DNS & Glossary
The Domain Name System turns human-readable names into the addresses and policies that route mail, prove identity and secure connections. This section documents every common DNS record type — what it stores, its zone-file syntax, and how to avoid the misconfigurations that break email and DNSSEC.
It also carries a glossary that defines the infrastructure terms the rest of the WebInspect reference library leans on, from TTL and ASN to HSTS, SPF and Certificate Transparency.
DNS record types
- A recordThe most fundamental DNS record: it maps a hostname to an IPv4 address so clients know where to send the connection.
- AAAA recordThe IPv6 counterpart of the A record: it maps a hostname to a 128-bit IPv6 address, enabling dual-stack connectivity for modern networks.
- CNAME recordAn alias that points one hostname at another canonical name — useful for pointing subdomains at a CDN or platform without hard-coding IPs.
- MX recordThe record that routes email: it names the mail servers accepting mail for a domain, with priority values that set primary and backup order.
- TXT recordA flexible text record that powers email authentication (SPF, DKIM, DMARC) and domain-ownership verification for countless services.
- NS recordThe record that delegates authority: it names the servers that answer authoritatively for a zone, forming the backbone of DNS delegation.
- SOA recordThe single record at the top of every zone that stores its authority metadata: primary server, admin contact, a serial number, and the timers that govern secondary-server synchronisation.
- CAA recordA security record that whitelists which certificate authorities may issue certificates for your domain, blocking unauthorized or mistaken issuance.
- PTR recordThe reverse of an A record: it maps an IP address back to a hostname. Mail servers check it, so a correct PTR is important for email deliverability.
- SRV recordA record that advertises where a specific service runs — host and port — with priority and weight for load balancing. Used by protocols like SIP, XMPP and Minecraft.
- DS recordThe DNSSEC record that connects a zone to its parent: it publishes a hash of the zone's signing key so resolvers can build an unbroken chain of trust from the root.
- DNSKEY recordHolds the public keys that resolvers use to verify a zone's DNSSEC signatures — split into a Key-Signing Key and a Zone-Signing Key.
- NAPTR recordAn advanced record that uses regular-expression rules to rewrite a name into a service URI — the backbone of ENUM telephone-number mapping and SIP discovery.
- TLSA recordThe record behind DANE: it pins which TLS certificate or key is valid for a service using DNSSEC, so a mis-issued certificate from any CA can be rejected.
Glossary
- TTLHow long a DNS record may be cached before resolvers must re-query — the dial that trades faster propagation against lower DNS load.
- ASNThe number that identifies a network operator on the internet. Every IP address belongs to an AS, so the ASN reveals who hosts or routes a given address.
- BGP prefixThe CIDR block of IP addresses a network announces to the world via BGP — the routing unit that determines the path traffic takes to reach an address.
- CDNA network of edge servers that cache content near users, cutting latency, absorbing traffic spikes and adding a security and TLS-termination layer in front of the origin.
- TLS handshakeThe negotiation that starts every HTTPS connection: the client and server authenticate, agree on a cipher, and derive shared keys before any application data is sent.
- HSTSA response-header policy that forces browsers to use HTTPS for a domain, blocking protocol-downgrade and SSL-stripping attacks.
- CORSThe browser mechanism that lets a server opt in to requests from other origins, relaxing the same-origin policy through Access-Control response headers.
- MIME typeThe label that tells a browser what a file is — text/html, application/json, image/png — carried in the Content-Type header and central to both rendering and security.
- ETagA per-version fingerprint of a resource that lets clients revalidate cheaply — the server answers a conditional request with 304 Not Modified when the ETag still matches.
- TTFBHow long from request to the first response byte — the sum of DNS, connection, TLS handshake and server processing time, and a key latency signal.
- DNSSECCryptographic signing of DNS so answers can be verified as authentic and untampered — closing the door on cache poisoning and forged DNS responses.
- Reverse DNSLooking up the hostname for an IP address, the inverse of normal resolution. Mail servers and security tools rely on it, especially forward-confirmed reverse DNS.
- SPFA DNS TXT policy that names which servers may send email for your domain, letting receivers detect forged senders — one leg of the SPF/DKIM/DMARC stack.
- DKIMCryptographic signing of outgoing mail, with the public key published in DNS, so receivers can verify a message truly came from your domain and was not tampered with.
- DMARCThe policy layer over SPF and DKIM: it tells receivers what to do with mail that fails authentication (none, quarantine, reject) and delivers reports on who is sending as your domain.
- OCSPHow clients learn whether a TLS certificate has been revoked before trusting it — and how OCSP stapling lets the server prove validity quickly and privately.
- Certificate TransparencyPublic, append-only logs of every issued TLS certificate, so domain owners can spot certificates issued for their domain without permission and browsers can require proof of logging.
- HTTP cachingHow browsers and CDNs store and reuse responses to avoid redundant round trips — governed by Cache-Control freshness and ETag/Last-Modified revalidation.