DNS record types
TXT, CAA, SRV, and PTR records
Recognize four record types used for verification, certificate policy, service discovery, and reverse DNS.
Four more record types show up regularly. None of them get a browser to a server, but you’ll add or read all of them sooner or later.
TXT
A TXT record holds text. DNS doesn’t care what the text means. The system that reads it does.
That’s why TXT is used for so many unrelated things: proving you own a domain to Google or Stripe, SPF policies, DMARC policies, DKIM keys. Each one defines its own owner name and its own syntax.
Query the exact owner name, not just the apex:
dig TXT example.com
dig TXT _dmarc.example.comLong values can be split into several quoted strings inside one record. Readers join them back together. That’s different from publishing two separate TXT records with competing policies, which is an error for SPF.
CAA
A CAA record lists which certificate authorities may issue certificates for your domain. issue covers normal certificates, issuewild covers wildcards, and iodef gives CAs an address to report violations to.
dig CAA example.comCAA stops a compliant CA from issuing a certificate by mistake or for an attacker. It doesn’t revoke certificates that already exist, and it doesn’t replace certificate monitoring.
SRV
An SRV record advertises where a service lives: priority, weight, port, and target hostname. The owner name includes underscored service and protocol labels:
dig SRV _sip._tcp.example.comLower priority wins. Weight spreads the load among records with the same priority. SRV only helps when the client protocol knows to look for it. Browsers don’t. SIP clients and some chat protocols do.
PTR
A PTR record goes the other way: from an IP address back to a name. These live in special zones, in-addr.arpa for IPv4 and ip6.arpa for IPv6.
Use dig -x to do a reverse lookup:
dig -x 192.0.2.40Whoever controls the IP range controls that zone. So you set PTR records at your server or network provider, not in your normal DNS dashboard.
Mail servers care about PTR a lot. Many expect the PTR name to resolve forward to the same address. A PTR alone proves nothing about ownership or trust, but a missing one hurts deliverability.
Try this: find one TXT policy, one CAA set, one SRV set, and one PTR. For each, write down who controls it, which application reads it, and one thing it does not guarantee. The DNS records explainer helps when you’re picking a type.
Lesson completed