DNS Glossary
Quick, plain-English definitions for the DNS terms you will run into. Terms with a full guide are linked.
- Resolver
- A server that looks up DNS records on your behalf — usually your ISP's or a public one like 8.8.8.8 or 1.1.1.1. Also called a recursive resolver.
- Authoritative Nameserver
- The server that holds the actual DNS records for a domain — the source of truth resolvers ultimately query.
- Zone
- A portion of the DNS namespace managed as a unit — typically one domain and its subdomains, defined by a zone file on the authoritative nameserver.
- TTL (Time To Live)
- How long, in seconds, a resolver may cache a record before re-querying the authoritative nameserver.
- Propagation
- The time it takes for a DNS change to reach every resolver worldwide, governed by the old TTL.
- NXDOMAIN
- An authoritative answer meaning the queried name does not exist in the zone.
- SERVFAIL
- The resolver could not complete the lookup at all — unreachable servers, broken delegation, or failed DNSSEC validation.
- Zone Apex / Root Domain
- The bare domain with no subdomain (example.com, not www.example.com). CNAME records are not allowed here.
- DNSSEC
- A set of extensions that cryptographically sign DNS records so resolvers can verify responses have not been forged.
- DoH (DNS over HTTPS)
- DNS queries encrypted and sent over HTTPS, preventing eavesdropping or tampering on the network path.
- DoT (DNS over TLS)
- DNS queries encrypted over a dedicated TLS connection — same goal as DoH, different transport.
- SPF
- A DNS TXT record listing which mail servers are authorized to send email for a domain.
- DKIM
- A cryptographic signature added to outgoing email so receivers can verify it was not altered in transit.
- DMARC
- A policy record that tells receiving mail servers what to do when SPF and DKIM both fail, plus provides reporting.
- Glue Record
- An A record for a nameserver that lives inside the domain it serves (e.g. ns1.example.com for example.com), needed to avoid a circular lookup.
- Wildcard Record
- A record using * as the hostname (*.example.com) that matches any subdomain not otherwise defined.
- SOA (Start of Authority)
- A record holding zone metadata: primary nameserver, admin contact, serial number, and cache-timing values.
- Delegation
- Pointing a subdomain or zone to a different set of nameservers via NS records, handing off authority for that part of the namespace.
- Cache Poisoning
- Injecting a forged DNS response into a resolver's cache to redirect traffic — the attack DNSSEC is designed to prevent.
- Subdomain Takeover
- Claiming a subdomain whose DNS record still points to a third-party service the original owner abandoned, letting an attacker serve content there under the trusted domain.
- Amplification Attack
- A DDoS technique that sends a small spoofed query to an open resolver so it floods the forged source address with a much larger response, multiplying the attacker's bandwidth.
- Open Resolver
- A DNS resolver that answers recursive queries from any IP address on the internet rather than just its own network, making it usable as a reflector in amplification attacks.
- Anycast
- A routing technique where the same IP address is announced from many physical locations, so a query is automatically answered by the nearest one.
- EPP Status Codes
- Standardized codes (e.g. clientTransferProhibited, serverHold) that a WHOIS record uses to show what a domain's registrar or registry currently locks or restricts.
- CGNAT (Carrier-Grade NAT)
- A setup where an ISP shares one public IP address across many customers, which can make IP-based location or identification unreliable.
- Happy Eyeballs
- An algorithm client software uses to try IPv6 and IPv4 connections in parallel and keep whichever connects first, so adding AAAA records carries little risk.
- RRL (Response Rate Limiting)
- A defense on authoritative nameservers that throttles repeated identical responses sent toward the same apparent source, blunting DNS amplification attacks.
- BCP38
- A network-filtering best practice that blocks packets leaving a network with a spoofed source address, stopping amplification attacks at their origin rather than their target.