DNS record types
TXT, CAA, SRV, and PTR records
Recognize four record types used for verification, certificate policy, service discovery, and reverse DNS.
8 minute lesson
TXT records store text used by systems such as domain verification and email authentication. The application using the record defines the text format.
DNS does not interpret a TXT payload. SPF, DMARC, DKIM, and verification systems each define their own owner name and syntax. Long TXT data can be split into several quoted character strings inside one record; consumers concatenate those strings. That is different from publishing several competing policy records.
Query the exact owner, not only the apex:
dig TXT example.com
dig TXT _dmarc.example.comCAA records say which certificate authorities may issue certificates for a domain. issue covers ordinary certificates, issuewild covers wildcard policy, and iodef can provide an incident-reporting contact. CAA reduces accidental or unauthorized issuance by compliant CAs; it does not revoke existing certificates or replace certificate monitoring.
dig CAA example.comSRV records advertise a service location with priority, weight, port, and target. The owner includes underscored service and protocol labels, such as _sip._tcp.example.com. Lower priority is preferred; weight distributes selection among records with the same priority. SRV helps only when the client protocol knows to query it.
dig SRV _sip._tcp.example.comPTR records perform reverse lookup from an address to a name under in-addr.arpa for IPv4 or ip6.arpa for IPv6. The organization controlling the IP range controls this zone, so you normally configure PTR through the server or network provider rather than your ordinary forward-DNS host.
dig -x 192.0.2.40Mail systems often expect the PTR name to resolve forward to the same address. A PTR alone does not prove ownership or trustworthiness.
Your action is to inspect one TXT policy, one CAA set, one SRV set, and one PTR. For each, identify who controls the record, which application consumes it, and one thing the record does not guarantee. Use the DNS records explainer when choosing a type.
Lesson completed