Inspectors

DNS Record Explainer

Paste DNS zone file records and get a plain-English explanation of each one. The tool parses all common record types — A, AAAA, CNAME, MX, TXT, SRV, NS, SOA, CAA, and PTR — and explains what each record does, what its fields mean, and flags potential issues like missing SPF, DKIM, or DMARC records. Handles BIND zone file syntax including comments and $ORIGIN directives.

DNS Record Explainer — Parse and explain DNS zone file records — A, AAAA, CNAME, MX, TXT, SRV, NS, SOA, CAA, PTR with security checks

What it does

  • ▸Parses A, AAAA, CNAME, MX, TXT, SRV, NS, SOA, CAA, and PTR records
  • ▸Explains each record type in plain English
  • ▸Breaks down record fields (e.g., MX priority and exchange, SRV weight and port)
  • ▸Flags missing security records (SPF, DKIM, DMARC in TXT records)
  • ▸Checks CAA records for CA authorization restrictions
  • ▸Handles BIND zone file syntax: comments (;), $ORIGIN, $TTL directives

Use cases

  • ▸Understanding a DNS zone file from a BIND config or DNS export
  • ▸Checking if a domain has proper SPF, DKIM, and DMARC records for email security
  • ▸Verifying CAA records to control which CAs can issue certificates
  • ▸Debugging DNS configuration issues by understanding what each record does

How it works

1

Paste your DNS zone file records into the input pane

2

The tool parses each line, identifying the record type and fields

3

Each record is explained in plain English with its components broken down

4

Security warnings are shown for missing or misconfigured records

Frequently asked questions

1What are SPF, DKIM, and DMARC?

SPF (Sender Policy Framework) is a TXT record that lists which servers are allowed to send email for your domain. DKIM (DomainKeys Identified Mail) adds a digital signature to emails. DMARC tells receiving servers what to do if SPF or DKIM checks fail. All three are TXT records that improve email deliverability and prevent spoofing.

2What's a CAA record and why does it matter?

CAA (Certification Authority Authorization) restricts which certificate authorities (CAs) are allowed to issue TLS certificates for your domain. Without a CAA record, any CA can issue a certificate. With one, only the specified CAs can. This reduces the risk of unauthorized certificate issuance.

3Does it query live DNS records?

No. The tool parses zone file text that you paste in. It doesn't make DNS queries. To get live records, use dig or nslookup, then paste the output here for explanation.

Related tools

CIDR / Subnet Calculator — Expand an IPv4 CIDR block: network, broadcast, mask, host range

CIDR / Subnet Calculator

Expand an IPv4 CIDR block: network, broadcast, mask, host range

HTTP Header Analyzer — Parse HTTP headers, explain their purpose, and flag missing security headers

HTTP Header Analyzer

Parse HTTP headers, explain their purpose, and flag missing security headers

Certificate Decoder (X.509) — Decode a PEM certificate — subject, issuer, validity, SANs, fingerprints

Certificate Decoder (X.509)

Decode a PEM certificate — subject, issuer, validity, SANs, fingerprints

Data / IOC Extractor — Pull emails, URLs, IPs, domains, hashes, UUIDs and MACs out of any text

Data / IOC Extractor

Pull emails, URLs, IPs, domains, hashes, UUIDs and MACs out of any text

Use DNS Record Explainer offline in Devinity

All 95 tools run locally on your Mac. No internet required, no data sent to servers.

Download Devinity →