Reading a whole DNS zone line by line: names, trailing dots, TTL and the @ sign

Domains & DNS·· 4 views· 4 min read

The short answer: a DNS zone is a plain-text list of records, one per line, in a standard format (the “zone file” from RFC 1035, the one BIND uses). Many servers store zones this way, and it is the format most DNS providers export and import. Being able to read it lets you check a migration, find a lost record and catch mistakes before they take the website or e-mail down. A small zone:$ORIGIN example.com.
$TTL 3600
@ IN SOA ns1.example.net. hostmaster.example.com. (
2026101601 ; serial
3600 ; refresh
1800 ; retry
1209600 ; expire
86400 ) ; minimum
@ IN NS ns1.example.net.
@ IN NS ns2.example.net.
@ IN A 192.0.2.10
@ IN AAAA 2001:db8::10
@ IN MX 10 mail.example.com.
@ IN TXT "v=spf1 a mx -all"
mail IN A 192.0.2.10
www IN CNAME example.com.
_dmarc IN TXT "v=DMARC1; p=none"
(example: example.com is a domain reserved for examples, and 192.0.2.10 and 2001:db8::10 are documentation addresses; replace them with yours.)

Each piece of a line

Piece What it means
$ORIGIN The domain appended to every name that does not end in a dot.
$TTL The default TTL: it applies to lines that do not carry their own.
The name (first column) @ is the domain itself. www with no dot is www.example.com. A name that ends in a dot is absolute and stays as it is. A blank first column repeats the name from the line above.
The TTL (optional number) How many seconds resolvers may keep the answer. See TTL and caching.
IN The class: Internet. It is on almost every line and you can ignore it.
The type SOA, NS, A, AAAA, CNAME, MX, TXT, SRV, CAA and others. DNS records explained covers what each one does.
The data Whatever the type needs: an IP for A, a priority and a name for MX, quoted text for TXT.
; and ( ) A semicolon starts a comment. Parentheses let one record span several lines, like the SOA in the example.

Reading your zone, in this order

1 Have the zone in front of you. In cPanel, the Zone Editor, under Manage next to the domain, shows the same records as a table with the same columns. Outside DNS providers such as Cloudflare usually offer a way to export the zone in this format. On a VPS with your own DNS, it is the zone file.
2 Start with the SOA and NS records: they say who answers for the zone. If the zone’s NS records are not the ones set at the domain’s registration, you are reading the wrong zone. See nameservers and the SOA record.
3 Write every name out in full: append the domain to every name without a trailing dot. This is the step where doubled names such as mail.example.com.example.com show up.
4 Group the lines by name: a name that has a CNAME cannot have anything else. If it does, see CNAME on the bare domain.
5 Check the e-mail lines: the MX and the name it points to, the TXT with v=spf1 on the domain, the TXT records on names ending in ._domainkey (DKIM) and the TXT on _dmarc. There should be exactly one SPF.
6 Compare with what the internet sees: ask the nameserver, name by name, with dig @ns1.example.net www.example.com A +short. What the file says and what the server answers must match.
The dot at the end of a name changes everything. In a zone whose origin is example.com, writing mail.example.com without the dot gives mail.example.com.example.com., a name nobody looks up. Some editors add the dot for you, others do not: always check what was saved.
Keep a copy of the zone before you change provider. That file is the record of what the zone held, and it is what you check the new zone against: moving your DNS zone and checking it.

Looking at a zone and one line makes no sense? Send us the domain and the line that puzzles you.

Open a support ticket

SEE ALSO

DNS records explained: A, CNAME, MX, TXT and TTL

Moving your DNS zone to a new provider and checking it before you switch

Taking the whole DNS zone to Cloudflare without losing records

Checking DNS from the command line: dig and nslookup, and how to read the answer

The SOA record and its serial number: what each field means and when it matters

CNAME on the bare domain: why it is not allowed and what to use instead

RECOMMENDED PRODUCT

Register your .ao domain

Secure your company name before someone else registers it. from $33.30/yr

Search a domain
Was this answer helpful? Your answer helps us improve this article.