DNS Cheat Sheet
Everything you look up twice, on one page. Print it, or keep the tab open — every value here is explained in more depth elsewhere in the Learn section.
Record types
| Type | Holds | Example value |
|---|---|---|
A | IPv4 address | 203.0.113.80 |
AAAA | IPv6 address | 2001:db8::80 |
CNAME | Alias to another name — never at the apex | example.netlify.app. |
MX | Mail server and its priority (lower first) | 10 mail.example.com. |
TXT | Text: SPF, DKIM, DMARC, verification tokens | "v=spf1 -all" |
NS | Nameservers that answer for the zone | ns1.example.com. |
SOA | Zone metadata: serial, timers, negative-caching TTL | ns1… admin… 2026101301 … |
CAA | Certificate authorities allowed to issue | 0 issue "letsencrypt.org" |
SRV | Host and port of a service | 10 5 5060 sip.example.com. |
PTR | Name for an IP address (reverse DNS) | mail.example.com. |
HTTPS | Connection hints for browsers: HTTP/3, alias | 1 . alpn=h2,h3 |
DS / DNSKEY | DNSSEC chain of trust | 2371 13 2 1F98… |
Lookup commands
dig example.com # A record (the default)
dig example.com MX +short # just the values
dig @1.1.1.1 example.com AAAA # ask a specific resolver
dig @ns1.example.com example.com # ask the authoritative server directly
dig example.com +trace # follow the delegation from the root
dig -x 203.0.113.80 # reverse lookup (PTR)
dig example.com TXT +tcp # large answers, e.g. many TXT recordsOn Windows, without dig:
nslookup -type=MX example.com
nslookup example.com 1.1.1.1
Resolve-DnsName example.com -Type TXT # PowerShell
Resolve-DnsName example.com -Server 8.8.8.8 -DnsOnlyTTL values
| Seconds | Time | Typical use |
|---|---|---|
60–300 | 1–5 min | Before a planned change, failover records |
3600 | 1 hour | A sensible default for most records |
14400 | 4 hours | Stable records that rarely change |
86400 | 1 day | NS records; the .com and .pl delegations use this |
Response codes
| Code | Meaning | First thing to check |
|---|---|---|
NOERROR | The name exists and there is an answer. | Nothing — unless the answer is wrong. |
NOERROR, empty | The name exists but has no record of that type (NODATA). | The record type — e.g. AAAA missing. |
NXDOMAIN | The name does not exist. | Spelling, expiry, the record name. |
SERVFAIL | The resolver could not get a valid answer. | DNSSEC and whether the nameservers answer. |
REFUSED | The server will not answer this query. | Whether you asked the right server. |
Email records
example.com. TXT "v=spf1 include:_spf.google.com ~all"
selector._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBg…"
_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]"
_mta-sts.example.com. TXT "v=STSv1; id=20261013"
_smtp._tls.example.com. TXT "v=TLSRPTv1; rua=mailto:[email protected]"
example.com. MX 10 mail.example.com.
example.com. MX 0 . ; null MX: no mail at allFlush the cache · public resolvers
ipconfig /flushdns # Windows
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder # macOS
sudo resolvectl flush-caches # Linux (systemd)
chrome://net-internals/#dns # Chrome, Edge| Resolver | IPv4 | IPv6 |
|---|---|---|
| Cloudflare | 1.1.1.1 · 1.0.0.1 | 2606:4700:4700::1111 |
8.8.8.8 · 8.8.4.4 | 2001:4860:4860::8888 | |
| Quad9 | 9.9.9.9 · 149.112.112.112 | 2620:fe::fe |
Frequently asked questions
How do I print the cheat sheet?
Use the Print button at the top or your browser's print command. The page prints without menus, links and buttons, and fits on two or three pages.
What is the difference between NXDOMAIN and an empty NOERROR answer?
NXDOMAIN means the name does not exist at all. An empty NOERROR answer means the name exists but has no record of the type you asked for.
Which TTL should I use?
An hour is a sensible default. Lower it to five minutes a day before a planned change, and raise it back once the change is done.
Try it on your domain
See the theory in practice — run a DNS Lookup for your own domain.
Updated October 13, 2026
Sources