A (DNS record)
Generated by GPT-5-miniExpansion Funnel Raw 74 → Dedup 0 → NER 0 → Enqueued 0
| A (DNS record) | |
|---|---|
| Name | A (DNS record) |
| Type | Resource Record |
| Introduced | 1987 |
| Specification | RFC 1035 |
| Owner | Internet Engineering Task Force |
| Usage | IPv4 address mapping |
A (DNS record) is a Domain Name System resource record that maps a domain name to an IPv4 address. It is foundational to the Internet's name resolution ecosystem, enabling clients to translate textual hostnames into 32-bit IPv4 addresses used by network stacks and routers. The record is specified in standards developed by the Internet Engineering Task Force and is implemented across DNS software from vendors such as ISC, Microsoft, and Cloudflare.
Overview
The A record was defined in RFC 1035 and extended by later documents maintained by the Internet Engineering Task Force and the Internet Architecture Board. It pairs a DNS owner name with a four-octet IPv4 address and is distinguished from the IPv6-mapping AAAA record. Implementations appear in widely used software including BIND, PowerDNS, Microsoft DNS Server, Knot DNS, and Unbound. Authoritative sources for A records include zone files hosted by registrars like Verisign, GoDaddy, and Namecheap, and managed DNS providers such as Cloudflare, Amazon Route 53, and Google Cloud DNS.
Format and Syntax
A records follow the DNS resource record wire format defined in RFC 1035: owner name, class, type, TTL, RDLENGTH, and RDATA. In textual zone-file form used by BIND and NSD, a typical line contains an owner (FQDN), optional class (usually IN), type A, TTL, and an IPv4 address such as 203.0.113.10. Zone transfers employ the AXFR and IXFR mechanisms to replicate A-record data between primary and secondary name servers like those run by Dyn, NS1, and Akamai. Dynamic updates of A records use the RFC 2136 mechanism supported by software including dhclient and Windows DHCP Server.
Use and Functionality
Client resolvers in Linux, FreeBSD, macOS, and Windows query recursive resolvers provided by ISP networks, public resolvers such as Google Public DNS, Quad9, and Cloudflare DNS, or corporate resolvers like Cisco Umbrella to obtain A records. Responses include TTL values that influence caching behavior in systems such as Bind9 caches, dnsmasq, and browser networking stacks in Chromium, Firefox, and Safari. A records are used by services including web hosting on platforms like Apache HTTP Server, nginx, Microsoft IIS, email routing with Postfix and Microsoft Exchange (often in combination with MX records), and content delivery networks operated by Akamai, Fastly, and Cloudflare.
Subtypes and Related Records
Related DNS resource records include AAAA record for IPv6, CNAME record for canonical name aliasing, MX record for mail exchange, NS record for authoritative name servers, PTR record for reverse DNS, and SRV record for service location as used by SIP and XMPP deployments. Records that interact operationally with A records include SOA record for zone authority and NAPTR record used in ENUM and VoIP. Load-balancing and failover are often implemented by multiple A records returned in round-robin fashion or by using DNS-based load balancing services from providers like Amazon Route 53 and Microsoft Azure DNS.
Security and Misuse
A records can be abused for phishing, command-and-control infrastructure, and distributed denial-of-service amplification when combined with reflection techniques. Mitigation approaches involve DNSSEC signatures as specified by RFC 4033, RFC 4034, and RFC 4035 to provide origin authentication, and operational practices such as response-rate limiting implemented by BIND, Unbound, and PowerDNS Recursor. DNS privacy measures like DNS over HTTPS and DNS over TLS reduce on-path manipulation by entities such as national filtering systems and some ISPs. Registries and registrars including ICANN and Regional Internet Registries cooperate with law enforcement and hosting providers like Cloudflare and Akamai when responding to abuse reports tied to malicious A records.
Implementation and Resolution Behavior
Authoritative name servers serve A records for zones managed via zone files or dynamic backends using databases, HTTP APIs, or configuration systems like Terraform and Ansible. Recursive resolvers follow iterative query processes involving root servers (such as a.root-servers.net), top-level domain servers managed by operators like Verisign and country-code registries, and authoritative servers for the target zone. Caching resolvers respect TTL values but must handle negative caching per RFC 2308. Conditional behaviors such as split-horizon DNS are provided by enterprise products from F5 Networks, Cisco, and cloud providers to return different A records based on client location or network. Resolution debugging uses tools including dig, host, nslookup, and packet captures with Wireshark to inspect A-record responses and DNS transaction behavior.