DNS Record Types

DNS Check monitors 14 DNS record types, from the A and CNAME records that every domain has to the SVCB and HTTPS service binding records defined in RFC 9460. Few monitoring services cover your mail routing, your certificate policy, and your service bindings, so getting all three usually means running several tools. DNS Check monitors all of them.

Every record type on this page is available on every plan, including the free plan. Plans differ in how many records you can monitor, not in which types you're allowed to monitor. The one exception is load balancer records, described below, which need a Professional or Enterprise plan.

Supported DNS Record Types

Here are the record types DNS Check monitors. Each links to a page explaining what the record does, what its fields mean, and how it looks in a zone file:

Record type	What it does
A records	Maps a domain name to an IPv4 address.
AAAA records	Maps a domain name to an IPv6 address.
ALIAS records	Points one record at another record of the same type, without the intermediate lookup a CNAME needs. Also called an ANAME record.
CAA records	Specifies which certificate authorities are permitted to issue TLS/SSL certificates for a domain.
CNAME records	Aliases one domain name to another.
HTTPS records	Tells browsers how to reach a website, including the protocols, port, and address hints to use before connecting.
MX records	Directs email for a domain to the correct mail server.
NS records	Delegates a domain to the authoritative name servers that answer queries for it.
PTR records	Maps an IP address back to a domain name, which is known as reverse DNS.
SOA records	Defines the global parameters for a DNS zone, such as its primary name server and serial number.
SPF records	Carries a Sender Policy Framework policy in the legacy SPF resource record type, which RFC 7208 replaced with TXT.
SRV records	Gives the host and port of the server providing a specific service and protocol.
SVCB records	Advertises the connection parameters for a service, letting clients reach an alternative endpoint with the right transport settings.
TXT records	Holds arbitrary text, used for SPF, DKIM, DMARC, and domain ownership verification.

Load Balancer Records

A load balancer record is a single monitored record that holds a set of acceptable values rather than just one. This is how DNS-based load balancing and round-robin DNS are normally published. The check passes when the name server returns values from the set, so a rotating answer isn't reported as a failure. IPv4 and IPv6 addresses can be given as individual addresses or as CIDR ranges.

A, AAAA, and CNAME records can be monitored this way. Load balancer records need a Professional or Enterprise plan; see the pricing page for what each plan includes.

Wildcard Records

An asterisk (*) stands in for "anything" in two places. A monitored record's Name can be a wildcard name like *.example.com, which monitors the wildcard record that answers queries for names with no records of their own. A monitored record's expected Value can be *, which passes as long as the record exists, whatever it returns. That's the option to use when a value changes on its own, such as a CDN handing out addresses from a pool or a zone's serial number incrementing on every edit.

Wildcard names work with every record type on this page. Wildcard values are accepted by most of them, in some cases field by field. See the Wildcard DNS Records page for which types and fields take one. Wildcards are available on every plan.

Record Types Built on TXT

Several records that are often referred to as their own record type are actually published as TXT records. DNS Check monitors each of them as a TXT record:

Record	Published at	Why monitor it
DMARC	_dmarc.example.com	Catches a policy being weakened from p=reject back to p=none, or being dropped entirely.
DKIM	selector._domainkey.example.com	Easy to lose track of when an email provider rotates a key or a selector is retired.
BIMI	default._bimi.example.com	Controls the logo shown beside your messages, which disappears if the record is removed or malformed.
MTA-STS	_mta-sts.example.com	Announces your MTA-STS policy. If it's removed, senders stop enforcing TLS on mail to your domain.
TLS-RPT	_smtp._tls.example.com	Names the address that receives TLS delivery reports, which stop arriving if it's wrong.
Domain ownership verification	Usually the domain itself	Services like Google Workspace and Microsoft 365 stop working if their record is removed during a cleanup.

SPF belongs on this list as well. RFC 7208 requires SPF policies to be published as TXT resource records only, so a policy published the recommended way is monitored here as a TXT record. The separate SPF record type in the table above is the older SPF resource record type that RFC 7208 retired, which DNS Check still monitors for domains that haven't moved off it yet.

Adding DNS Records to Monitor

There are two ways to get your records into DNS Check:

• Import a zone file to add everything at once. Standard zone file syntax (RFC 1035) is parsed, along with the non-standard records DNS Check exports as comments, so a file exported from DNS Check imports back into an identical set of records.
• Add records individually by picking a record type and filling in the fields for that type. The form changes to match the type you pick, so an MX record asks for a preference and an exchange, and an SRV record asks for a priority, weight, port, and target.

Either way, DNS Check queries your name servers on a schedule, compares the records they return against the ones you entered, and notifies you when the two stop matching or a lookup fails.

Record Types That Aren't Supported

DNS Check can't monitor these record types yet. If your zone file contains them, every other record is imported, and the unsupported lines are reported:

• DNSSEC records: DS, DNSKEY, and RRSIG.
• TLSA records, used by DANE.
• NAPTR, URI, LOC, SSHFP, DNAME, and HINFO records.

If you need one of these, tell us. We decide which types to build next largely based on what customers ask for.