Advanced DNS Records¶

This overview explains the advanced DNS record types (MX, SRV, SPF) and shows the syntax for BIND.

For most of these record types, our portal provides dedicated input forms that make creation easier.

1. MX Record (Mail Exchange)¶

Determines which mail servers are responsible for receiving emails for a domain. It always has a priority value (lower number = higher priority).

In the portal, the priority and mail server can be configured in separate fields. If you operate multiple mail servers, assign the backup server a higher priority number (for example 20) so it is only used when the primary server (priority 10) is unavailable.

Example - Single MX Record¶

example.com.  IN  MX  10 mail.example.com.

Example - Multiple MX Records¶

example.com.  IN  MX  10 mail1.example.com.
example.com.  IN  MX  20 mail2.example.com.

2. SRV Record (Service Locator)¶

Defines the location (hostname and port) of specific services (for example SIP, LDAP, or game servers). It contains priority, weight, port, and target.

Priority determines the order in which services are contacted (lower number = higher priority). Weight is used when multiple entries have the same priority in order to distribute load. The port defines where the service is reachable, and the target host is the server providing the service.

In the portal, you can enter priority, weight, port, and target host separately. In addition, templates for the most common services are available.

Example - Minecraft Server¶

_minecraft._tcp.example.com.  IN  SRV  10 5 25565 server.example.com.

Example - SIP Server¶

_sip._tcp.example.com.  IN  SRV  10 5 5060 sipserver.example.com.

3. SPF (Sender Policy Framework)¶

Warning: Deprecated

SPF no longer has its own record type (type SPF/99 is deprecated). An SPF entry is now always stored as a TXT record. It defines which servers are allowed to send emails on behalf of the domain.

An SPF record defines the authorized mail servers and the policies for handling unauthorized email. It contains mechanisms such as v=spf1 (version), ip4/ip6 (allowed IP addresses), include (include other SPF entries), and -all (policy for unauthorized email).

Example¶

The mail server has the IPs 1.2.3.4 and 2001:db8::1, allows emails from those servers, and rejects all others.

example.com.  IN  TXT  "v=spf1 a mx ip4:1.2.3.4 ip6:2001:db8::1 -all"

Tip

If you have multiple mail servers, you can define them with ip4 and ip6.

CAA¶

The CAA record (Certification Authority Authorization) defines which certificate authorities (CAs) are allowed to issue SSL/TLS certificates for the domain. It contains flags, tag, and value.

Example¶

Only the CA letsencrypt.org may issue certificates for example.com.

example.com.  IN  CAA  0 issue "letsencrypt.org"

TLSA¶

The TLSA record (Transport Layer Security Authentication) is used to verify the authenticity of TLS certificates. It contains the port number, the protocol, the certificate usage type, and the certificate association data.

Example¶

TLSA record for an HTTPS service on port 443 using a certificate of type 3 (DANE-EE).

_443._tcp.example.com.  IN  TLSA  3 1 1 "abcdef1234567890"