Glossary · DNSA Record (Address Record)An A record maps a hostname to an IPv4 address and is the most common DNS record for pointing a domain at a web server.Glossary · DNSAAAA Record (IPv6 Address Record)An AAAA record maps a hostname to a 128-bit IPv6 address, letting IPv6-only and dual-stack visitors reach your server.Glossary · DNSALIAS and ANAME RecordsALIAS or ANAME records are provider-specific DNS records that act like a CNAME at the zone apex by resolving a target hostname and returning its IP addresses.Glossary · DNSApex Domain (Root Domain)The apex domain is the bare name at the top of a DNS zone, such as example.com, which must hold SOA and NS records and cannot be a CNAME.Glossary · DNSAuthoritative NameserverAn authoritative nameserver holds the actual DNS records for a zone and gives definitive answers, as opposed to a resolver that only fetches and caches answers.Glossary · DNSAuto-RenewAuto-renew is a registrar or certificate setting that extends a domain registration or SSL certificate automatically before it expires.Glossary · DNSCNAME FlatteningCNAME flattening lets a DNS provider answer queries for a root domain with the IP addresses of a target hostname, avoiding the rule that bans CNAME at the apex.Glossary · DNSCNAME Record (Canonical Name)A CNAME record makes one hostname an alias of another, so resolvers follow it and use the target's records instead.Glossary · DNSCybersquattingCybersquatting is registering a domain that matches or imitates someone else trademark or name in bad faith, usually to resell it or profit from the confusion.Glossary · DNSdig (Domain Information Groper)dig is a command-line DNS lookup tool that sends queries to a chosen resolver or nameserver and prints the full response, including flags, TTLs and sections.Glossary · DNSDNS Amplification AttackA DNS amplification attack spoofs a victim IP in small DNS queries to open resolvers, which send much larger responses at the victim in a reflected DDoS.Glossary · DNSDNS Cache PoisoningDNS cache poisoning injects forged records into a resolver cache so users asking for a legitimate name are sent to an attacker-chosen IP address.Glossary · DNSDNS FailoverDNS failover automatically changes the records a domain returns when a health check shows the primary server is down, steering users to a backup IP address.Glossary · DNSDNS HijackingDNS hijacking redirects a domain or a user lookups to a wrong destination by changing DNS settings, such as nameservers, records or a router resolver.Glossary · DNSDNS LeakA DNS leak happens when a device sends DNS queries outside an active VPN or encrypted tunnel, exposing the sites you visit to your ISP or local network.Glossary · DNSDNS PropagationDNS propagation is the period after a DNS change when different resolvers still serve old cached answers until their TTLs expire.Glossary · DNSDNS Provider (DNS Hosting)A DNS provider hosts your domain zone on authoritative nameservers and answers queries for it; it is often separate from the registrar holding the domain.Glossary · DNSDNS Resolver (Recursive Resolver)A DNS resolver is the server that looks up domain names for users by querying authoritative nameservers and caching the answers.Glossary · DNSDNS Root ServerDNS root servers are the top of the DNS hierarchy, answering with referrals to the nameservers of each top-level domain such as .com or .org.Glossary · DNSDNS Zone FileA DNS zone file is a text file listing every resource record in a zone, beginning with an SOA record, which authoritative servers load to answer queries.Glossary · DNSDNS Zone Transfer (AXFR)A DNS zone transfer (AXFR) copies a whole zone from a primary nameserver to a secondary, and if left open to anyone it exposes every record in the zone.Glossary · DNSDNSKEY RecordA DNSKEY record publishes a public key for a zone, which validating resolvers use to verify the DNSSEC signatures (RRSIG records) on that zone data.Glossary · DNSDoH (DNS over HTTPS)DNS over HTTPS (DoH) sends DNS queries inside encrypted HTTPS requests on port 443, hiding them from on-path observers and blending in with web traffic.Glossary · DNSDomain BackorderA domain backorder is a request to a service to try registering a specific domain the moment it expires and is released, ahead of other buyers.Glossary · DNSDomain ExpirationDomain expiration is the end of a registration period; if unrenewed, the domain moves through grace and redemption stages and may stop resolving or be deleted.Glossary · DNSDomain TransferA domain transfer moves a domain registration from one registrar to another, normally requiring an unlocked domain and an EPP authorization code.Glossary · DNSDomain Transfer LockA domain transfer lock is a registrar-set status, shown as clientTransferProhibited, that blocks moving the domain to another registrar until unlocked.Glossary · DNSDoT (DNS over TLS)DNS over TLS (DoT) encrypts DNS queries between a client and a resolver using a dedicated TLS connection on port 853, defined in RFC 7858.Glossary · DNSDS Record (Delegation Signer)A DS record is stored in the parent zone and holds a hash of a child zone DNSKEY, linking the two zones into the DNSSEC chain of trust.Glossary · DNSEPP Authorization CodeAn EPP authorization code, also called an auth code or transfer key, is a secret password a registrar gives you to prove ownership when moving a domain.Glossary · DNSGeoDNSGeoDNS is a DNS service that answers the same query with different IP addresses depending on where the client or its resolver appears to be located.Glossary · DNSGlue RecordA glue record is an A or AAAA record for a nameserver, stored at the parent zone so resolvers can reach a domain whose nameservers live inside that same domain.Glossary · DNSIDN and PunycodeAn internationalized domain name (IDN) contains non-ASCII characters, and Punycode is the encoding that converts it to an ASCII form starting with xn-- for DNS.Glossary · DNSLame DelegationA lame delegation is a DNS zone delegation whose listed nameserver does not answer authoritatively for that zone, causing failed or slow lookups.Glossary · DNSNameserver (Authoritative DNS Server)A nameserver is a DNS server that holds the official records for a domain and answers queries about it from resolvers around the world.Glossary · DNSNegative CachingNegative caching is when a DNS resolver stores a "does not exist" or "no data" answer for a time, so repeated lookups for missing names skip re-asking.Glossary · DNSNS Record (Name Server)An NS record delegates a DNS zone to specific authoritative nameservers and tells resolvers where to ask for that domain's records.Glossary · DNSNSEC and NSEC3 RecordsNSEC and NSEC3 records are DNSSEC records that prove a DNS name or record type does not exist by pointing to the next existing name in the zone.Glossary · DNSnslookupnslookup is a cross-platform command-line tool for querying DNS records, available on Windows by default and usable interactively or in a single command.Glossary · DNSNXDOMAINNXDOMAIN is the DNS response code meaning the queried name does not exist, which differs from an empty answer for a name that exists without that record type.Glossary · DNSPremium DomainA premium domain is a name a registry or reseller prices well above standard registration fees because it is short, generic, memorable or commercially valuable.Glossary · DNSPTR Record (Reverse DNS)A PTR record maps an IP address back to a hostname in the in-addr.arpa or ip6.arpa tree, and mail servers often check it.Glossary · DNSPublic DNS ResolverA public DNS resolver is a recursive DNS service open to anyone, such as Google 8.8.8.8, Cloudflare 1.1.1.1 or Quad9 9.9.9.9, used instead of the ISP default.Glossary · DNSRedemption Period (RGP)The redemption grace period is a late stage after a domain expires when the owner can still recover it, usually for a fee above a normal renewal.Glossary · DNSRegistrar (Domain Registrar)A registrar is an accredited company that sells and manages domain registrations on your behalf, handling renewals, locks and transfers.Glossary · DNSRegistry LockA registry lock is a high-security domain lock applied at the registry level that blocks changes until the owner is verified through an out-of-band process.Glossary · DNSReverse DNS (rDNS)Reverse DNS maps an IP address back to a hostname by querying a PTR record in the in-addr.arpa or ip6.arpa tree, the opposite of a normal DNS lookup.Glossary · DNSRound-Robin DNSRound-robin DNS publishes several A or AAAA records for one name and rotates their order so connections spread across multiple servers without a load balancer.Glossary · DNSSecondary DNSSecondary DNS keeps a replicated copy of your zone on a second provider or server so name resolution continues if the primary DNS provider fails.Glossary · DNSSERVFAILSERVFAIL is DNS response code 2, returned when a resolver could not complete a query, often due to broken delegation, timeouts or DNSSEC validation failure.Glossary · DNSSOA Record (Start of Authority)The SOA record marks the start of a DNS zone and holds its primary nameserver, admin contact, serial number and timing values.Glossary · DNSSplit-Horizon DNSSplit-horizon DNS returns different answers for one name depending on who asks, giving internal clients private IPs and the public internet public ones.Glossary · DNSSRV Record (Service Record)An SRV record tells clients the host, port, priority and weight for a specific service, such as SIP, XMPP or Microsoft 365 autodiscover.Glossary · DNSTTL (Time to Live)TTL is the number of seconds a DNS answer may be cached by resolvers before they must ask the authoritative server again.Glossary · DNSTXT Record (Text Record)A TXT record stores arbitrary text in DNS and is widely used for SPF, DKIM, DMARC and domain ownership verification.Glossary · DNSTyposquattingTyposquatting is registering domains that are common misspellings or lookalikes of a popular name, to catch mistyped traffic or to deceive visitors.Glossary · DNSWHOIS and RDAP (Domain Registration Data)WHOIS and RDAP are protocols for looking up who registered a domain, its registrar, dates and nameservers, with RDAP as the modern replacement.Glossary · DNSWHOIS PrivacyWHOIS privacy replaces your personal contact details in public domain registration records with proxy or redacted information to reduce spam and exposure.Glossary · DNSWildcard DNS RecordA wildcard DNS record uses an asterisk label, such as *.example.com, to answer for any subdomain that has no more specific record of its own.