DNS and domain glossary
Short, precise definitions of the terms that appear in a domain report, each with an example and the tool that checks it.
A
A record
An A record is the DNS record that maps a hostname to an IPv4 address, so that a name such as example.com can be reached at an address such as 192.0.2.10.
AAAA record
An AAAA record maps a hostname to an IPv6 address. It does for IPv6 what the A record does for IPv4.
Anycast
Anycast is a routing method in which the same IP address is announced from many locations at once, so that each user is routed to the nearest or best-connected one.
Apex domain
The apex domain, also called the root, naked or bare domain, is the registered name itself without any subdomain: example.com rather than www.example.com.
ASN (autonomous system number)
An ASN is the unique number of an autonomous system: a network, or group of networks, under one operator that exchanges routes with the rest of the internet using BGP.
Auth code (EPP code)
An auth code, also called EPP code, transfer code or AuthInfo, is the password for a single domain that authorises its transfer to another registrar.
Authoritative DNS
An authoritative DNS server holds the original records of a zone and answers from that data, as opposed to a resolver, which looks answers up on behalf of users and caches them.
C
CAA record
A CAA record states which certificate authorities are allowed to issue TLS certificates for a domain. CAs are required to check it before issuing.
ccTLD
A ccTLD (country-code top-level domain) is a two-letter TLD assigned to a country or territory on the basis of its ISO 3166-1 code, such as .de, .jp or .tr.
CDN (content delivery network)
A CDN is a network of servers in many locations that caches and delivers a site's content from a point close to each visitor, in front of the site's own origin server.
Certificate authority (CA)
A certificate authority is an organisation that checks control of a domain and issues TLS certificates for it, and whose root certificates are trusted by browsers and operating systems.
CNAME record
A CNAME record makes one hostname an alias of another: the resolver restarts the lookup with the target name and uses whatever records it finds there.
D
DKIM
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing email. Receivers verify it with a public key published in the sender's DNS, proving the message was authorised by that domain and not modified in transit.
DMARC
DMARC is a policy published in DNS that tells receiving mail servers what to do with messages that fail SPF and DKIM checks for your domain, and where to send reports about them.
DNS propagation
DNS propagation is the period after a DNS change during which some resolvers still return the old, cached answer while others already return the new one.
DNSSEC
DNSSEC adds digital signatures to DNS records so that a resolver can verify an answer really comes from the zone owner and was not altered on the way.
Domain transfer
A domain transfer moves the management of a domain from one registrar to another. The registrant stays the same, and so do the DNS records, as long as the DNS is hosted elsewhere.
DS record
A DS (delegation signer) record is published in the parent zone and contains a hash of a child zone's DNSSEC key. It is the link that connects a signed domain to the chain of trust.
E
G
H
I
M
N
Nameserver
A nameserver is a server that answers DNS queries. In everyday use the word means the authoritative servers that host a domain's DNS records, such as ns1.dns-host.example.
NS record
NS records list the authoritative nameservers of a DNS zone: the servers that hold the zone's records and answer for it.
P
R
RDAP
RDAP (Registration Data Access Protocol) is the modern replacement for WHOIS. It returns domain, IP and ASN registration data as structured JSON over HTTPS.
Recursive resolver
A recursive resolver is the DNS server your device sends its queries to. It finds the answer by asking the root, TLD and authoritative servers in turn, and caches the result.
Redemption period
The redemption period is a stage of roughly 30 days after a registrar deletes an expired gTLD domain, during which only the former registrant can restore it, usually for a substantial fee.
Registrant
The registrant is the person or organisation in whose name a domain is registered: the holder of the right to use it for the registration period.
Registrar
A registrar is a company accredited to sell domain registrations to the public and to enter them into the registry's database on the customer's behalf.
Registry
A registry is the organisation that operates a top-level domain: it keeps the authoritative database of all names under it and runs the TLD's nameservers.
Reverse DNS (rDNS)
Reverse DNS is looking up the hostname that belongs to an IP address, the opposite of the usual name-to-address lookup. It uses PTR records in the in-addr.arpa and ip6.arpa zones.
S
SOA record
The SOA (start of authority) record sits at the top of every DNS zone and holds its administrative parameters: primary nameserver, contact, serial number and timers.
SPF
SPF (Sender Policy Framework) is a TXT record in which a domain lists the servers that are allowed to send email using it, so that receivers can spot mail from unauthorised sources.
SRV record
An SRV record tells clients which host and port provide a particular service for a domain, together with a priority and a weight for choosing between several servers.
SSL/TLS certificate
An SSL/TLS certificate is a digitally signed file that binds a public key to one or more hostnames. It lets a browser confirm it is talking to the named site and set up an encrypted HTTPS connection.
Subdomain
A subdomain is any name beneath a registered domain, such as blog.example.com under example.com. The domain owner creates it in the DNS zone; nothing has to be registered.
T
TLD (top-level domain)
A TLD (top-level domain) is the last label of a domain name, such as com, org or tr. Each TLD is a zone delegated from the DNS root to a registry that operates it.
TTL
TTL (time to live) is the number of seconds a DNS answer may be cached before the resolver has to ask the authoritative servers again.
TXT record
A TXT record attaches free-form text to a DNS name. Today it is mostly used for machine-readable data such as SPF, DKIM and DMARC policies and domain ownership verification tokens.