A record
An Address record maps a domain name to a 32-bit IPv4 address. It is one of the most common DNS data types and is normally used for forward name resolution.
Category glossary
Search all termsDNS
311 definitions associated with DNS.
AA flag
The Authoritative Answer bit in a DNS response indicates that the responding server is authoritative for the name in the answer section. It does not mean every item in the response is authoritative, such as some additional-section data.
AAAA record
An IPv6 Address record maps a domain name to a 128-bit IPv6 address. The name is pronounced "quad A".
Absolute domain name
A domain name expressed relative to the DNS root, usually shown with a trailing dot, such as host.example.com. The trailing dot prevents a resolver or tool from appending a local search suffix.
Active Directory-integrated zone
A Microsoft DNS zone whose data is stored in Active Directory and replicated through AD replication rather than only through DNS zone transfers. It can support secure dynamic updates and multi-writer operation on eligible domain controllers.
Address registration
A mechanism by which a host informs a DHCPv6 infrastructure component about an IPv6 address it configured through another method, such as SLAAC. This can help DDI systems maintain address visibility and DNS registration.
Aging
A Microsoft DNS mechanism that timestamps eligible dynamically registered records so old data can later be removed by scavenging. Static records normally do not age unless explicitly converted or timestamped.
Alias
A name that points to another canonical name or target. CNAME is the standardized alias record for most owner names, while provider-specific ALIAS or ANAME features often synthesize A and AAAA answers at a zone apex.
ALIAS record
A non-standard provider feature that allows an alias-like configuration where a CNAME is not allowed, often at the zone apex. The authoritative platform follows the target and returns synthesized address records.
Allow-query
A policy controlling which clients may ask a DNS server questions. It is commonly enforced globally, per view, or per zone.
Allow-recursion
A policy controlling which clients may use a resolver to perform recursive resolution. Restricting recursion prevents an internal resolver from becoming an open resolver.
Allow-transfer
A policy controlling which systems may request AXFR or IXFR zone transfers. Transfers should normally be limited to designated secondaries and management systems.
ANAME record
A proposed or vendor-specific alias-at-apex mechanism that lets an operator point a name to another name while serving address records to clients. It is not a universally standardized DNS resource record type.
ANY query
A DNS query using QTYPE 255 that asks for whatever records a server chooses to return for a name. It does not reliably mean "all records" and modern servers often minimize or synthesize the response to reduce abuse.
Anycast
A routing design in which multiple nodes advertise the same service IP address and the network directs a client to a reachable instance, often the topologically closest one. Anycast is widely used for authoritative and recursive DNS resilience.
Apex
The top name of a DNS zone. It is also called the zone apex and contains the zone's SOA and authoritative NS record sets.
Authoritative answer
A response based on data for which the responding server is authoritative, rather than solely on recursive cache content. The AA bit normally identifies authoritative responses.
Authoritative data
DNS data served from an authoritative zone or a properly configured authoritative data source. Cached copies at resolvers are not authoritative data even when they reproduce the same record set.
Authoritative server
A DNS server that provides authoritative answers for one or more zones. It may obtain data from a primary source, a zone transfer, a database, a catalog, or a hosted control plane.
Authoritative-only server
A server configured to answer only from its authoritative zones and not to provide recursion to clients. Public authoritative infrastructure should normally use this model.
AXFR
A full zone transfer that sends the complete contents of a zone from one authoritative server to another authorized system. Large or sensitive transfers should be protected by ACLs, TSIG, and secure transport where supported.
Bailiwick
The domain namespace for which a server is considered authoritative in a particular delegation context. Resolvers use bailiwick rules to decide which additional data, especially glue, can be safely cached.
Base domain
An informal term that may mean the registrable domain, organizational domain, or zone apex depending on context. Because it is ambiguous, documentation should state the intended meaning.
BIND
Berkeley Internet Name Domain, a widely used open-source DNS server and tool suite maintained by ISC. Its configuration vocabulary influences many general DNS terms, even when another platform is used.
Blackhole DNS
A configuration that intentionally returns no useful result or directs selected names to a non-routable or controlled destination. The term can refer to policy blocking, sinkholing, or routing a DNS service address to discard traffic.
Blocklist
A list of domains, addresses, clients, or indicators for which an action such as deny, redirect, log, or quarantine is applied. Modern documentation often uses blocklist instead of blacklist.
CAA record
A Certification Authority Authorization record states which certificate authorities are permitted to issue certificates for a domain and can define incident-reporting contacts. Certificate authorities are expected to check it before issuance.
Cache
Temporary storage of DNS responses and related metadata by a resolver or intermediary. Cached data is reused until its TTL expires or the cache is cleared, replaced, or invalidated.
Cache hit
A query answered from cached data without contacting an upstream authoritative server. A high cache-hit rate can reduce latency and upstream load, though the right rate depends on workload and TTLs.
Cache miss
A query for which the resolver does not have usable cached data and must perform resolution or forwarding. Misses increase upstream traffic and usually add latency.
Cache poisoning
The insertion of false DNS data into a resolver cache so future clients receive an attacker-chosen answer. Defenses include strong transaction matching, source-port randomization, DNSSEC validation, cookies, and hardened bailiwick processing.
Caching resolver
A resolver that stores responses and reuses them for later queries. It may perform full iterative resolution or forward queries to another resolver.
Canonical name
The selected true or target name for an alias. A CNAME record points an alias owner name to a canonical target name, though the target can itself lead through another alias.
Catalog zone
A special DNS zone that distributes a catalog of member zones and associated properties to participating authoritative servers. It can automate secondary-zone provisioning across a fleet.
Child zone
A zone whose apex is below another zone in the namespace and is reached through a delegation from its parent. The child controls authoritative data at and below its apex except for delegated descendants.
Class
A DNS protocol field that identifies a namespace class. IN, for Internet, is overwhelmingly the common class; others such as CH exist for specialized or historical uses.
Client FQDN option
A DHCP option by which a client communicates its desired fully qualified domain name and dynamic-update preferences. The server can use it to coordinate forward and reverse DNS registration.
Closest encloser
For a queried name that does not exist, the closest encloser is the longest existing ancestor name in the zone. It is central to wildcard processing and DNSSEC proofs of nonexistence.
Cloud DNS
DNS services delivered through a cloud control plane, including authoritative hosting, recursive resolution, private zones, traffic management, and security policy. The data plane may be provider-managed and globally distributed.
CNAME chain
A sequence in which a queried alias points to another name that may itself be an alias before reaching terminal data. Long chains add latency and increase the chance of loops, broken targets, or policy differences.
CNAME flattening
A provider feature that follows a configured alias target at the authoritative platform and returns address records to the client. It is often used at the zone apex where an ordinary CNAME would conflict with required SOA and NS data.
CNAME record
A Canonical Name record makes its owner name an alias for a target name. With limited DNSSEC-related exceptions, other data should not coexist at the same owner name.
Conditional forwarder
A forwarding rule that sends queries for selected domains to specific upstream resolvers instead of using the normal recursive path. It is commonly used between organizations, Active Directory forests, clouds, and isolated environments.
Cookie
A lightweight DNS transaction token carried in an EDNS option to help a server verify that a client can receive traffic at its claimed address. DNS Cookies can reduce spoofed-query abuse and improve transaction matching.
CoreDNS
A modular DNS server commonly used for service discovery in Kubernetes and other cloud-native environments. Its behavior is defined by a chain of plugins.
CSYNC record
A Child-to-Parent Synchronization record allows a child zone to signal selected delegation-data changes, such as NS and related address records, to its parent under an agreed automation policy.
CUDN
A centrally operated user-facing recursive DNS service, often used as an organizational resolver platform. The acronym is less universal than common terms such as recursive resolver.
Dangling DNS record
A DNS record that points to a resource that no longer exists or is no longer controlled by the intended owner. If another party can claim the target service, the condition can enable subdomain takeover.
DDNS
Dynamic DNS, the controlled creation, modification, or deletion of DNS records without manually editing a zone file. DHCP servers and clients commonly use DNS UPDATE to register address and pointer records.
Delegation
The relationship created when a parent zone publishes NS records that identify the authoritative servers for a child zone. A delegation may also require glue address records in the parent.
Delegation-centric zone
A zone whose main purpose is publishing delegations rather than ordinary endpoint data, such as a large parent zone operated by a registry. Operational choices for signing, transfers, and automation may differ from host-oriented zones.
DHCID record
A DNS record that stores a digest representing a DHCP client identity and name association. It helps DHCP servers detect ownership conflicts during coordinated dynamic DNS updates.
DKIM
DomainKeys Identified Mail, an email-authentication method that adds a cryptographic signature to a message. The public verification key is published in a DNS TXT record beneath a selector-specific name.
DKIM selector
A label identifying which DKIM public key should be retrieved for a signed email. The lookup name uses selector._domainkey followed by the signing domain.
DMARC
Domain-based Message Authentication, Reporting, and Conformance, a policy framework that evaluates SPF and DKIM alignment and publishes policy and reporting addresses in DNS TXT records.
DNAME record
A Delegation Name record redirects an entire subtree of names to another subtree, unlike CNAME which aliases a single owner name. Resolvers synthesize a CNAME-like result for the queried descendant.
DNS
The Domain Name System, a distributed hierarchical database and protocol used to map names to resource records. It supports far more than address lookup, including service discovery, email routing, delegation, policy, and security data.
DNS amplification
A denial-of-service technique in which an attacker sends small spoofed queries that trigger larger DNS responses toward a victim. Open recursion, large UDP responses, DNSSEC data, and ANY behavior can increase the amplification factor.
DNS anomaly
A query or response pattern that differs from expected behavior, such as sudden NXDOMAIN growth, unusual labels, rare record types, high entropy, or traffic from an unexpected client. An anomaly is a signal, not proof of malicious activity.
DNS cache snooping
Techniques that infer whether a resolver recently looked up a name by observing its cache behavior or TTL. Restricting recursion and minimizing information leakage can reduce exposure.
DNS class
The CLASS field associated with queries and resource records. IN is the normal Internet class, while other values are used for historical, diagnostic, or specialized purposes.
DNS Cookies
An EDNS option that carries client and server cookies to improve transaction assurance and reduce off-path spoofing and reflection abuse without establishing a full session.
DNS firewall
A policy enforcement layer that blocks, redirects, or otherwise controls DNS resolution based on domain intelligence, client identity, category, or behavior. RPZ is a common standards-based policy distribution mechanism.
DNS flag day
A coordinated industry event after which participating DNS software stops accommodating a legacy or non-compliant behavior. The goal is to accelerate protocol hygiene by changing defaults at the same time.
DNS forwarding proxy
A DNS intermediary that accepts client queries and sends them to another resolver, sometimes adding policy, caching, encryption, or protocol translation. Its exact recursion and validation behavior should be documented.
DNS hijacking
Unauthorized alteration or interception of DNS behavior so users receive attacker-selected or policy-selected results. It can occur at registrars, authoritative servers, resolvers, endpoints, routers, or network interception points.
DNS message
The protocol unit containing a DNS header and question, answer, authority, and additional sections. Queries and responses use the same overall format with flags indicating purpose and status.
DNS name compression
A wire-format technique that replaces repeated domain-name suffixes with pointers to earlier positions in a DNS message. Incorrect compression processing has historically caused implementation vulnerabilities.
DNS policy
Rules that influence how queries are answered or processed based on name, type, client, time, geography, health, or security intelligence. Examples include response policy zones, views, traffic steering, and filtering.
DNS rebinding
An attack in which a domain's answers change so browser-originated traffic is redirected from an attacker-controlled host to an internal or local address. Resolver protections can block suspicious private or loopback answers for external names.
DNS response rate limiting (RRL)
An authoritative-server defense that limits repeated similar responses, especially to spoofable UDP queries, to reduce participation in reflection attacks. Implementations usually allow some responses and may trigger truncation.
DNS search list
An ordered set of suffixes a host may append to a relative name during local resolution. DHCP options 119 and 24 can distribute search lists for IPv4 and IPv6 respectively.
DNS Service Discovery (DNS-SD)
A naming convention and query method for discovering service instances and their parameters using PTR, SRV, and TXT records. It is often paired with multicast DNS on local networks.
DNS shadowing
The malicious creation of many subdomains beneath a legitimately registered domain, often after account compromise, to host phishing, malware, or command-and-control infrastructure. The parent domain can initially appear reputable.
DNS sinkhole
A controlled DNS response that directs prohibited or suspicious names to an analysis, notification, or non-routable destination. Sinkholes can disrupt malware while generating telemetry about affected clients.
DNS spoofing
The delivery of a forged DNS response intended to be accepted as legitimate. It can target a stub, recursive resolver, application, or network path.
DNS tunneling
The encoding of data or command traffic inside DNS labels, record data, or query patterns to bypass normal channels. Detection often examines label length, entropy, query volume, record types, and destination reputation.
DNS UPDATE
The standardized DNS operation that adds, deletes, or changes records in a zone. Updates can use prerequisites and are normally authenticated with TSIG, SIG(0), GSS-TSIG, or platform access controls.
DNS view
A server-side configuration that provides different DNS data or behavior to different clients, often based on source network, interface, or identity. Views are commonly used for split DNS and overlapping namespaces.
DNS water torture
A random-subdomain denial-of-service attack that sends many queries for unique nonexistent names, forcing recursive and authoritative servers to do repeated work while bypassing positive cache reuse.
DNS zone
A coherently managed portion of the DNS namespace served as authoritative data. A zone begins at its apex and ends at delegated child-zone cuts.
DNS64
A resolver function that synthesizes AAAA records from IPv4 A records using a configured IPv6 prefix, allowing IPv6-only clients to reach IPv4 services through NAT64.
dnstap
A structured binary event stream for recording DNS message and resolver processing data. It provides richer and often more efficient telemetry than plain-text query logs.
Domain
A node in the DNS namespace together with all names below it. A domain is not necessarily the same as a zone because delegations can divide a domain into separately administered zones.
Domain generation algorithm (DGA)
An algorithm used to produce many candidate domain names, often so malware can locate command-and-control infrastructure despite takedowns. DGA domains may show unusual entropy, length, timing, and NXDOMAIN patterns.
Domain name
An ordered sequence of DNS labels representing a node in the namespace. In presentation format, labels are separated by dots.
Domain shadowing
Abuse in which an attacker compromises control of a legitimate domain and creates unauthorized subdomains for malicious activity. It can evade reputation systems that score only the parent domain.
Domain suffix search
The client behavior of appending configured suffixes to a relative name and trying one or more resulting FQDNs. Search behavior varies by operating system and can create information leakage or unexpected lookups.
DSO
DNS Stateful Operations, a framework for maintaining stateful sessions and exchanging asynchronous DNS-related messages over a persistent transport. It supports capabilities such as DNS Push Notifications.
DSYNC record
A DNS record used to publish the location of a service that synchronizes delegation-related data between child and parent. It supports automated delegation maintenance workflows.
Dynamic update
An update made through a protocol or automated process rather than by editing static zone data. In most DNS contexts it refers to RFC 2136 DNS UPDATE.
E.164
The international public telecommunication numbering plan used for telephone numbers. ENUM can represent an E.164 number as labels beneath e164.arpa for DNS-based service discovery.
ECS
EDNS Client Subnet, an EDNS option that lets a resolver include part of a client's network prefix in an upstream query so an authoritative service can tailor the answer geographically. It can improve content localization but reduces privacy and cache efficiency.
EDE
Extended DNS Error, an EDNS option that adds a more specific reason to a DNS response, such as blocked, stale answer, DNSSEC bogus, or network error. The normal RCODE remains present.
EDNS
Extension Mechanisms for DNS, a framework that expands DNS message capabilities without changing the original fixed header. An OPT pseudo-record carries a larger UDP size, the extended RCODE, version, flags, and options.
EDNS buffer size
The UDP payload size a requester advertises in the OPT record. Oversized values can cause fragmentation or path failures, while undersized values cause more truncation and TCP or QUIC fallback.
EDNS Client Subnet
The full name of ECS, an option that shares a truncated client network prefix with upstream authoritative systems. Operators should understand its privacy, caching, and traffic-steering effects.
EDNS Cookie option
The EDNS option used to transport DNS Cookies between client and server. It helps verify return reachability and harden UDP exchanges against spoofing.
EDNS Keepalive
An EDNS option used with DNS over TCP to signal a desired idle timeout for a persistent connection. It can reduce repeated connection setup while allowing servers to control resource use.
EDNS option
A typed extension carried inside the OPT pseudo-record. Registered options include NSID, Cookies, Client Subnet, Padding, Extended DNS Error, TCP Keepalive, Chain, and multiple experimental or specialized functions.
EDNS Padding
An EDNS option that adds padding bytes to DNS messages so packet sizes reveal less information about the queried name or response. It is especially useful with encrypted DNS transports.
EDNS version
A field in the OPT record that identifies the EDNS version. EDNS version 0 is the deployed standard; unsupported versions normally produce BADVERS.
ENUM
A system for mapping E.164 telephone numbers into DNS names and retrieving service information through NAPTR records. Digits are reversed and represented beneath e164.arpa.
EXPIRE
The SOA field that tells a secondary how long it may continue serving a zone without successfully refreshing from an upstream source. After the interval, the zone becomes expired and should no longer be served authoritatively.
External DNS
Authoritative DNS intended to answer public or partner-facing queries, typically with recursion disabled and tightly controlled zone transfer and update access. It is often separated from internal DNS by servers, views, networks, or accounts.
Fast flux
Rapidly changing DNS address records that map a malicious domain to many compromised hosts, often with low TTLs and distributed name servers. It increases resilience for phishing, malware, or proxy infrastructure.
FCrDNS
Forward-confirmed reverse DNS, a check in which an address resolves to a PTR name and that name resolves back to the original address. It can be a useful signal but is not proof of identity or authorization.
Fingerprint
A pattern of observable behavior used to infer device type, software, or activity. DHCP option order, DNS query patterns, EDNS support, and TTL behavior can contribute to a fingerprint.
Flattening
The process of resolving an alias target within an authoritative platform and returning terminal records to the requester. It is often applied to apex aliases and can obscure target TTL or failure behavior.
Forward first
A resolver policy that tries configured forwarders first and performs its own iterative resolution if forwarding fails. The fallback can bypass central policy or security controls if not intentionally designed.
Forward lookup
Resolution from a name to data, most commonly A or AAAA addresses. Forward zones are contrasted with reverse zones that map addresses back to names.
Forward only
A resolver policy that uses only configured forwarders for selected or all queries and does not fall back to independent recursion. Failure of all forwarders results in query failure.
Forward zone
A configuration that forwards queries for a selected namespace to designated upstream resolvers. It is a resolver configuration object and is not necessarily an authoritative DNS zone.
Forward-confirmed reverse DNS
The expanded form of FCrDNS. It validates that a PTR result has a forward address mapping back to the original address.
Forwarder
A resolver that sends a query to another resolver instead of performing the complete iterative resolution itself. Forwarders can centralize policy, cache, logging, Internet access, or encrypted transport.
Forwarding resolver
A resolver that relies primarily or entirely on one or more upstream resolvers rather than directly walking the DNS hierarchy. It may still cache responses and enforce local policy.
FQDN
Fully Qualified Domain Name, a name that identifies its complete position in the DNS hierarchy. In strict presentation form it includes the trailing root dot, though common usage often omits the visible dot.
Fragmentation
Splitting an IP packet into smaller fragments because it exceeds a path or link MTU. Fragmented DNS UDP responses are more likely to be lost, filtered, or abused, so modern DNS operations aim to avoid them.
Freeze
A product operation that temporarily stops dynamic modifications to a zone so its backing file or data can be edited safely. In BIND, thaw resumes normal dynamic update processing.
Full resolver
A resolver capable of performing iterative queries from the DNS root toward the authoritative servers needed to answer a question. It contrasts with a stub resolver that depends on another resolver.
GeoDNS
DNS response selection based on the estimated location or network of the requester. The decision may use resolver address, ECS data, latency, policy regions, or anycast ingress.
Glue
Address records published in a parent zone to provide the addresses of delegated child name servers when those server names cannot otherwise be resolved without circular dependency. Glue is not authoritative child-zone data.
Glue record
An A or AAAA record placed in a parent zone to support a delegation. Resolvers treat glue differently from authoritative answer data and apply bailiwick rules before caching it.
GSLB
Global Server Load Balancing, the use of DNS and health, geography, topology, or load information to direct clients to an appropriate application endpoint. Some vendors call it global traffic management.
GSS-TSIG
A method that uses Generic Security Service mechanisms, commonly Kerberos, to authenticate DNS dynamic updates with TSIG-style transaction protection. It underpins secure dynamic update in many Active Directory environments.
Health check
An active or passive test used to decide whether an endpoint should receive traffic. GSLB systems may monitor TCP, HTTP, DNS, application content, or external telemetry before publishing an answer.
Hidden primary
A primary authoritative server that is not listed in the zone's public NS RRset and is normally reachable only by secondaries or management systems. It centralizes updates while reducing public exposure.
HINFO record
A Host Information record that can describe CPU and operating system text for a host. It is rarely used on the public Internet because the information can become stale or reveal unnecessary detail.
Hostname
A name used to identify a host, often a single label or an FQDN. Hostname syntax rules are more restrictive than the full range of labels permitted by the DNS protocol.
HTTPS record
The HTTPS service binding record, a specialized SVCB form for HTTPS endpoints. It can advertise alternative endpoints, protocols, ports, encrypted-client-hello parameters, and address hints.
IDN
Internationalized Domain Name, a domain name that represents Unicode characters using an ASCII-compatible encoding in DNS. User interfaces may display native characters while the wire form uses A-labels beginning with xn--.
IDNA
Internationalized Domain Names in Applications, the standards framework that maps, validates, and converts Unicode labels for use with the ASCII DNS protocol. Application behavior and registry policy both affect which names are valid.
Implied apex NS
An informal description of the authoritative NS RRset located at a zone apex. The parent delegation NS and child apex NS should be operationally consistent, though they are separate RRsets.
IN class
The Internet DNS class, numeric value 1, used by nearly all ordinary DNS resource records and queries. Other classes exist but are rarely used for production Internet naming.
In-addr.arpa
The DNS reverse-mapping domain for IPv4. Address octets are reversed as labels below in-addr.arpa, with zone boundaries aligned to delegated portions of address space.
In-bailiwick
A name that falls within the relevant zone or delegation boundary. A child name server whose name is inside the child zone normally requires glue in the parent.
Internal DNS
DNS infrastructure or data intended for an organization's internal clients and private namespaces. Internal DNS commonly supports recursion, private zones, Active Directory, service discovery, and split responses.
Ip6.arpa
The DNS reverse-mapping domain for IPv6. Each hexadecimal nibble of the 128-bit address is reversed as a label beneath ip6.arpa.
Iterative query
A query for which the server returns the best answer or referral it currently has without taking responsibility for completing resolution on the client's behalf. Recursive resolvers send iterative queries to authoritative infrastructure.
Iterative resolution
The process of following referrals from the root, TLD, and lower authoritative servers until an answer or authoritative negative response is obtained. Results are cached according to TTL.
IXFR
An incremental zone transfer that sends changes between SOA serial versions when both servers have suitable history. It can be much smaller than AXFR, with fallback to full transfer when needed.
Journal
A change log used by a DNS server to support dynamic update recovery and incremental zone transfers. Journal file formats and retention are implementation-specific.
Knot DNS
An open-source authoritative DNS server developed by CZ.NIC, designed for high-performance authoritative service and DNSSEC operation. It is distinct from Knot Resolver.
Knot Resolver
An open-source caching and validating recursive resolver developed by CZ.NIC. It supports modular policy and modern DNS transports.
Label
A component of a domain name separated by dots in presentation form. On the wire, a standard label is length-prefixed and generally limited to 63 octets.
Lame delegation
A delegation that points to a server that is not authoritative for the delegated zone or cannot serve it correctly. Lame delegations cause resolution delays, intermittent failures, and operational noise.
LOC record
A Location record encodes geographic coordinates, altitude, size, and precision for a domain name. It is not widely deployed and should not be relied on as a current asset-location system.
Local data
DNS records or policy answers configured directly in a resolver rather than learned from public authoritative resolution. Examples include local zones, hosts entries, block responses, and internal overrides.
Local zone
A resolver-controlled zone that provides authoritative-like local answers, negative responses, redirects, or policy for a selected namespace. It does not necessarily exist in the global DNS hierarchy.
Local-host zone
A locally served namespace used for host-specific or network-specific answers, often to override external data or provide private names. The term and exact semantics vary by resolver implementation.
Managed DNS
A DNS service operated by a provider or centralized platform on behalf of the zone owner. Management, signing, distribution, scaling, and availability are delivered through a service control plane.
Master file
The standardized text representation of DNS zone data, also called zone-file format. Modern terminology favors primary and secondary for server roles rather than master and slave.
Maximum DNS message size
DNS over UDP was originally limited to 512 bytes, while EDNS allows larger advertised payloads. DNS over TCP and other stream transports can carry messages up to 65,535 bytes, subject to protocol framing and implementation limits.
Microsoft DNS
The DNS Server role and related client components in Windows Server and Active Directory environments. It supports AD-integrated zones, secure dynamic update, conditional forwarding, policies, DNSSEC, and standard DNS protocols.
MNAME
The first domain-name field in the SOA record, conventionally naming the zone's primary source server. Modern distributed and hidden-primary architectures can make the literal operational role more nuanced.
Multi-primary
An architecture in which more than one authoritative source can accept changes for the same zone and a separate replication system reconciles them. Active Directory-integrated DNS is a common example.
MX record
A Mail Exchange record identifies mail servers for a domain and assigns each a preference value. Lower preference values are tried first, with equal values treated as alternatives.
Name error
The original DNS RCODE description for NXDOMAIN, indicating that the queried domain name does not exist according to an authoritative response. It is distinct from an existing name that lacks the requested record type.
Name server
A DNS server that answers queries from authoritative data, recursive processing, cache, forwarding, or local policy. The term alone does not specify the server's role.
Name server identifier (NSID)
An EDNS option by which a requester asks the server to return an implementation-defined identifier for the responding instance. It is useful when many servers share an anycast or load-balanced address.
Named
The traditional daemon process name for BIND DNS server. Administrators use configuration files and tools such as rndc to control it.
Naming authority
The organization or system with administrative control over a namespace or zone. Authority is established operationally through delegation and control of authoritative data.
NAPTR record
A Naming Authority Pointer record applies ordered rewriting rules to discover services or transform identifiers. It is used in ENUM, SIP, and other naming systems, often together with SRV records.
Negative answer
An authoritative response indicating that a name does not exist or that the name exists but lacks the requested type. Resolvers can cache negative answers using the SOA information and applicable rules.
Negative caching
Caching of authoritative negative answers so repeated nonexistent-name or missing-type queries do not repeatedly reach authoritative servers. The negative TTL is derived from the SOA according to current rules.
Next closer name
In wildcard and DNSSEC processing, the name one label longer than the closest encloser and on the path toward the original query name. It is used to prove that no closer matching name exists.
Nibble boundary
A boundary aligned on a four-bit hexadecimal digit. IPv6 reverse DNS is simplest when prefixes are delegated on nibble boundaries because each label in ip6.arpa represents one hexadecimal digit.
No-refresh interval
The first phase of Microsoft DNS aging during which repeated refreshes do not update a record's timestamp. It reduces replication traffic while still allowing actual record changes.
NODATA
An informal but widely used term for an authoritative response where the queried name exists but no record of the requested type exists. The response normally has NOERROR rather than NXDOMAIN.
Node
A position in the DNS namespace that can own one or more resource record sets. A node can exist even without A or AAAA records.
Non-authoritative answer
A response based on cache, recursion, forwarding, or local processing rather than the responder's authority for the queried zone. The AA bit is not set.
Non-recursive query
A query with the RD bit clear. The server returns data it already has from authority or cache, or a referral, without being asked to perform recursion.
NOTIFY
A DNS message that informs secondary servers that a zone may have changed so they can check the SOA serial and refresh promptly instead of waiting for the normal refresh timer.
NS record
A Name Server record identifies an authoritative server for a zone or delegated child. Apex authoritative NS records and parent-side delegation NS records are separate RRsets.
NS set
The group of NS records associated with a zone apex or delegation. Redundant servers should be independently reachable and consistently configured.
NSID
The abbreviation for Name Server Identifier, an EDNS option used to identify the responding server instance behind a shared service address.
NSLOOKUP
A long-standing command-line DNS query tool available on many operating systems. It is useful for basic testing, though dig, Resolve-DnsName, or drill often expose more protocol detail.
NSSET
A registry or provisioning object representing the authoritative name servers and sometimes their addresses for a domain. The exact object model depends on the registry protocol or platform.
Null MX
An MX RRset consisting of a single record with preference 0 and target dot, explicitly stating that the domain accepts no email. It is clearer than relying on failed implicit delivery.
NXDOMAIN
The DNS RCODE indicating that the queried domain name does not exist. It applies to the name, not merely the requested record type, and can be cached as a negative answer.
NXDOMAIN hijacking
Replacement of a legitimate NXDOMAIN response with a redirect, search page, advertisement, or other synthesized answer. It can break DNSSEC, application assumptions, and diagnostic accuracy.
NXDOMAIN redirection
A policy or service behavior that substitutes another answer when a name should return NXDOMAIN. It may be used for captive portals or policy, but it changes standard DNS semantics.
NXDOMAIN spike
A sudden rise in nonexistent-name responses. Causes can include typos, missing suffixes, search-list behavior, stale applications, DGAs, random-subdomain attacks, or failed service discovery.
Open resolver
A recursive resolver that accepts queries from arbitrary Internet clients. Open resolvers are vulnerable to abuse for reflection attacks, policy bypass, and unauthorized resource consumption.
OPT record
A pseudo-resource-record used to carry EDNS metadata in the additional section of a DNS message. Its class field advertises UDP payload size, while TTL bits carry extended RCODE, version, and flags.
Option 119
The Domain Search option, which distributes an ordered list of DNS search suffixes using DNS name compression encoding. It is distinct from option 15, which carries a single domain name.
Option 81
The Client FQDN option, used to communicate a client's FQDN and dynamic DNS update preferences. It supports coordinated ownership of A and PTR updates.
Orphaned record
A DNS or IPAM object whose intended owner, target, device, or application no longer exists or cannot be identified. Orphans create security risk and complicate address reclamation.
Out-of-bailiwick
A name outside the relevant zone or delegation boundary. An out-of-bailiwick child name-server name normally does not require parent glue because it can be resolved through its own delegation path.
Owner name
The domain name at which a resource record set is stored. It is the left-hand name in zone-file presentation format.
Parent zone
The zone immediately above a delegated child zone. It publishes the delegation NS RRset, optional DS records, and any required glue.
Passive DNS
A system that collects and indexes observed DNS query or response data over time without actively probing every name. It supports investigations, threat intelligence, asset discovery, and historical correlation.
Persistent connection
A TCP, TLS, QUIC, or other session reused for multiple DNS transactions rather than opened for each query. Persistence improves efficiency but requires connection limits and idle-time management.
Persistent record
A record protected from automatic aging, scavenging, cleanup, or synchronization deletion. The term is product-specific and does not define a distinct DNS resource-record type.
Preference
A relative selection value whose interpretation depends on the protocol. MX and SRV use numeric preference or priority, while DHCPv6 servers can send an OPTION_PREFERENCE value to influence client selection.
Primary DNS server
The authoritative server or data source from which a zone is provisioned and updated before changes reach secondaries. "Primary" describes the provisioning relationship, not necessarily traffic preference or a single server.
Primary zone
A locally writable authoritative zone whose source data is maintained on that server or integrated data store. Other servers can obtain copies through transfer or replication.
Private hosted zone
A cloud-managed authoritative zone visible only within associated virtual networks, accounts, or resolver endpoints. Connectivity and resolver rules determine who can query it.
Private namespace
A DNS namespace intended for limited administrative or network scope rather than the public DNS. Collision risk exists if an internal suffix later becomes delegated publicly or is used by another connected organization.
Protective DNS
A recursive DNS service that uses threat intelligence and policy to block or redirect access to malicious domains while producing security telemetry. It can be delivered on premises, in cloud, or as a hybrid service.
PTR record
A Pointer record maps a reverse-domain name to another domain name, most commonly mapping an IPv4 or IPv6 address to a host name. Multiple PTRs are technically possible but can confuse applications.
Public suffix
A domain suffix under which independent parties can register names, such as com or co.uk, as identified by policy data such as the Public Suffix List. It is not always the same as a DNS zone boundary.
Punycode
The encoding algorithm used by IDNA to represent Unicode labels using ASCII characters. Encoded A-labels begin with xn--.
QCLASS
The class field in a DNS question. IN is the normal value for Internet DNS queries.
QNAME
The domain name in the question section of a DNS query. During alias processing, the original QNAME can lead to one or more other names and RRsets.
QNAME minimization
A recursive-resolver technique that sends only the minimum name needed at each delegation step instead of exposing the full original query name to every upstream server. It improves privacy and can reduce unnecessary data disclosure.
QPS
Queries per second, a common measurement of DNS request rate. Capacity planning should consider peaks, response sizes, cache behavior, query types, and failure scenarios rather than QPS alone.
QR bit
The Query/Response bit in the DNS header. A value of 0 indicates a query and 1 indicates a response.
QTYPE
The numeric type requested in a DNS question, such as A, AAAA, MX, or a meta-type such as ANY. QTYPE values share the IANA RR TYPE registry.
Query
A DNS message sent to request information or perform an operation. Most queries contain one question, though the protocol format can represent more.
Query logging
Recording DNS query metadata such as time, client, name, type, response code, latency, and selected policy. Logging improves troubleshooting and security visibility but requires privacy, retention, and volume controls.
Query name
A plain-language synonym for QNAME, the domain name being asked about in a DNS question.
Question section
The DNS message section containing QNAME, QTYPE, and QCLASS. Normal queries usually contain one question.
Random subdomain attack
A denial-of-service technique that generates many unique labels beneath a target domain, defeating positive caching and forcing repeated authoritative work. It is also called DNS water torture.
RCODE
The DNS response code indicating the outcome of a query or operation, such as NOERROR, FORMERR, SERVFAIL, NXDOMAIN, NOTIMP, or REFUSED. EDNS extends the original four-bit field.
RD bit
The Recursion Desired bit in a query asks the server to perform recursive resolution if it supports and permits it. The server's RA bit indicates whether recursion is available.
RDATA
The type-specific data portion of a resource record, such as an IPv4 address in an A record or the fields of an SOA record.
RDLENGTH
The resource-record field giving the length in octets of RDATA in the wire-format message.
RDNSS
Recursive DNS Server option in IPv6 Router Advertisements. It allows routers to advertise recursive resolver addresses without DHCPv6.
Recursive answer
An answer produced after a server performs or forwards resolution on behalf of a client. It is normally non-authoritative from the responding resolver's perspective.
Recursive query
A query requesting that the server obtain a final answer or error on the client's behalf rather than returning only a referral. Recursion is requested with the RD bit and controlled by server policy.
Recursive resolver
A server that accepts recursive queries, follows referrals or uses forwarders, caches results, and returns final answers to clients. It may also validate DNSSEC and apply policy.
Referral
A response that directs a resolver to authoritative name servers closer to the requested name, normally through NS records in the authority section and optional glue in the additional section.
Refresh interval
In an SOA, the interval after which a secondary checks the primary source for a new serial. In Microsoft DNS aging, the refresh interval is the period during which eligible refreshes update a record timestamp.
Registered domain
A domain registered through a registrar beneath a registry-controlled suffix. Application security often uses the concept of an organizational or registrable domain, which may require public-suffix policy data.
Registry lock
A registry-level protection that prevents selected domain changes until an out-of-band unlock process is completed. It reduces the risk of unauthorized transfer or delegation change.
Relative domain name
A domain name interpreted relative to an origin or search suffix rather than the root. In a zone file, names without a trailing dot are usually relative to the current $ORIGIN.
RESINFO record
The Resolver Information record lets a resolver publish information about its capabilities or configuration through key-value data. Clients can discover it using the resolver.arpa framework.
Resolver
Software or a service that receives DNS questions and obtains answers from local data, cache, forwarding, or iterative queries. A resolver may be a stub, caching recursive resolver, forwarding resolver, or validating resolver.
Resolver operator
The organization or team responsible for a recursive resolver service, including policy, privacy, logging, security, capacity, and upstream connectivity.
Resource record (RR)
The basic typed data element in DNS, containing an owner name, type, class, TTL, and RDATA. Records with the same owner, type, and class form an RRset.
Resource record set (RRset)
All resource records with the same owner name, class, and type. DNSSEC signs an RRset as a unit, and authoritative servers should return the complete set subject to protocol rules.
Response
A DNS message sent in reply to a query, containing a status code and possibly answer, authority, or additional data. A response can be authoritative, recursive, referred, truncated, or policy-generated.
Response policy zone (RPZ)
A DNS zone format and resolver policy mechanism used to distribute rules for blocking, redirecting, or otherwise modifying answers based on queried names, answer addresses, name servers, or client context.
Response rate limiting
A server technique that limits repeated similar responses to reduce reflection and amplification abuse. It is commonly abbreviated RRL.
Reverse delegation
Delegation of authority for part of in-addr.arpa or ip6.arpa to the organization responsible for an address block. IPv4 prefixes not aligned on octet boundaries may require RFC 2317 techniques.
Reverse DNS
The use of PTR records in in-addr.arpa or ip6.arpa to map an IP address to a domain name. Reverse data is independently managed from forward A and AAAA records.
Reverse lookup
A query that converts an IP address into its reverse-domain name and requests a PTR record. The result is descriptive and does not by itself prove ownership or trust.
Reverse zone
An authoritative zone beneath in-addr.arpa or ip6.arpa containing PTR records and delegations for address space.
rndc
The remote name daemon control utility used to manage BIND named, including reload, retransfer, freeze, thaw, flush, and status operations. It uses an authenticated control channel.
Root hints
A bootstrap list of root name server names and addresses used by a full resolver to begin iterative resolution. Resolvers update their working root-server information from DNS responses.
Root label
The zero-length label at the top of the DNS hierarchy. It is shown as the trailing dot in an absolute domain name and as a single dot when written alone.
Root name server
An authoritative server for the DNS root zone. The named root-server identities are served by many anycast instances distributed worldwide.
Root priming
The process by which a recursive resolver queries a root server using hints to obtain the current root NS RRset and associated addresses.
Root zone
The zone at the top of the DNS hierarchy, represented by a single dot. It delegates top-level domains and contains DNSSEC trust-chain data for signed delegations.
RPZ
Abbreviation for Response Policy Zone. It is used by recursive resolvers to apply distributed DNS response policies.
RRL
Common abbreviation for DNS Response Rate Limiting. It reduces the volume of repeated spoofable responses while trying to preserve legitimate service.
RRset
Common abbreviation for Resource Record Set, the records sharing owner name, class, and type.
RRTYPE
The numeric resource-record type code identifying the format and meaning of RDATA, such as A=1, AAAA=28, or HTTPS=65. IANA maintains the registry.
Scavenging
Automatic removal of DNS records considered stale according to timestamp and aging settings. In Microsoft DNS, both zone aging and server scavenging schedules must be configured correctly.
Search suffix
A domain suffix appended by a client to relative names during resolution. Multiple suffixes form a search list whose order and qualification rules can create unexpected queries.
Secondary DNS server
An authoritative server that obtains zone data from another authoritative source, traditionally through AXFR or IXFR. It can answer clients independently and is not inherently less authoritative than the primary.
Secondary zone
A read-only authoritative copy of a zone obtained from a primary or another secondary. It refreshes based on SOA timing, NOTIFY, and transfer behavior.
Secure dynamic update
A DNS UPDATE process authenticated and authorized so only approved clients or services can change records. Common mechanisms include TSIG, GSS-TSIG, SIG(0), and platform identity controls.
Serial number
The SOA field used by secondary servers to determine whether zone data has changed. Serial arithmetic wraps modulo 2^32 and should follow RFC 1982.
SERVFAIL
RCODE 2, indicating that the server failed to complete the operation. Causes include upstream timeout, DNSSEC validation failure, lame delegation, expired secondary zone, policy, or internal error.
Service binding
A framework using SVCB and HTTPS records to describe alternative endpoints and connection parameters for a service. It can advertise protocols, ports, address hints, and security-related parameters.
Service discovery
The process of locating service endpoints and parameters through DNS records or related naming conventions. SRV, NAPTR, SVCB, HTTPS, and service-specific records can participate.
Service mode
The SVCB or HTTPS record form that directly describes connection parameters for a service endpoint. It uses a nonzero priority and can contain service parameters.
Slave server
An older term for a secondary authoritative DNS server. Current standards terminology prefers secondary because it is more precise and neutral.
SOA minimum
The final field of the SOA record. Historically it had multiple interpretations; current negative-caching rules use it with the SOA TTL to determine the negative TTL.
SOA record
The Start of Authority record identifies key zone parameters including MNAME, RNAME, serial, refresh, retry, expire, and minimum fields. Every authoritative zone has an SOA at its apex.
Source port randomization
Use of unpredictable UDP source ports in recursive DNS queries to increase the entropy an off-path attacker must guess when forging a response.
Special-use domain
A domain name reserved by an RFC for special behavior, such as localhost, invalid, test, or onion. Applications and resolvers may treat such names differently from ordinary public DNS names.
SPF
Sender Policy Framework, an email-authentication mechanism that publishes which systems are authorized to send mail for a domain, normally in a DNS TXT record. The dedicated SPF RR type is obsolete for deployment.
Split DNS
A design in which the same name or namespace produces different data depending on the requesting client or network context. It can be implemented with views, separate authoritative systems, private zones, or resolver policy.
Split horizon
A common synonym for split DNS. The same namespace is presented differently to different audiences.
SRV record
A Service record identifies the target host and port for a named service, with priority and weight values for selection. The owner name normally begins with _service._protocol.
Stale answer
An expired cached response served by a resolver when authoritative refresh is temporarily impossible and policy permits serving stale data. It can improve resilience during outages while carrying an EDE explanation.
Stale record
A record that no longer reflects the current device, address, owner, or service. Stale data can cause misrouting, security exposure, and incorrect capacity reports.
Static record
A DNS record created without an aging timestamp or otherwise protected from automatic scavenging. "Static" describes management behavior, not a distinct DNS record type.
Stealth server
An authoritative server not listed in the public NS RRset, often used as a hidden primary or internal transfer source. The term is informal.
Stub resolver
A simple resolver on an endpoint that sends queries to a recursive resolver and does little or no iterative resolution itself. Operating-system libraries commonly provide stub functionality.
Stub zone
A zone configuration containing only enough authoritative data, usually SOA, NS, and glue, to locate the zone's current authoritative servers. It tracks delegation data without storing the full zone.
Subdelegation
A delegation from one zone to a child zone below it. Each subdelegation creates a new zone cut and administrative boundary.
Subdomain
A domain contained beneath another domain in the DNS hierarchy. A subdomain is not necessarily a separate zone unless a delegation creates a zone cut.
Subdomain takeover
An attack in which a DNS record points to a deprovisioned third-party resource that an attacker can claim. Removing dangling records and validating external targets reduces risk.
Suffix
A sequence of ending labels in a domain name. DNS hierarchy, search lists, public-suffix policy, and QNAME minimization all use suffix concepts in different ways.
SVCB record
A Service Binding record that describes alternative service endpoints and connection parameters. It supports alias mode and service mode and is the base format specialized by the HTTPS record.
SvcParam
A key-value parameter carried in SVCB or HTTPS RDATA, such as alpn, port, ipv4hint, ipv6hint, ech, or mandatory. IANA maintains the parameter-key registry.
TC bit
The Truncated bit in a DNS response indicates that the message was shortened because it exceeded the available transport size. A client normally retries using TCP or another suitable transport.
TCP fallback
Retrying a DNS query over TCP after a truncated UDP response or other transport need. Modern DNS implementations must support TCP and should reuse connections efficiently.
Thaw
A BIND operation that resumes dynamic update after a zone has been frozen and reloads changes made to its master file.
Time to live (TTL)
The number of seconds a DNS record may be cached before it must be treated as expired. TTL choices affect change speed, query load, resilience, and negative or stale-answer behavior.
TLD
Top-Level Domain, a direct child of the DNS root, such as com, org, net, or a country-code TLD. TLD zones are delegated from the root.
Transaction ID
A 16-bit identifier used to match a DNS response to its query. UDP security also relies on source port, addresses, question content, cookies, and other transaction checks.
Transaction signature (TSIG)
A shared-secret mechanism that authenticates DNS messages and protects integrity and replay context. It is commonly used for zone transfers, NOTIFY, and dynamic updates between trusted systems.
Transfer source
The authoritative server from which a secondary requests AXFR or IXFR. The transfer source may be a hidden primary, another secondary, or a distribution layer.
Truncation
The condition indicated by the TC bit when a response does not fit the allowed message size. Truncation should prompt retry over a transport that can carry the full response.
TSIG
The common abbreviation for Transaction Signature, a shared-secret authentication mechanism for DNS messages. Current TSIG specification is RFC 8945.
TTL
Abbreviation for Time to Live, the cache lifetime carried in each resource record. Records in one RRset should have a consistent TTL.
TXT record
A Text record contains one or more character strings, each limited to 255 octets in wire format. TXT is used by many applications for verification, email policy, security, and metadata, with application-specific syntax.
U-label
A Unicode form of an internationalized DNS label intended for user display and processing under IDNA rules. Its corresponding DNS-compatible A-label uses Punycode.
Update prerequisite
A condition in a DNS UPDATE message that must be true before changes are applied, such as a name or RRset existing or not existing. Prerequisites support atomic conflict-aware updates.
View
A server configuration that selects a set of zones, recursion behavior, or policy according to the client or request context. The same queried name can therefore receive different answers.
Water torture
A common shortened name for DNS water torture, the random-subdomain attack that forces repeated cache misses and authoritative queries.
Weight
The relative selection value among SRV records with the same priority. Higher weights should receive a proportionally larger share of selections, subject to client implementation.
Wildcard
A DNS owner name whose leftmost label is an asterisk and that can synthesize answers for certain nonexistent names below it. Wildcards do not match every descendant blindly and are constrained by existing names and closest-encloser rules.
Wildcard certificate
A TLS certificate containing a wildcard DNS name such as *.example.com. It normally matches one label at that position and does not replace DNS wildcard behavior.
Wildcard expansion
The DNS server process that synthesizes an answer from a wildcard RRset when the query name does not exist and wildcard matching rules are satisfied. The synthesized owner name is the original QNAME.
Wire format
The binary on-network representation of protocol messages, including field sizes, byte order, labels, options, and compression rules. Presentation formats such as zone files are not identical to wire format.
XFR
A collective shorthand for DNS zone transfers, including AXFR and IXFR.
Zone
A portion of the DNS namespace managed as a unit and served authoritatively. It contains data from its apex down to, but not including, delegated child zones.
Zone apex
The top node of a zone, where its SOA and authoritative NS RRsets are stored. The apex cannot normally be a CNAME because required zone data must coexist there.
Zone cut
The boundary between a parent zone and a delegated child zone. It is marked by a parent-side delegation NS RRset and child-side authoritative zone apex.
Zone digest
A cryptographic digest over canonical zone data used to verify that a transferred or published zone is complete and unmodified. The ZONEMD record carries the digest at the zone apex.
Zone enumeration
Discovery of many or all names in a zone through transfers, NSEC walking, certificate data, search engines, logs, or other sources. DNSSEC with NSEC can make systematic walking easier.
Zone file
A text file in DNS master-file format containing directives and resource records for a zone. Authoritative data can also be stored in databases or generated dynamically.
Zone transfer
Replication of authoritative zone data using AXFR for a full copy or IXFR for changes. Transfers use TCP and should be authenticated and access-controlled.
Zone walking
Systematic enumeration of names in a DNSSEC-signed zone by following NSEC records or analyzing NSEC3 under favorable conditions. NSEC3 increases cost but does not guarantee confidentiality.
ZONEMD record
A Message Digest Over Zone Data record that provides a digest of the zone contents. It can detect corruption or incomplete distribution but does not replace DNSSEC authentication of individual answers.