SIP SRV Records: DNS Setup for 3 Transport Types

SIP SRV records let phones, PBXs and trunk providers find your SIP server by domain name alone, and they give you failover between servers without touching a single phone. RFC 3263 defines the lookup: a client resolving sip:example.com first asks for NAPTR records to choose a transport, then for SRV records to get host and port, and finally for the A or AAAA address. This guide shows the records to publish and how to check them.

Short answer: Publish one SRV record per transport, _sip._udp, _sip._tcp and _sips._tcp, each pointing to an A/AAAA hostname (not a CNAME) with the right port: 5060 for UDP and TCP, 5061 for TLS. Use lower priority numbers for the primary server and a higher number for the backup, and weight to split load between servers of equal priority. Add NAPTR records if clients should prefer TLS, then verify with dig SRV _sip._udp.example.com.

Record format

An SRV record has four values after the type: priority, weight, port and target host.

; name                          TTL   class type priority weight port target
_sip._udp.example.com.          3600  IN    SRV  10       60     5060 sip1.example.com.
_sip._udp.example.com.          3600  IN    SRV  10       40     5060 sip2.example.com.
_sip._udp.example.com.          3600  IN    SRV  20       0      5060 sip-dr.example.com.
_sip._tcp.example.com.          3600  IN    SRV  10       0      5060 sip1.example.com.
_sips._tcp.example.com.         3600  IN    SRV  10       0      5061 sip1.example.com.
sip1.example.com.               3600  IN    A    203.0.113.10
sip2.example.com.               3600  IN    A    203.0.113.11
sip-dr.example.com.             3600  IN    A    198.51.100.20

Clients always try the lowest priority first. Within the same priority, weight sets the share of traffic, so the example sends about 60% to sip1 and 40% to sip2, and only uses sip-dr if both fail.

NAPTR records for transport choice

NAPTR records tell clients which transports exist and which to prefer. Lower order values win. This set prefers TLS, then TCP, then UDP:

example.com. 3600 IN NAPTR 10 50 "s" "SIPS+D2T" "" _sips._tcp.example.com.
example.com. 3600 IN NAPTR 20 50 "s" "SIP+D2T"  "" _sip._tcp.example.com.
example.com. 3600 IN NAPTR 30 50 "s" "SIP+D2U"  "" _sip._udp.example.com.

NAPTR is optional. Without it, clients fall back to querying the SRV names directly, usually trying UDP first.

Create them at your DNS host

In Cloudflare, cPanel Zone Editor or DirectAdmin DNS management choose type SRV and fill in the service (_sip), protocol (_udp, _tcp), priority, weight, port and target as separate fields. Keep the SIP host records DNS-only in Cloudflare; the orange-cloud proxy only handles web traffic and will break SIP if applied to the target hostname.

Test the lookup

dig +short NAPTR example.com
dig +short SRV _sip._udp.example.com
dig +short SRV _sips._tcp.example.com
dig +short A sip1.example.com
openssl s_client -connect sip1.example.com:5061 -servername sip1.example.com </dev/null | openssl x509 -noout -subject -dates

The TLS certificate on 5061 must match the domain the clients use, otherwise TLS phones refuse to register. You can run the same checks in one go with the free SIP SRV checker on srvScripts.

Common mistakes

• Pointing an SRV target at a CNAME, which RFC 2782 forbids and some clients reject.
• Leaving a trailing dot off the target in zone files, which appends the zone name twice.
• Configuring the trunk with a hostname plus explicit port, which skips the SRV lookup entirely; enter the domain alone if you want SRV-based failover.
• Very long TTLs that slow down failover changes; 300 to 3600 seconds is a sensible range.

SIP SRV records at a glance

Official documentation: RFC 3263: locating SIP servers, RFC 2782: DNS SRV, Cloudflare DNS record types.

Related guides: SIP ports firewall rules · Disable SIP ALG · Migrate PBX to cloud.

Frequently asked questions