DNS record types

The record types a Coritan DNS zone accepts, the content each one takes and the rules the API checks.

View as Markdown

Every record has a name, a type, content and a TTL. The DNS tab's Type list and the API accept every type below.

Types

Section titled Types

Type	Content	Other fields	Example content
`A`	An IPv4 address	Can be proxied	`203.0.113.10`
`AAAA`	An IPv6 address	Can be proxied	`2001:db8::10`
`CNAME`	The hostname this name is an alias of	None	`app.example.net`
`MX`	The hostname of a mail server	Priority	`mail.example.com`
`TXT`	Text, up to 2,048 characters	None	`v=spf1 include:_spf.example.com ~all`
`SRV`	The hostname of the server that offers the service	Priority, weight and port	`play.example.com`
`NS`	The hostname of a nameserver	None	`ns1.example.net`
`CAA`	`<flags> <tag> "<value>"`	None	`0 issue "letsencrypt.org"`
`DS`	`<key tag> <algorithm> <digest type> <digest>`	None	`2371 13 2 1F987CC6583E92DF0890718C42…`
`PTR`	A hostname	None	`host.example.com`
`SVCB`	`<priority> <target> [key=value ...]`	None	`1 svc.example.com. alpn=h2`
`HTTPS`	`<priority> <target> [key=value ...]`	None	`1 . alpn="h3,h2"`

Rules for every record

Section titled Rules for every record

Name: Relative to the zone, up to 253 characters: @ for the domain itself, www for www.example.com, * for any name without records of its own. Coritan lowercases it. The full name works too, with or without its trailing dot: www.example.com is stored as www. A full name outside the zone, or a name that ends in a domain above it, is refused.
TTL: From 60 to 86,400 seconds. The API uses 300 when you leave it out.
Hostnames in content: For CNAME, MX, NS, SRV and PTR, Coritan lowercases the hostname and drops a trailing dot. Each label takes letters, digits, underscores and hyphens.
Priority, weight and port: Whole numbers from 0 to 65,535. MX needs a priority. SRV needs all three.
Comment: Optional text that only you see. It is not published in DNS.

Rules for some types

Section titled Rules for some types

A and AAAA: Only these two can be proxied. A proxied record must point at a public address (Proxied records).
CNAME: Not at @, and never beside another record of any type at the same name.
TXT: Type the text as it is; surrounding quotes are optional. Coritan splits text longer than 255 characters into the strings DNS carries.
SRV: Put the service and protocol in the name, such as _minecraft._tcp, and the target hostname in the content. On the DNS tab, the Service, Protocol and Name fields make the name, and Target is the content.
NS: At a name other than @, an NS record hands that name to other nameservers. The two or more NS records at @ are the zone's own, and the zone keeps at least two.
CAA: Lists the certificate authorities that may issue certificates for the name. On the DNS tab, the Tag and Certificate authority (or Report address) fields make the content, and Critical, under Record attributes, sets the flags to 128. Coritan requests certificates from Let's Encrypt and falls back to ZeroSSL and Google Trust Services. If you publish CAA records for a name that Coritan secures, add an issue record for each of letsencrypt.org, sectigo.com and pki.goog (How SSL/TLS certificates work).
DS: Only at a delegated name, never at @. The digest is hexadecimal: 40 characters for digest type 1, 64 for types 2 and 3, and 96 for type 4. On the DNS tab, the Key tag, Algorithm, Digest type and Digest fields make the content; the Digest type list offers 1, 2 and 4. Add one when the delegated name's own DNS provider signs it. Without a DS record, a signed zone tells validating resolvers that the delegated name is unsigned, and they accept its answers without checking them.
SVCB and HTTPS: The content starts with the priority, then the target and any key=value parameters. A dot as the target means the record's own name. An HTTPS record at @, such as 1 . alpn="h3,h2", tells browsers that the domain serves HTTP/3 and HTTP/2 before they connect. Coritan checks the content with a DNS parser and refuses what it cannot read, with an example of the format in the error.
PTR: Answers a lookup of an address with a hostname. Resolvers ask for such a lookup under in-addr.arpa or ip6.arpa, so a PTR record in a zone such as example.com does not answer it. For a floating IP, set reverse DNS instead.

Names a load balancer owns

Section titled Names a load balancer owns

A name that a load balancer answers for takes no A, AAAA or CNAME records of its own. Change the load balancer instead, or delete it to manage the name with records again.

Section titled Related