What does @ mean in a DNS zone file?

In a DNS master file, @ expands to the current $ORIGIN. Learn how that differs from an apex shortcut in a DNS control panel.

Guance Editorial Team 3 min read Updated 2026-10-19

Best practices

In a DNS zone file, @ stands for the current origin, set by $ORIGIN or the zone-loading context. It often represents the zone apex, but that is not its universal meaning: changing $ORIGIN changes what @ expands to.

With $ORIGIN example.com., these owner names are equivalent:

@             IN A 192.0.2.1
example.com.  IN A 192.0.2.1

Read a zone-file example

This illustrative zone uses documentation addresses. Replace the names, addresses, and operational timing choices before deployment:

$ORIGIN example.com.
$TTL 3600
@ IN SOA ns1.example.com. admin.example.com. (
    2026101901 3600 900 1209600 300
)
@     IN NS ns1.example.com.
@     IN NS ns2.example.com.
@     IN A 192.0.2.1
@     IN MX 10 mail.example.com.
www   IN A 192.0.2.1
mail  IN A 192.0.2.25
ns1   IN A 192.0.2.53
ns2   IN A 192.0.2.54

Here, the SOA, NS, A, and MX owner is example.com. The relative owner www becomes www.example.com. The SOA's admin.example.com. field encodes the responsible mailbox, admin@example.com; it is not another use of an @ owner token.

If a later directive says $ORIGIN sub.example.com., a subsequent @ means sub.example.com, while www means www.sub.example.com.

Keep the trailing dot on absolute names

A trailing dot makes a name absolute. Without it, the origin is appended in places where the master-file syntax expects a domain name. Under example.com., an owner written as example.com can therefore expand to example.com.example.com..

The same issue affects domain-name data such as MX and NS targets. It does not mean every field in every record is a domain name; TXT content, for example, follows its own syntax.

DNS control panels are a separate interface

Name field	Common meaning when editing example.com
`@`	The apex, `example.com`
`www`	`www.example.com`
`*`	A wildcard owner, subject to DNS wildcard rules
Empty	Often the apex, depending on the provider

Check the provider's instructions. Some interfaces append the zone automatically, others accept complete names, and some use a blank field instead of @. A control-panel convention does not change the underlying master-file rules.

$TTL supplies the default TTL for records without an explicit one. * is a wildcard label with closest-encloser and delegation constraints; it is not an unconditional match for every missing name.

Common questions

Are @ and www interchangeable? No. With the origin at the apex, they represent two different names. Configure both if both should resolve. A www CNAME to the apex is a common arrangement; a standard CNAME at the apex itself conflicts with required SOA and NS records.

Is CNAME forbidden wherever @ appears? No. The conflict is about other records at the expanded owner name, not the character @. If the origin is changed to a suitable non-apex name, that name can have a CNAME subject to normal constraints.

Does an alias redirect the browser? No. DNS resolves names; an HTTP redirect is a separate response from a web service.