OPT pseudo-record: The EDNS extension record. Lives in the additional section of every EDNS-enabled query.

P: Z#

Path attestation: A signed statement from an authoritative server that a specific query reached it and that the answer came back unmodified: a property of the path, where DNSSEC proves a property of the data. Verified offline against a published Ed25519 key, and scoped to that one query, that one zone, at that one moment. See path-attestation.

PTR record: Reverse DNS. Maps an IP back to a name. Stored under *.in-addr.arpa (IPv4) or *.ip6.arpa (IPv6). See ptr, reverse-dns, and The dig-along.

QName: Question Name. The name being asked about in a DNS query. See query-types and anatomy-of-a-query.

QNAME minimization: Resolver behaviour of sending each server only as much of the query name as it needs to give a referral, walking down the delegation one label at a time instead of handing the full name to every server on the way (RFC 9156, which obsoletes RFC 7816). Limits what each server learns. It relies on intermediate names answering NODATA rather than NXDOMAIN, because an NXDOMAIN at any cut denies everything below it (RFC 8020). See anatomy-of-a-query.

QType: Question Type. The record type being asked about (A, AAAA, MX, …). See query-types.

RA (Recursion Available): Response flag. The server is willing to recurse on behalf of the client. Authoritative-only servers should NOT set this.

rcode: Response code. The verdict in a DNS answer. Common values: NOERROR (0), FORMERR (1), SERVFAIL (2), NXDOMAIN (3), NOTIMP (4), REFUSED (5). See DNS fundamentals: refresher.

RD (Recursion Desired): Query flag. The client wants the resolver to do the recursion. Default for most stub-resolver queries.

Recursive resolver: Server that walks the DNS hierarchy on behalf of a client, caching results. The one in your /etc/resolv.conf. Opposite of authoritative. See anatomy-of-a-query and forward.

REFUSED: DNS rcode 5. The server refused to answer. Usually means the client is outside the recursion ACL, or recursion is off and the question was not for an owned zone.

Root server: One of the 13 logical name servers (a.root-servers.net through m.root-servers.net) that serve the root zone (.). Operated by 12 different organizations. Implemented as anycast: the 13 letters are backed by more than 2,000 server instances worldwide in total as of July 2026 (live count at root-servers.org). See anatomy-of-a-query.

RPZ: Response Policy Zone. A mechanism for a resolver to rewrite responses based on a policy zone: used for threat-feed blocking, DNS firewall, captive-portal redirection. Visible in dnstap output as policy_* fields (policy_action, policy_type, policy_value). Specified in the ISC RPZ draft; supported by BIND, Unbound, Knot Resolver, and PowerDNS Recursor. See forward for resolver configuration context.

RRSIG: DNSSEC signature record. Cryptographically signs an RRset. Verified against the zone's DNSKEY. See dnssec.

RRset: A set of resource records sharing the same name, class, and type. Signed (in DNSSEC) and cached together.

SERVFAIL: DNS rcode 2. "Server failure." Could mean upstream broken, DNSSEC validation failed, recursion timeout, or a software bug. Always investigate. See when-its-dns.

SOA record: Start of Authority. Zone metadata: primary NS, admin contact, serial, refresh/retry/expire timers, negative-cache TTL. Every zone has exactly one at its apex. See soa and The dig-along.

Split-horizon DNS (also called DNS views): A name resolves to different answers depending on who is asking. Common pattern: internal clients get RFC1918 addresses, external clients get public ones. Implemented via an ACL that matches clients to a view, where each view holds its own copy of the zone. See split-horizon and authoritative zones for working examples.

SRV record: Service location. Names a host and port for a service, with priority + weight. Used by XMPP, SIP, LDAP, etc. See srv and The dig-along.

Stub resolver: Minimal client-side resolver, usually built into the OS. Asks a recursive resolver a single question and relays the answer back to the application. Never recurses itself. See anatomy-of-a-query and stub.

TC (Truncated): Response flag set when a UDP answer does not fit in the packet. Tells the client to retry over TCP. RFC 1035 defines the flag; EDNS(0) raises the practical limit of UDP payload size, reducing how often truncation occurs. See fundamentals.

TLD: Top-Level Domain. The last label of an FQDN: .com, .net, .org, ccTLDs like .uk, new gTLDs like .cafe.

TSIG: Transaction Signature. HMAC-based authentication for DNS messages, used to authorize AXFR/IXFR/UPDATE. See transfer and ddns.

TTL: Time To Live. How long, in seconds, resolvers may cache a record before re-asking authoritative. See DNS fundamentals: refresher.

TXT record: Arbitrary text. Used for SPF, DKIM, DMARC, domain verification. See txt, email-records, and The dig-along.

View (DNS view): A scoped set of zones served only to clients that match a given ACL. BIND implements views directly (the view statement), as does Unbound (the view: clause); other servers reach the same effect through modules or scripted backends. Views are the mechanism behind split-horizon DNS: same zone name, different copies per view, ACL chooses which. See split-horizon and authoritative zones for working examples.

Wildcard record: A record at *.zone that matches any name below that node for which no closer explicit record exists, at any depth (RFC 4592). The common belief that a wildcard only matches one label is incorrect; a closer explicit node stops synthesis for names in that subtree. See The dig-along.

Zone: A contiguous portion of the DNS namespace administered as a unit. isitdns.net is a zone; so is example.isitdns.net if it has been delegated separately. See authoritative zones and delegations.

Zone apex: The top of a zone: the name that matches the zone itself (isitdns.net for the isitdns.net zone). Must contain SOA and NS records. See soa, ns, and authoritative zones.

Acronym quick-reference#

See also#

• DNS fundamentals
• The dig-along
• Record-type cheat sheet
• dig flag reference
• nslookup and dig
• Anatomy of a query
• RFC index
• DNS wiki home