Zone management
Record types
Review every DNS record type DNSMigrator supports, including standard, DNSSEC, service, redirect, provider-specific, and dnsconfig.js alias records.
7 min read
On this page
DNSMigrator’s release model has 44 canonical record types: standard DNS records, redirect shortcuts, and provider-specific pseudo-records. The key point is that the Type menu uses the union advertised by the assigned providers; a type can appear even when another assigned provider cannot accept it.
How to read this reference#
The support counts below come from the release provider catalog. They include the 65 connectable, writable DNS destinations and exclude the BIND file module and DNS modules marked as planned. Open Supported providers to confirm a destination’s current capability list.
Examples use zone-file layout for readability:
owner TTL IN TYPE RDATA@ means the zone apex. DNS names are stored in lowercase with a trailing dot. TXT and SPF values are stored as logical text without outer quotes.
Common record types#
These types have dedicated fields in the record editor.
| Type | Fields in the editor | Zone-file example | Release catalog support |
|---|---|---|---|
| A | Address | www 300 IN A 192.0.2.10 | 65 destinations. The form validates four decimal octets and removes leading zeros. |
| AAAA | Address | www 300 IN AAAA 2001:db8::10 | 65 destinations. The stored value is compressed and lowercased. |
| CNAME | Target | www 300 IN CNAME app.example.net. | 65 destinations. The form allows one target; apex support depends on every assigned provider. |
| MX | Priority, Mail server | @ 300 IN MX 10 mx1.mail.example.net. | 62 destinations. Priority is 0–65535; 0 . represents null MX. |
| TXT | Text | @ 300 IN TXT "v=spf1 -all" | 60 destinations. Enter text without quotes; provider logical-value limits differ. |
| NS | Target | child 3600 IN NS ns1.child.example. | 56 destinations. Use an NS record for a delegated child. Apex NS records are configured as nameserver settings. |
| SRV | Priority, Weight, Port, Target | _sip._tcp 300 IN SRV 10 5 5060 sip.example.net. | 60 destinations. Each number is 0–65535; . is allowed as the target. |
| CAA | Flags, Tag, Value | @ 300 IN CAA 0 issue "letsencrypt.org" | 52 destinations. The form offers flags 0 and 128 plus issue, issuewild, iodef, issuemail, and issuevmc. |
| PTR | Target | 10 300 IN PTR host.example.com. | 34 destinations. In a reverse-zone dnsconfig.js, a full IP owner is reduced to the relative reverse label. |
CNAME, ALIAS, and DNAME are single-value in the form. NS and PTR use the same hostname field but may hold several values. Types without a dedicated editor use Record data, which checks only that the value is nonempty before saving unless a specific lint rule applies.
DNSSEC, service binding, and security records#
| Type | Canonical RDATA | Zone-file example | Release behavior and support |
|---|---|---|---|
| SOA | Primary NS, mailbox, serial, refresh, retry, expire, minimum | @ 3600 IN SOA ns1.example.net. hostmaster.example.com. 1 3600 600 1209600 300 | No destination advertises user-managed SOA. It is hidden from Add record and omitted from managed-zone plans. |
| DS | Key tag, algorithm, digest type, digest | child 300 IN DS 12345 13 2 49FD46E6C4B45C55D4AC0123456789ABCDEF0123456789ABCDEF0123456789AB | 18 destinations. Zone checks validates key-tag, algorithm, digest type, hexadecimal data, and digest length. |
| DNSKEY | Flags, protocol, algorithm, public key | @ 300 IN DNSKEY 257 3 13 BASE64PUBLICKEY | No destination advertises it as user-managed. It is hidden and omitted from plans; supported providers create it when DNSSEC is enabled. |
| HTTPS | Priority, target, service parameters | @ 300 IN HTTPS 1 . alpn="h3,h2" | 24 destinations. The direct editor stores raw Record data and does not parse service parameters. |
| SVCB | Priority, target, service parameters | _dns 300 IN SVCB 1 resolver.example.net. port=853 alpn="dot" | 22 destinations. The direct editor stores raw Record data. |
| TLSA | Usage, selector, matching type, association data | _443._tcp 300 IN TLSA 3 1 1 0C72AC70B745AC19998811B131D662C9AC69DBDBE7CB23E5B514B56664C5D3D6 | 33 destinations. The direct editor does not validate the numeric fields or digest. |
| SSHFP | Algorithm, fingerprint type, fingerprint | host 300 IN SSHFP 4 2 123456789ABCDEF0 | 28 destinations. The direct editor stores raw RDATA. |
| SMIMEA | Usage, selector, matching type, association data | hash._smimecert 300 IN SMIMEA 3 1 1 A1B2C3D4 | AXFR/DDNS, CentralNic, deSEC, Infomaniak, and PowerDNS. |
| CERT | Certificate type, key tag, algorithm, certificate | cert 300 IN CERT PGP 0 0 mQENBFExample | 7 destinations. It uses raw Record data and has no dnsconfig.js record function in this release. |
A DS for this zone belongs at its parent or registrar. An in-zone DS normally accompanies an NS delegation for a child. Use Settings → DNSSEC for provider-managed signing and follow DNSSEC transitions when changing delegation.
Other standard records#
| Type | Canonical RDATA | Zone-file example | Release catalog support |
|---|---|---|---|
| NAPTR | Order, preference, flags, service, regexp, replacement | @ 300 IN NAPTR 100 10 "U" "E2U+sip" "!^.*$!sip:info@example.com!" . | 22 destinations. The direct editor stores raw RDATA. |
| SPF | SPF policy text | @ 300 IN SPF "v=spf1 -all" | 16 destinations. The type is obsolete; publish SPF policy as TXT. The dnsconfig.js runtime does not register an SPF() function. |
| LOC | Latitude, longitude, altitude, size, horizontal precision, vertical precision | office 300 IN LOC 51 30 12.748 N 0 7 39.611 W 0.00m 0.00m 0.00m 0.00m | 9 destinations. Use a LOC builder rather than hand-writing raw data. |
| URI | Priority, weight, absolute URI | _service 300 IN URI 10 1 "https://example.com/" | Cloudflare, AXFR/DDNS, deSEC, PowerDNS, and Realtime Register. It has no dnsconfig.js record function in this release. |
| ALIAS | Target hostname | @ 300 IN ALIAS app.example.net. | 29 destinations. This is a provider-level flattening record, not a standard wire type. |
| DHCID | Base64 identifier | host 300 IN DHCID AAIBY2/AuCccgoJbsaxcQc9TUapptP69lOjxfNuVAA2kjEA= | AXFR/DDNS, CentralNic, deSEC, NS1, and PowerDNS. |
| DNAME | Target hostname | old 300 IN DNAME new.example.net. | 15 destinations. The form allows one target. |
| OPENPGPKEY | Base64 public key | hash._openpgpkey 300 IN OPENPGPKEY mQENBFExample | AXFR/DDNS, deSEC, Gandi, hosting.de, LuaDNS, and PowerDNS. |
| RP | Mailbox name, TXT name | @ 300 IN RP hostmaster.example.com. contact.example.com. | 7 destinations. Both values are DNS names, but the direct editor stores the row as raw data. |
The nine LOC destinations are Cloudflare, Akamai, CentralNic, deSEC, Gandi, Loopia, Oracle Cloud, OVHcloud, and Realtime Register.
Redirect and mail shortcut types#
These are control-plane shortcuts rather than portable DNS wire types. The BIND parser does not accept them as zone-file record types.
| Type | Value in the direct editor | DNSMigrator-style example | Release catalog support |
|---|---|---|---|
| URL | Destination URL | go 300 IN URL https://example.net/ | DNSimple, DNS Made Easy, INWX, Joker, Namecheap, and Realtime Register. |
| URL301 | Destination URL | go 300 IN URL301 https://example.net/ | DNS Made Easy, INWX, and Namecheap. |
| FRAME | Destination URL | go 300 IN FRAME https://example.net/ | DNS Made Easy, INWX, and Namecheap. |
| MXE | Provider mail destination | @ 300 IN MXE mail | Namecheap advertises it, but Add record hides MXE and the dnsconfig.js runtime has no MXE() function. |
When a migration destination lacks the same shortcut, translation marks it as a provider redirect feature instead of inventing equivalent HTTP behavior.
Cloudflare pseudo-records#
The release catalog exposes four Cloudflare-only pseudo-types. They use raw Record data in the editor and are not accepted by the BIND parser.
| Type | Value shape | DNSMigrator-style example |
|---|---|---|
| CF_REDIRECT | Source pattern, destination | @ 300 IN CF_REDIRECT "example.com/*" "https://www.example.com/$1" |
| CF_TEMP_REDIRECT | Source pattern, destination | @ 300 IN CF_TEMP_REDIRECT "example.com/*" "https://status.example.net/$1" |
| CF_SINGLE_REDIRECT | Rule name, HTTP code, expression, target expression | @ 300 IN CF_SINGLE_REDIRECT "to-www" 301 "http.host eq \"example.com\"" "concat(\"https://www.\", http.host)" |
| CF_WORKER_ROUTE | Route pattern, Worker script | @ 300 IN CF_WORKER_ROUTE "example.com/api/*" "api-worker" |
The dnsconfig.js constructor for CF_SINGLE_REDIRECT accepts 301, 302, 303, 307, or 308. Cloudflare proxying is separate: ordinary A, AAAA, and CNAME records use Proxy through Cloudflare metadata.
Akamai, ClouDNS, PowerDNS, and appliance types#
| Type | Value shape | DNSMigrator-style example | Release catalog owner |
|---|---|---|---|
| AKAMAICDN | Edge hostname | www 300 IN AKAMAICDN www.example.com.edgekey.net | Akamai Edge DNS |
| AKAMAITLC | Answer type (DUAL, A, or AAAA) and target | @ 300 IN AKAMAITLC DUAL example.edgesuite.net. | Akamai Edge DNS |
| LUA | Emitted record type and Lua expression | app 300 IN LUA A "ifportup(443, {'192.0.2.1'})" | PowerDNS, not LuaDNS |
| CLOUDNS_WR | Destination URL | go 300 IN CLOUDNS_WR https://example.net/ | ClouDNS |
| ADGUARDHOME_A_PASSTHROUGH | Empty RDATA | host 300 IN ADGUARDHOME_A_PASSTHROUGH | AdGuard Home |
| ADGUARDHOME_AAAA_PASSTHROUGH | Empty RDATA | host 300 IN ADGUARDHOME_AAAA_PASSTHROUGH | AdGuard Home |
| MIKROTIK_FORWARDER | Upstream DNS server addresses | corp 300 IN MIKROTIK_FORWARDER 192.0.2.53,192.0.2.54 | MikroTik |
| MIKROTIK_FWD | Forward-to address | corp 300 IN MIKROTIK_FWD 192.0.2.53 | MikroTik |
| MIKROTIK_NXDOMAIN | Empty RDATA | blocked 300 IN MIKROTIK_NXDOMAIN | MikroTik |
The two AdGuard passthrough types and MIKROTIK_NXDOMAIN require an empty canonical value. The release web save guard rejects empty non-alias values, so they cannot currently be created or imported successfully as managed-zone records.
Alias constructors in dnsconfig.js#
R53_ALIAS and AZURE_ALIAS are constructor names, not canonical record types. The importer converts them to ordinary records with alias metadata:
R53_ALIAS("cdn", "A", "d111111abcdef8.cloudfront.net.", R53_EVALUATE_TARGET_HEALTH(true), R53_ZONE("Z2FDTNDATAQYW2"))
AZURE_ALIAS("app", "A", "/subscriptions/0000/resourceGroups/dns/providers/Microsoft.Network/publicIPAddresses/app")A Route 53 alias stores an allowed Route 53 record type with no ordinary values, plus a DNS target, optional hosted-zone ID, and optional health evaluation. The direct editor exposes aliases only for A and AAAA. An Azure alias stores A, AAAA, or CNAME with a resource ID and is available only by loading dnsconfig.js.
For the exact runtime function list and import losses, see dnsconfig.js import and export. Use the zone file validator for the release BIND parser’s standard-type and directive coverage.