DNS Cheat Sheet

Table 1: Core DNS Record Types

Every DNS resource record follows the format name TTL class type rdata. The seven record types below handle the overwhelming majority of real-world queries — master these before exploring the specialized types in Table 2.

Table 2: Advanced and Specialized Record Types

Beyond the core types, DNS supports dozens of specialized records for service binding, security, identity, and zone management. The rows below cover the most practically useful, ordered from most widely deployed to most niche.

Table 3: DNSSEC Records

DNSSEC uses a chain of cryptographic trust from the root zone through TLDs to authoritative nameservers. These specialized record types implement that chain — understand the KSK/ZSK split before working with any of them in production.

Table 4: DNS Zone Types and Management

A DNS zone is the administrative unit that an authoritative server manages. Knowing zone types and their relationships determines how you architect redundancy, split-horizon views, and delegations.

Table 5: DNS Resolution Methods

DNS resolution is not a single operation — it is a coordinated sequence of queries between clients, recursive resolvers, and authoritative servers. Understanding this flow is essential for diagnosing latency, misconfiguration, and policy-based filtering.

Table 6: DNS Caching and TTL

Caching is what makes DNS scalable — without it, every query would burden root and authoritative servers. TTL values, negative caching, and modern resilience techniques like serve-stale directly affect how quickly DNS changes propagate and how gracefully infrastructure survives outages.

Table 7: DNS Query Flags and Response Codes

DNS message headers carry a compact set of flags and a 4-bit RCODE that communicates query intent and server response status. RFC 8914 Extended DNS Errors (EDE) supplement RCODEs when a single code is insufficient to describe the failure.

Table 8: DNS Security Mechanisms

DNS security is layered: DNSSEC ensures data integrity, encrypted transports protect confidentiality, RPZ enables policy-based threat blocking, and anti-spoofing measures harden resolvers against injection attacks. These mechanisms are complementary, not mutually exclusive.

Table 9: DNS Attack Types and Threats

DNS is a high-value attack surface: every internet-connected device trusts DNS responses implicitly. Attacks range from passive eavesdropping to active cache poisoning and infrastructure flooding. Understanding each threat model is prerequisite to deploying the correct countermeasure from Table 8.

Table 10: DNS Zone Transfer Methods

Zone transfers are the mechanism by which secondary servers receive authoritative data from primaries. Securing transfers via TSIG and controlling which servers may request them is fundamental to authoritative DNS hardening.

Table 11: DNS Infrastructure Components

DNS infrastructure spans multiple tiers, from the client's stub resolver to the global root server network. Knowing each component's role clarifies where performance bottlenecks and security boundaries exist.

Table 12: DNS Troubleshooting Commands

DNS troubleshooting follows a consistent workflow: confirm resolution path, verify record content, check delegation, validate DNSSEC, and test connectivity at each layer. The tools below cover every step.

Table 13: Email Authentication DNS Records

Email authentication relies entirely on DNS as the trust medium — without correct SPF, DKIM, DMARC, and BIMI records, modern mail filtering will reject or junk your messages. These four records form an interdependent system; DMARC requires both SPF and DKIM to be meaningful.

Table 14: DNS Performance and Load Balancing

DNS is often the simplest lever for distributing load and directing users to geographically optimal endpoints. The techniques below range from basic round-robin to sophisticated latency-based global routing.

Table 15: DNS Standards and Protocol Details

DNS was designed in 1983 and has been extended continuously through RFCs. Understanding the protocol-level constraints — message size limits, transport choices, flag semantics — prevents hard-to-diagnose production issues.

Table 16: Advanced DNS Configurations

Production-grade DNS deployments go beyond simple zone hosting. Split-horizon, DNSSEC signing configurations, dynamic updates, and logging policies are the building blocks of a well-operated authoritative DNS service.

Table 17: DNS Protocol Enhancements and Modern Features

DNS protocol development is active: the 2020s brought encrypted transports from experimental to production-deployed, automated key management, zone integrity verification, and DDR for seamless upgrade paths. This table captures the most significant advances from 2019 to 2026.