DTD
W3C / SGML standard
A Document Type Definition, or DTD, is a set of markup declarations that defines the legal structure, elements, and attributes allowed in an XML or SGML document, letting a parser validate that a document conforms to an expected format…
Definition
A Document Type Definition, or DTD, is a set of markup declarations that defines the legal structure, elements, and attributes allowed in an XML or SGML document, letting a parser validate that a document conforms to an expected format before an application processes it. DTDs predate XML itself, originating in SGML, and remain one of several schema languages usable to constrain XML document structure.
Overview
DTDs were created within SGML, the markup metalanguage that XML was later derived from, to solve the problem of specifying exactly which elements, attributes, and nesting structures are allowed in a class of documents, so that both document authors and processing software share a single, checkable definition of valid structure. When XML was standardized as a simpler subset of SGML, it inherited DTD syntax largely unchanged, giving early XML documents a validation mechanism from the very start, before more expressive alternatives like XML Schema were developed. Mechanically, a DTD declares elements using a compact, non-XML syntax: an element declaration specifies its name and a content model describing what child elements or text it may contain and in what order or combination, while attribute-list declarations specify which attributes an element may carry, their allowed value types, and whether they are required, optional, or fixed to a specific value. A DTD can be included inline within a document via a DOCTYPE declaration or referenced externally as a separate file, and an XML parser operating in validating mode checks the document against these declarations, rejecting any structure that violates them. Among XML schema languages, DTDs are the oldest and least expressive: they lack native support for datatypes beyond basic string-like content, cannot express namespaces cleanly since DTD syntax predates XML namespaces, and cannot use XML syntax for the schema definition itself, unlike XML Schema (XSD) or RELAX NG, both of which were developed later specifically to address these gaps. Despite these limitations, DTDs remain simpler to read and write for straightforward document structures than the more verbose XSD syntax. In practice, DTDs are still found in older document formats and specifications that predate widespread XSD adoption, such as certain HTML doctype declarations, legacy publishing and technical documentation formats, and some configuration file formats that adopted XML with a DTD before XML Schema became common. Many modern XML-based systems have migrated to XML Schema or RELAX NG for new work, reserving DTDs mainly for maintaining legacy documents or formats that never moved away from them. The trade-offs are DTD's limited expressiveness around data types and namespaces, its non-XML declaration syntax that requires learning a separate notation from the documents it validates, and security concerns around external DTD references, which historically enabled entity-expansion and server-side request forgery attacks in XML parsers configured to resolve external DTDs by default. Because of these risks, many modern XML processing libraries disable external DTD resolution by default, and teams designing new XML formats generally choose XML Schema or RELAX NG over a DTD for anything beyond the simplest legacy compatibility needs.
Key Concepts
- Declares legal elements, attributes, and content models for XML/SGML documents
- Uses a compact, non-XML declaration syntax inherited from SGML
- Can be embedded inline via DOCTYPE or referenced as an external file
- Validates document structure before an application processes the content
- Predates and coexists with newer schema languages like XSD and RELAX NG
- Supports required, optional, and fixed-value attribute declarations
- Lacks native support for rich datatypes beyond basic string content
- Historically associated with external-entity security vulnerabilities