DNS & email glossary

Plain-language definitions of DNS, DNSSEC, email-authentication and network terms.

DNS (Domain Name System): DNS is the internet's naming system that translates human-readable domain names like example.com into the IP addresses computers use to connect. It works as a distributed hierarchy of servers, so no single machine holds every record.
IP address: An IP address is a numeric label that uniquely identifies a device on a network and routes traffic to it, such as 93.184.216.34 (IPv4) or 2606:2800:220:1:248:1893:25c8:1946 (IPv6).
Nameserver: A nameserver is a server that stores a domain's DNS records and answers queries about them. The authoritative nameservers listed for a domain are the official source of its DNS data.
Recursive resolver: A recursive resolver is the DNS server your device queries first; it does the legwork of chasing down an answer by asking root, TLD, and authoritative servers on your behalf. It caches results to speed up repeat lookups.
TTL (Time To Live): TTL is the number of seconds a DNS record may be cached by resolvers before it must be looked up again. Lower values mean changes propagate faster but generate more queries; higher values improve caching but slow updates.
DNS propagation: DNS propagation is the time it takes for a DNS change to be seen everywhere as old cached records expire across resolvers worldwide. It is governed by each record's TTL and can take from minutes up to 48 hours.
Propagation delay: Propagation delay is the lag between making a DNS change and every resolver reflecting it, caused by cached copies of the old record living out their TTL. It is why a new record may work in one location before another.
A record: An A record maps a domain name to an IPv4 address, telling clients which server to connect to. For example, an A record points example.com to 93.184.216.34.
AAAA record: An AAAA record ("quad-A") maps a domain name to an IPv6 address, the modern equivalent of an A record for the larger IPv6 address space. It lets IPv6-capable clients reach the domain over IPv6.
CNAME record: A CNAME record makes one domain name an alias of another, so lookups follow through to the target's records. For example, www.example.com as a CNAME to example.com resolves to whatever example.com points to; a CNAME cannot coexist with other records on the same name.
MX record: An MX (mail exchange) record specifies the mail servers that receive email for a domain, each with a priority number where the lowest value is tried first. Without a valid MX record, a domain cannot receive email.
TXT record: A TXT record holds arbitrary text attached to a domain and is widely used for verification and email authentication policies such as SPF, DKIM, and DMARC. It lets domain owners publish machine-readable data in DNS.
NS record: An NS (name server) record names the authoritative nameservers responsible for a domain or zone, delegating who answers its DNS queries. Registrars and parent zones use NS records to point to a domain's DNS hosting.
SOA record: An SOA (start of authority) record holds core administrative information for a DNS zone, including the primary nameserver, the admin contact, and timers for refresh, retry, and expiry. Every zone has exactly one SOA record, and its serial number tracks changes for zone transfers.
SRV record: An SRV (service) record specifies the hostname and port for a particular service on a domain, such as SIP, XMPP, or LDAP, along with priority and weight for load balancing. It follows the format _service._protocol.domain.
CAA record: A CAA (certification authority authorization) record lists which certificate authorities are allowed to issue TLS/SSL certificates for a domain. Certificate authorities must check it and refuse issuance if they are not authorized, reducing the risk of misissued certificates.
PTR record: A PTR record maps an IP address back to a domain name, the reverse of an A or AAAA record, and lives in a special reverse DNS zone. Mail servers often check PTR records to help verify that a sending host is legitimate.
Reverse DNS: Reverse DNS (rDNS) is the lookup that resolves an IP address to a domain name using PTR records, the opposite of a normal forward lookup. It is commonly used in email delivery and logging to identify the host behind an IP.
DNSSEC: DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS records so resolvers can verify that answers are authentic and unaltered. It protects against forged responses and cache poisoning but does not encrypt the data itself.
DNSKEY record: A DNSKEY record publishes the public keys a zone uses to sign its DNS records under DNSSEC, letting resolvers validate the signatures. It typically holds a zone-signing key (ZSK) and a key-signing key (KSK).
DS record: A DS (delegation signer) record sits in the parent zone and holds a hash of a child zone's key-signing key, linking the two so DNSSEC trust can chain from the root down. It is how a domain's DNSSEC is activated at its registrar.
SPF (Sender Policy Framework): SPF is an email authentication method published as a DNS TXT record that lists which mail servers are allowed to send email for a domain. Receiving servers check it to detect forged senders and reduce spam and spoofing.
DKIM (DomainKeys Identified Mail): DKIM adds a cryptographic signature to outgoing email, using a private key held by the sender and a public key published in DNS, so recipients can verify the message was authorized by the domain and not altered in transit.
DMARC: DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS TXT policy that tells receivers what to do with email failing SPF and DKIM checks, such as none, quarantine, or reject. It also enables aggregate reports so domain owners can monitor abuse.
BIMI: BIMI (Brand Indicators for Message Identification) is a DNS TXT record that lets a domain publish a logo to display next to authenticated emails in supporting inboxes. It requires an enforced DMARC policy and often a Verified Mark Certificate.
MTA-STS: MTA-STS (SMTP MTA Strict Transport Security) lets a domain require that inbound email be delivered over encrypted, certificate-validated TLS connections. It is published via a DNS TXT record pointing to a policy served over HTTPS, defending against downgrade and interception attacks.
TLS-RPT: TLS-RPT (SMTP TLS Reporting) is a DNS TXT record that asks sending servers to send daily reports about the success or failure of TLS-encrypted email delivery to a domain. It helps operators spot MTA-STS or DANE problems that would otherwise go unnoticed.
DNSBL (DNS blacklist / RBL): A DNSBL (DNS-based blacklist), also called an RBL (real-time blackhole list), is a list of IP addresses known for sending spam or abuse, published in DNS so mail servers can query it in real time. If a sending IP appears on the list, its email may be blocked or flagged.
WHOIS: WHOIS is a query protocol and public directory that returns registration details for a domain name or IP address, such as the registrar, creation and expiry dates, and (where not redacted) contact information. Much personal data is now masked for privacy under rules like GDPR.
RDAP: RDAP (Registration Data Access Protocol) is the modern, structured replacement for WHOIS, delivering domain and IP registration data as JSON over HTTPS. It supports standardized queries, access control, and internationalization that legacy WHOIS lacks.
ASN (Autonomous System Number): An ASN is a unique number that identifies an autonomous system, a network or group of IP ranges under a single administrative control, on the global internet. ASNs are used by the BGP routing protocol to exchange routes between networks.
CIDR: CIDR (Classless Inter-Domain Routing) is a notation for describing IP address ranges by appending a prefix length after a slash, such as 192.0.2.0/24, where the number indicates how many leading bits define the network. It replaced rigid address classes to allocate IP space more efficiently.
Subnet: A subnet is a logical subdivision of a larger IP network, defined by a subnet mask that separates the network portion of an address from the host portion. Subnetting organizes and isolates traffic, improving routing efficiency and security.
Open relay: An open relay is a mail server misconfigured to forward email from any sender to any recipient without authentication. Spammers exploit open relays to send bulk unwanted mail, so such servers are frequently blacklisted.