Skip to content

Zone management

Record types

Review every DNS record type DNSMigrator supports, including standard, DNSSEC, service, redirect, provider-specific, and dnsconfig.js alias records.

7 min read

On this page

DNSMigrator’s release model has 44 canonical record types: standard DNS records, redirect shortcuts, and provider-specific pseudo-records. The key point is that the Type menu uses the union advertised by the assigned providers; a type can appear even when another assigned provider cannot accept it.

How to read this reference#

The support counts below come from the release provider catalog. They include the 65 connectable, writable DNS destinations and exclude the BIND file module and DNS modules marked as planned. Open Supported providers to confirm a destination’s current capability list.

Examples use zone-file layout for readability:

text
owner  TTL  IN  TYPE  RDATA

@ means the zone apex. DNS names are stored in lowercase with a trailing dot. TXT and SPF values are stored as logical text without outer quotes.

Common record types#

These types have dedicated fields in the record editor.

TypeFields in the editorZone-file exampleRelease catalog support
AAddresswww 300 IN A 192.0.2.1065 destinations. The form validates four decimal octets and removes leading zeros.
AAAAAddresswww 300 IN AAAA 2001:db8::1065 destinations. The stored value is compressed and lowercased.
CNAMETargetwww 300 IN CNAME app.example.net.65 destinations. The form allows one target; apex support depends on every assigned provider.
MXPriority, Mail server@ 300 IN MX 10 mx1.mail.example.net.62 destinations. Priority is 0–65535; 0 . represents null MX.
TXTText@ 300 IN TXT "v=spf1 -all"60 destinations. Enter text without quotes; provider logical-value limits differ.
NSTargetchild 3600 IN NS ns1.child.example.56 destinations. Use an NS record for a delegated child. Apex NS records are configured as nameserver settings.
SRVPriority, Weight, Port, Target_sip._tcp 300 IN SRV 10 5 5060 sip.example.net.60 destinations. Each number is 0–65535; . is allowed as the target.
CAAFlags, Tag, Value@ 300 IN CAA 0 issue "letsencrypt.org"52 destinations. The form offers flags 0 and 128 plus issue, issuewild, iodef, issuemail, and issuevmc.
PTRTarget10 300 IN PTR host.example.com.34 destinations. In a reverse-zone dnsconfig.js, a full IP owner is reduced to the relative reverse label.

CNAME, ALIAS, and DNAME are single-value in the form. NS and PTR use the same hostname field but may hold several values. Types without a dedicated editor use Record data, which checks only that the value is nonempty before saving unless a specific lint rule applies.

DNSSEC, service binding, and security records#

TypeCanonical RDATAZone-file exampleRelease behavior and support
SOAPrimary NS, mailbox, serial, refresh, retry, expire, minimum@ 3600 IN SOA ns1.example.net. hostmaster.example.com. 1 3600 600 1209600 300No destination advertises user-managed SOA. It is hidden from Add record and omitted from managed-zone plans.
DSKey tag, algorithm, digest type, digestchild 300 IN DS 12345 13 2 49FD46E6C4B45C55D4AC0123456789ABCDEF0123456789ABCDEF0123456789AB18 destinations. Zone checks validates key-tag, algorithm, digest type, hexadecimal data, and digest length.
DNSKEYFlags, protocol, algorithm, public key@ 300 IN DNSKEY 257 3 13 BASE64PUBLICKEYNo destination advertises it as user-managed. It is hidden and omitted from plans; supported providers create it when DNSSEC is enabled.
HTTPSPriority, target, service parameters@ 300 IN HTTPS 1 . alpn="h3,h2"24 destinations. The direct editor stores raw Record data and does not parse service parameters.
SVCBPriority, target, service parameters_dns 300 IN SVCB 1 resolver.example.net. port=853 alpn="dot"22 destinations. The direct editor stores raw Record data.
TLSAUsage, selector, matching type, association data_443._tcp 300 IN TLSA 3 1 1 0C72AC70B745AC19998811B131D662C9AC69DBDBE7CB23E5B514B56664C5D3D633 destinations. The direct editor does not validate the numeric fields or digest.
SSHFPAlgorithm, fingerprint type, fingerprinthost 300 IN SSHFP 4 2 123456789ABCDEF028 destinations. The direct editor stores raw RDATA.
SMIMEAUsage, selector, matching type, association datahash._smimecert 300 IN SMIMEA 3 1 1 A1B2C3D4AXFR/DDNS, CentralNic, deSEC, Infomaniak, and PowerDNS.
CERTCertificate type, key tag, algorithm, certificatecert 300 IN CERT PGP 0 0 mQENBFExample7 destinations. It uses raw Record data and has no dnsconfig.js record function in this release.

A DS for this zone belongs at its parent or registrar. An in-zone DS normally accompanies an NS delegation for a child. Use Settings → DNSSEC for provider-managed signing and follow DNSSEC transitions when changing delegation.

Other standard records#

TypeCanonical RDATAZone-file exampleRelease catalog support
NAPTROrder, preference, flags, service, regexp, replacement@ 300 IN NAPTR 100 10 "U" "E2U+sip" "!^.*$!sip:info@example.com!" .22 destinations. The direct editor stores raw RDATA.
SPFSPF policy text@ 300 IN SPF "v=spf1 -all"16 destinations. The type is obsolete; publish SPF policy as TXT. The dnsconfig.js runtime does not register an SPF() function.
LOCLatitude, longitude, altitude, size, horizontal precision, vertical precisionoffice 300 IN LOC 51 30 12.748 N 0 7 39.611 W 0.00m 0.00m 0.00m 0.00m9 destinations. Use a LOC builder rather than hand-writing raw data.
URIPriority, weight, absolute URI_service 300 IN URI 10 1 "https://example.com/"Cloudflare, AXFR/DDNS, deSEC, PowerDNS, and Realtime Register. It has no dnsconfig.js record function in this release.
ALIASTarget hostname@ 300 IN ALIAS app.example.net.29 destinations. This is a provider-level flattening record, not a standard wire type.
DHCIDBase64 identifierhost 300 IN DHCID AAIBY2/AuCccgoJbsaxcQc9TUapptP69lOjxfNuVAA2kjEA=AXFR/DDNS, CentralNic, deSEC, NS1, and PowerDNS.
DNAMETarget hostnameold 300 IN DNAME new.example.net.15 destinations. The form allows one target.
OPENPGPKEYBase64 public keyhash._openpgpkey 300 IN OPENPGPKEY mQENBFExampleAXFR/DDNS, deSEC, Gandi, hosting.de, LuaDNS, and PowerDNS.
RPMailbox name, TXT name@ 300 IN RP hostmaster.example.com. contact.example.com.7 destinations. Both values are DNS names, but the direct editor stores the row as raw data.

The nine LOC destinations are Cloudflare, Akamai, CentralNic, deSEC, Gandi, Loopia, Oracle Cloud, OVHcloud, and Realtime Register.

Redirect and mail shortcut types#

These are control-plane shortcuts rather than portable DNS wire types. The BIND parser does not accept them as zone-file record types.

TypeValue in the direct editorDNSMigrator-style exampleRelease catalog support
URLDestination URLgo 300 IN URL https://example.net/DNSimple, DNS Made Easy, INWX, Joker, Namecheap, and Realtime Register.
URL301Destination URLgo 300 IN URL301 https://example.net/DNS Made Easy, INWX, and Namecheap.
FRAMEDestination URLgo 300 IN FRAME https://example.net/DNS Made Easy, INWX, and Namecheap.
MXEProvider mail destination@ 300 IN MXE mailNamecheap advertises it, but Add record hides MXE and the dnsconfig.js runtime has no MXE() function.

When a migration destination lacks the same shortcut, translation marks it as a provider redirect feature instead of inventing equivalent HTTP behavior.

Cloudflare pseudo-records#

The release catalog exposes four Cloudflare-only pseudo-types. They use raw Record data in the editor and are not accepted by the BIND parser.

TypeValue shapeDNSMigrator-style example
CF_REDIRECTSource pattern, destination@ 300 IN CF_REDIRECT "example.com/*" "https://www.example.com/$1"
CF_TEMP_REDIRECTSource pattern, destination@ 300 IN CF_TEMP_REDIRECT "example.com/*" "https://status.example.net/$1"
CF_SINGLE_REDIRECTRule name, HTTP code, expression, target expression@ 300 IN CF_SINGLE_REDIRECT "to-www" 301 "http.host eq \"example.com\"" "concat(\"https://www.\", http.host)"
CF_WORKER_ROUTERoute pattern, Worker script@ 300 IN CF_WORKER_ROUTE "example.com/api/*" "api-worker"

The dnsconfig.js constructor for CF_SINGLE_REDIRECT accepts 301, 302, 303, 307, or 308. Cloudflare proxying is separate: ordinary A, AAAA, and CNAME records use Proxy through Cloudflare metadata.

Akamai, ClouDNS, PowerDNS, and appliance types#

TypeValue shapeDNSMigrator-style exampleRelease catalog owner
AKAMAICDNEdge hostnamewww 300 IN AKAMAICDN www.example.com.edgekey.netAkamai Edge DNS
AKAMAITLCAnswer type (DUAL, A, or AAAA) and target@ 300 IN AKAMAITLC DUAL example.edgesuite.net.Akamai Edge DNS
LUAEmitted record type and Lua expressionapp 300 IN LUA A "ifportup(443, {'192.0.2.1'})"PowerDNS, not LuaDNS
CLOUDNS_WRDestination URLgo 300 IN CLOUDNS_WR https://example.net/ClouDNS
ADGUARDHOME_A_PASSTHROUGHEmpty RDATAhost 300 IN ADGUARDHOME_A_PASSTHROUGHAdGuard Home
ADGUARDHOME_AAAA_PASSTHROUGHEmpty RDATAhost 300 IN ADGUARDHOME_AAAA_PASSTHROUGHAdGuard Home
MIKROTIK_FORWARDERUpstream DNS server addressescorp 300 IN MIKROTIK_FORWARDER 192.0.2.53,192.0.2.54MikroTik
MIKROTIK_FWDForward-to addresscorp 300 IN MIKROTIK_FWD 192.0.2.53MikroTik
MIKROTIK_NXDOMAINEmpty RDATAblocked 300 IN MIKROTIK_NXDOMAINMikroTik

The two AdGuard passthrough types and MIKROTIK_NXDOMAIN require an empty canonical value. The release web save guard rejects empty non-alias values, so they cannot currently be created or imported successfully as managed-zone records.

Alias constructors in dnsconfig.js#

R53_ALIAS and AZURE_ALIAS are constructor names, not canonical record types. The importer converts them to ordinary records with alias metadata:

dnsconfig.js
R53_ALIAS("cdn", "A", "d111111abcdef8.cloudfront.net.", R53_EVALUATE_TARGET_HEALTH(true), R53_ZONE("Z2FDTNDATAQYW2"))
AZURE_ALIAS("app", "A", "/subscriptions/0000/resourceGroups/dns/providers/Microsoft.Network/publicIPAddresses/app")

A Route 53 alias stores an allowed Route 53 record type with no ordinary values, plus a DNS target, optional hosted-zone ID, and optional health evaluation. The direct editor exposes aliases only for A and AAAA. An Azure alias stores A, AAAA, or CNAME with a resource ID and is available only by loading dnsconfig.js.

For the exact runtime function list and import losses, see dnsconfig.js import and export. Use the zone file validator for the release BIND parser’s standard-type and directive coverage.