Knowledge base
DNS and email authentication
Understand DNS records, verify changes and protect your sending domain.
Search all articlesFind the right place to edit your DNS records
Check parent delegation and each assigned nameserver to find the live DNS provider before editing web or mail records.
Read the guide →DNS and email authenticationSet up SPF without blocking legitimate email
Inventory real senders, publish one SPF policy for the envelope domain and check headers for SPF and DMARC alignment.
Read the guide →DNS and email authenticationSet up DKIM and verify a signed message
Publish the sender's DKIM selector at the authoritative DNS provider and verify a fresh signed message.
Read the guide →DNS and email authenticationIntroduce DMARC without disrupting legitimate mail
Start DMARC reporting, fix SPF or DKIM alignment for legitimate mail and assess enforcement using representative evidence.
Read the guide →DNS and email authenticationCheck a DNS change while caches expire
Compare authoritative and cached DNS answers, read TTLs and decide whether to repair the zone or wait for old caches.
Read the guide →DNS and email authenticationDiagnose a website that works on IPv4 but fails on IPv6
Find a stale AAAA record, test the site's IPv6 path and correct the assigned web target without disturbing IPv4.
Read the guide →DNS and email authenticationChange MX records without losing incoming mail
Prepare the new mail destination, change MX with an overlap plan and verify real inbound and outbound messages.
Read the guide →DNS and email authenticationDiagnose SERVFAIL after a nameserver change
Compare authoritative and validating DNS answers after a nameserver change; investigate stale DS and other causes of SERVFAIL.
Read the guide →DNS and email authenticationCheck CAA records when a certificate authority cannot issue
Trace CAA from the requested certificate name to applicable parents and check the approved issuer before changing policy.
Read the guide →DNS and email authenticationPoint a website to new hosting without disrupting mail
Check MX targets, fallback mail routing and SPF dependencies before pointing a website at new hosting.
Read the guide →DNS and email authenticationCorrect www when the root domain works
Diagnose the separate www DNS answer, host binding, redirect and TLS certificate when the root site works.
Read the guide →DNS and email authenticationMove authoritative DNS while preserving every needed record
Inventory web, mail, verification and DNSSEC records; test the new zone before changing registrar nameservers.
Read the guide →DNS and email authenticationTrace a subdomain that does not resolve
Identify the subdomain's real authority and distinguish NXDOMAIN, absent address data and broken child delegation.
Read the guide →DNS and email authenticationUnderstand CNAME and apex record choices
Choose A, AAAA, CNAME or a supported apex alias from the web provider's target and existing DNS records.
Read the guide →DNS and email authenticationVerify Search Console domain ownership without replacing existing DNS records
Check Domain property scope across subdomains, then publish Google's exact DNS token at the authoritative provider.
Read the guide →DNS and email authenticationCheck why wildcard DNS does not cover an existing subdomain
Compare exact names, closer ancestors and wildcard answers before adding a record for a missing subdomain address.
Read the guide →DNS and email authenticationCheck a VPS reverse DNS (PTR) record before sending mail
Identify the real outbound IP, compare its PTR with forward DNS and ask the address operator to correct mismatches.
Read the guide →DNS and email authenticationCheck whether DNSSEC works for your domain with dig
Use dig to distinguish a signed zone from a validated DNSSEC chain, compare DS and DNSKEY, and investigate SERVFAIL without changing live DNS blindly.
Read the guide →