DNS and SRV Records

Parent: MongoDB Atlas AWS Networking · Published reference · snapshot 2026-10-15 · viability 3.60 / 5 (research)

Depth-first rabbithole dossier for DNS and SRV Records; source-anchored research pack.

These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.

Definitions

[medium] The hostname in the SRV record for AWS PrivateLink is a DNS CNAME record that resolves to the endpoint-specific regional DNS name generated by AWS. Sources: https://www.mongodb.com/docs/atlas/troubleshoot-private-endpoints.md, https://www.mongodb.com/docs/atlas/security-private-endpoint.md [source]

Structure and components

[low] If srvAllowedHostsSuffix is configured, it acts as the domainname for DNS validation; otherwise, for hostnames with three or more parts, the left-most part is the subdomain and the remainder is the domainname. Sources: https://github.com/mongodb/specifications/blob/master/source/initial-dns-seedlist-discovery/initial-dns-seedlist-discovery.md [source]

Problems, failure modes and limitations

[high] The srvMaxHosts option limits the number of mongos connections and SRV records used for seedlist population, requires a non-negative integer, defaults to zero (no limit), and is configurable only at the MongoClient level. Sources: https://www.mongodb.com/docs/atlas/manage-connections-aws-lambda.md, https://github.com/mongodb/specifications/blob/master/source/initial-dns-seedlist-discovery/initial-dns-seedlist-discovery.md [source]
[low] Using the default ISP DNS server with the DNS seed list connection string format may cause a 'DNSHostNotFound: Failed to look up service' error because that server might not support SRV record lookups. Separately, the MongoDB Database Tools (mongodump, mongorestore) may report 'cannot unmarshal DNS message' with a mongodb+srv:// string; the source does not give a cause and recommends a non-SRV URI or --host. Sources: https://www.mongodb.com/docs/atlas/troubleshoot-connection.md [source]
[low] A 'querySrv ECONNREFUSED' error during SRV lookup indicates that the DNS resolver does not support SRV records or that outbound DNS traffic is blocked. Sources: https://www.mongodb.com/docs/atlas/troubleshoot-connection.md [source]
[low] If DNS returns no SRV records or a DNS error occurs, the driver must raise an error indicating the URI could not be used to find hostnames, including the reason for failure. Sources: https://github.com/mongodb/specifications/blob/master/source/initial-dns-seedlist-discovery/initial-dns-seedlist-discovery.md [source]
[low] The srvHostValidator option provides an alternative to srvAllowedHostsSuffix for SRV host validation, and an error is raised if both options are present. Sources: https://github.com/mongodb/specifications/blob/master/source/initial-dns-seedlist-discovery/initial-dns-seedlist-discovery.md [source]
[low] Specifying a port or more than one hostname in a mongodb+srv connection string is an error that causes the driver to raise a parse error without performing DNS resolution or contacting hosts. Sources: https://github.com/mongodb/specifications/blob/master/source/initial-dns-seedlist-discovery/initial-dns-seedlist-discovery.md [source]
[low] Leading or trailing dots in srvAllowedHostsSuffix must be stripped (an error is raised if the stripped value is empty), and a dot must be prepended after normalization; an error is raised if the resulting value lacks at least two dot-separated labels, unless it is a single label from a fixed list of reserved or private-use names (test, localhost, invalid, example, local, internal, corp, home, mail). Sources: https://github.com/mongodb/specifications/blob/master/source/initial-dns-seedlist-discovery/initial-dns-seedlist-discovery.md [source]
[low] Private DNS hostnames for a VPC cannot be resolved to private IP addresses if its IPv4 CIDR block falls outside the RFC 1918 private IPv4 address ranges. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html [source]
[low] Users cannot connect to or query the Amazon DNS server in a peer VPC. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html [source]

Comparisons and alternatives

[low] Node.js v24.13.0 on Windows introduced a regression where DNS SRV lookups fail with ECONNREFUSED due to a c-ares change reporting the fallback resolver with port 53 instead of port 0. (verified as of 2026-10-15) Sources: https://github.com/nodejs/node/pull/61453 [source]

Facts and statements

[low] During mongodb+srv preprocessing, the driver queries DNS for SRV records prefixed with the service name (default "mongodb") and protocol, ignoring the priority and weight fields in returned records. Sources: https://github.com/mongodb/specifications/blob/master/source/initial-dns-seedlist-discovery/initial-dns-seedlist-discovery.md [source]
[low] As a second preprocessing step, the client queries DNS for TXT records on the hostname to provide default connection string options, supporting only authSource, replicaSet, and loadBalanced options. Sources: https://github.com/mongodb/specifications/blob/master/source/initial-dns-seedlist-discovery/initial-dns-seedlist-discovery.md [source]
[low] Clients must not check for DNS CNAME records on the hostname during mongodb+srv preprocessing, as transparent CNAME handling by the resolver could break SRV record validation. Sources: https://github.com/mongodb/specifications/blob/master/source/initial-dns-seedlist-discovery/initial-dns-seedlist-discovery.md [source]
[low] A driver requesting the SRV record _mongodb._tcp.server.mongodb.com may return records with TTL, class, priority, weight, port, and target fields, such as port 27317 targeting mongodb1.mongodb.com. Sources: https://github.com/mongodb/specifications/blob/master/source/initial-dns-seedlist-discovery/initial-dns-seedlist-discovery.md [source]
[low] Users affected by the Node.js v24.13.0 DNS SRV regression can work around it by forcing DNS servers like 8.8.8.8 and 1.1.1.1, or by downgrading to v24.11.1, which was the last known good version. (verified as of 2026-10-15) Sources: https://github.com/nodejs/node/pull/61453 [source]
[low] The DNS SRV lookup regression persists in Node.js versions 24.16.0, 26.2.0, and 26.3.1 on Windows 11. (verified as of 2026-10-15) Sources: https://github.com/nodejs/node/pull/61453 [source]
[low] On macOS, dns.resolveSrv returns EBADRESP for all existing SRV records since Node.js v26.6.0, which uses c-ares 1.34.8. (verified as of 2026-10-15) Sources: https://github.com/nodejs/node/pull/61453 [source]
[low] The srvServiceName option specifies a valid SRV service name per RFC 6335, defaults to "mongodb", and is configurable only at the MongoClient level. Sources: https://github.com/mongodb/specifications/blob/master/source/initial-dns-seedlist-discovery/initial-dns-seedlist-discovery.md [source]
[medium] For AWS PrivateLink, a DNS ALIAS record exists for each VPC subnet where the interface endpoint is deployed, containing the private IP address of that interface endpoint. Sources: https://www.mongodb.com/docs/atlas/troubleshoot-private-endpoints.md, https://www.mongodb.com/docs/atlas/security-private-endpoint.md [source]
[low] AWS PrivateLink supports 50 addressable targets, and Atlas uses ports 1024 through 65535, typically starting with port 1024. Sources: https://www.mongodb.com/docs/atlas/security-private-endpoint.md [source]
[low] Azure Private Link supports 150 addressable targets, and Atlas uses ports 1024 through 2524, typically starting with port 1024. Sources: https://www.mongodb.com/docs/atlas/security-private-endpoint.md [source]
[low] The mongodb+srv protocol replaces the comma-separated list of hostnames in a connection string with a single hostname in the format mongodb+srv://{hostname}/{options}. Sources: https://github.com/mongodb/specifications/blob/master/source/initial-dns-seedlist-discovery/initial-dns-seedlist-discovery.md [source]
[low] Using the mongodb+srv protocol implicitly enables TLS, which clients can disable by passing tls=false in the connection string or MongoClient options. Sources: https://github.com/mongodb/specifications/blob/master/source/initial-dns-seedlist-discovery/initial-dns-seedlist-discovery.md [source]
[low] With default VPC peering options, public DNS hostnames resolve to public IP addresses, but after enabling DNS hostname resolution, they resolve to private IP addresses. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html [source]
[low] If all network tests pass but connection errors persist, the issue may be an older driver version that does not correctly support the SRV connection string format. Sources: https://www.mongodb.com/docs/atlas/troubleshoot-connection.md [source]
[low] In AWS PrivateLink, Atlas replica set nodes are accessible via the same hostname, with the load balancer resolving individual nodes by unique ports such as 1024, 1025, and 1026. Sources: https://www.mongodb.com/docs/atlas/troubleshoot-private-endpoints.md [source]

Related concepts

SRV — is a part of DNS and SRV Records
DNS — is a part of DNS and SRV Records
and — is a part of DNS and SRV Records
Records — is a part of DNS and SRV Records

Children

No children recorded.

← the whole tree · 3D view· how to read this page