DNS and domain infrastructure

Article

SPF and DMARC Records for Inactive Domains: What You Need to Know

Don't let your inactive domains become a playground for email scammers! Read on for some nerdy yet essential knowledge!

Article

Unlocking the Secrets of External Domain Verification: The Jedi Way

Protect your brand from phishing and malicious attacks with external domain verification - the Jedi way of email security. Read now!

Article

Understanding the Timeframe of DNS Updates

Discover the factors of DNS and what impacts their duration. Also, ensure the accuracy and security of your website.

Article

What is meant by Organizational Domain?

Understanding Organizational Domain! Read through our definition, get familiar with the concept and how to protect it from online threats.

Guide

Add validation and approval to a DNS change pipeline

Build a DNS pipeline with exact-record differences, mail-aware validation, accountable approval, baseline checks and retained post-change evidence.

Guide

Authoritative and recursive DNS answers compared

Compare authoritative and recursive DNS for email authentication, interpret AA, RD and RA flags, and preserve the evidence behind conflicting answers.

Guide

Back up a DNS zone before an authentication change

Preserve zone data, provider attributes and recovery boundaries before changing SPF, DKIM or DMARC. Separate a backup file from a verified restore.

Guide

CNAME records at the zone apex: check provider-specific behaviour

Distinguish ordinary apex CNAME constraints from supported DNS-provider alias features while preserving email and other zone records.

Guide

Compare answers from multiple authoritative name servers

Compare exact record sets across authoritative servers to distinguish real publication differences from harmless answer ordering.

Guide

Concurrent DNS edits: avoid overwriting another team's changes

Use supported version checks, complete record-set comparisons and scoped recovery to prevent stale DNS edits from erasing another team’s work.

Guide

Dangling DKIM CNAMEs after a supplier is offboarded

Retire supplier-managed DKIM aliases with checks for active selectors, standby rotation, delayed messages, target control and remaining access.

Guide

DNS A and AAAA records in mail-service configuration

Verify every advertised IPv4 and IPv6 mail endpoint and identify SPF dependencies before changing A or AAAA records.

Guide

DNS API credentials: restrict the zones and actions they can reach

Review DNS automation identities by resource scope, permitted actions, inherited access and lifecycle without collecting or testing secrets.

Guide

DNS availability monitoring for authentication-critical records

Monitor the specific DNS dependencies used by authentication and distinguish missing data, wrong data, resolver failure and end-to-end mail failure.

Guide

DNS CAA records: understand their role in certificate issuance

Map CAA issuer authorization to actual certificate workflows, distinguish wildcard rules and renewal risks, and keep certificate governance separate from email authentication.

Guide

DNS cache poisoning and authentication evidence

Investigate suspected DNS cache poisoning with timestamped resolver comparisons, DNSSEC context and competing cache explanations, without attack procedures.

Guide

DNS CNAME records: delegation and conflicts with other record types

Trace CNAME aliases, avoid coexistence conflicts and distinguish selector dependencies from zone delegation and SMTP routing.

Guide

DNS delegation and dangling records: assess takeover exposure

Assess stale DNS dependencies using ownership and provider-protection evidence without confusing outages with proven takeover exposure.

Guide

DNS hijacking and its effect on email trust

Explain how DNS hijacking affects MX routing, SPF, DKIM and DMARC, and define evidence-led containment and recovery without claiming a live incident.

Guide

DNS hosting and email hosting: find the correct control panel

Identify who publishes DNS, hosts mailboxes and signs outbound mail so authentication changes reach the active control panel.

Guide

DNS MX records: mail routing, priorities and dependencies

Understand MX preferences, implicit fallback and null MX while keeping DNS routing, SMTP acceptance and final delivery distinct.

Guide

DNS NS records and subdomain delegation

Plan the correct zone boundary, prepare child authority and verify the referral chain before delegating email-authentication DNS.

Guide

DNS records and owners for email authentication

Identify the DNS names, record types and owners behind SPF, DKIM and DMARC, with a fictional inventory and a proposed publication-evidence checklist.

Guide

DNS resolver differences: investigate inconsistent checker results

Explain inconsistent DNS checker results by matching the question, resolver path, cache state and validation behavior before editing records.

Guide

DNS response truncation and TCP fallback in authentication lookups

Diagnose truncated DNS responses and blocked TCP without confusing transport failure with an absent authentication policy.

Guide

DNS TXT records: quoting, multiple strings and record boundaries

Distinguish TXT character strings from separate records, preserve SPF spaces and verify the exact published owner and value.

Guide

DNS zone transfers: assess exposure without confusing it with email authentication

Assess zone-transfer exposure as a DNS information-disclosure and administration question, without treating it as a direct SPF, DKIM or DMARC verdict.

Guide

DNS-over-HTTPS results and mail-receiver DNS: interpret different observations

Interpret DoH as a DNS transport and resolver choice, not as evidence that an email receiver observed the same answer.

Guide

DNSSEC and email authentication: what signed DNS adds

Validate the DNS chain behind mail dependencies without mistaking signed DNS for message authentication or automatic DANE deployment.

Guide

DNSSEC key rollover during a DNS-provider migration

Plan a DNS-provider move around parent DS, child signing keys and overlapping caches rather than switching name servers and hoping validation follows.

Guide

DNSSEC validation failures and email-authentication outages

Diagnose DNSSEC-related mail failures without treating every SERVFAIL as a broken signature or disabling validation as the default repair.

Guide

Domain Connect: assess automated DNS configuration and approval boundaries

Review Domain Connect template changes, user consent and persistent access as separate approval boundaries before automating authentication DNS.

Guide

Domain registrar and authoritative DNS provider: distinguish their responsibilities

Separate registrar, authoritative DNS and mail responsibilities using scoped RDAP evidence, DNS observations and verified internal owners.

Guide

Expired domains and authentication dependencies

Trace expiring registration dependencies behind SPF, DKIM and DNS delegation, then plan scoped recovery or retirement using provider-specific evidence.

Guide

Flushing a local DNS cache and its limits

Learn what a Windows DNS cache flush changes, how to preserve a baseline and why recursive resolvers and remote email receivers can still disagree.

Guide

Forward-confirmed reverse DNS: verify both lookup directions

Check reverse and forward DNS with full address-set membership, normalized IPv6 values and distinct timeout or mismatch outcomes.

Guide

Internationalised domain names and punycode in DNS checks

Compare internationalised domain labels in their Unicode and validated ASCII forms before running DNS and authentication checks.

Guide

Investigate missing parent delegation and glue-record warnings

Investigate delegation and glue warnings by following the parent-to-child resolution path, then connect any actual failure to the affected mail dependencies.

Guide

Maintain a dependency map for mail authentication and transport

Map SPF, DKIM, DMARC, MTA-STS, DANE and TLS reporting dependencies with owners, evidence dates and change triggers before approving mail changes.

Guide

Manage authentication DNS with infrastructure as code

Build a controlled Terraform workflow for authentication DNS with exact ownership, reviewed plans, protected state, recovery material and post-change evidence.

Guide

Map NIST DNS guidance to authentication dependencies

Map current NIST DNS guidance to authoritative services, caching, change paths and authentication dependencies without claiming unperformed control tests.

Guide

Move authoritative DNS without dropping authentication records

Move DNS authority with a verified record inventory, a coordinated DNSSEC plan and an overlap period that protects mail dependencies.

Guide

Negative DNS caching after publishing a new record

Diagnose a new DKIM record hidden by negative caching, calculate the SOA-based lifetime correctly and separate cached absence from resolution failures.

Guide

Null MX records for domains that do not accept email

Distinguish Null MX from absent MX, inventory receiving needs and separately review sending controls before changing a domain.

Guide

Plan DNS TTL changes without a fixed propagation promise

Plan SPF and DKIM DNS changes with realistic TTL expectations, old-cache arithmetic, negative-cache caveats and a proposed resolver comparison workflow.

Guide

Protect DNS administration with scoped access and change approval

Align effective DNS permissions, record-level change previews and accountable approval without confusing locks with immutable records.

Guide

Protect registrar access and domain-renewal ownership

Assign accountable registration, renewal and recovery owners without confusing DNS or mailbox subscriptions with domain-registration continuity.

Guide

Publish authentication records without duplicating the domain suffix

Translate a complete authentication-record owner into the DNS editor’s supported input, then verify that publication did not duplicate the zone suffix.

Guide

Restore authentication records after a DNS rollback

Recover authentication DNS by reconciling the rollback snapshot with current sender dependencies instead of blindly restoring an old zone.

Guide

Reverse DNS and PTR records for sending infrastructure

Trace PTR authority from the observed public sending IP, verify reverse and forward data and keep authentication conclusions separate.

Guide

Separate mail-impacting DNS failures from advisory warnings

Triage DNS health warnings by exact record, active mail route, response type and evidence confidence, separating current failures from advisory findings.

Guide

SOA records, serial numbers and inconsistent name-server answers

Distinguish authoritative version differences from cached DNS answers, interpret SOA fields and serial arithmetic, and build a reproducible incident record.

Guide

Split-horizon DNS: compare internal and public authentication records

Distinguish private DNS views, public authority and caches when an internal authentication lookup succeeds but external mail fails.

Guide

TLSA records: publish the information DANE actually requires

Build a TLSA record from the actual SMTP service key and verify the DNSSEC and rollover conditions that make it useful.

Guide

Troubleshoot NXDOMAIN, NODATA and SERVFAIL

Distinguish NXDOMAIN, NODATA, SERVFAIL, referrals and timeouts in SPF and DKIM troubleshooting, with a proposed evidence-led diagnostic decision sequence.

Guide

TXT record-length and label-length errors in DNS control panels

Diagnose DNS label, wire-name and TXT string limits while preserving SPF record boundaries and DKIM key bytes.

Guide

Use dig to inspect authentication records and delegation

Use explicit dig queries to compare authentication records, server responses and delegation. Preserve evidence without confusing lookup success with mail success.

Guide

Verify authentication records with Windows nslookup

Inspect SPF, DKIM and DMARC dependencies with Windows nslookup. Use explicit questions and preserve response context for a useful support handoff.

Guide

Why a DNS editor's display may differ from the published record

Distinguish TXT string chunks, record boundaries, quoting and cached answers before treating a DNS editor’s display as a publication error.

Guide

Wildcard MX and unexpected mail routes

Use existing names and closest-encloser examples to explain wildcard MX, then verify DNS routing separately from mailbox acceptance.

Step-by-step SPF, DKIM and DMARC setup for every email platform, CRM, marketing tool and help desk that sends as your domain.

49 guides

Publish DMARC, SPF and DKIM records at your DNS host, with the exact screens and fields to use.

23 guides