Your domain's DNS records do more than point browsers to your website. They also control how email sent as your domain is authenticated, whether your SSL certificate can be issued and renewed automatically, and whether other services can be authorised to act on behalf of your domain. A five-minute DNS check can surface gaps that have real consequences for email deliverability, security, and trust.
SPF, DMARC, CAA, and DNSSEC basics
SPF (Sender Policy Framework) is a TXT record that lists every mail server permitted to send email as your domain. If you have recently added a new email service — a CRM, a booking tool, or a newsletter platform — and not updated your SPF record, legitimate email from that service may fail authentication checks and land in spam. Use MXToolbox to view your current SPF record and confirm that every service you use for email is included.
DMARC is a TXT record that tells receiving mail servers what to do when an email fails SPF or DKIM authentication. A DMARC record set to p=none sends you reports but does not affect delivery. Starting with p=none and reviewing reports before moving to p=quarantine or p=reject is the recommended approach for most small businesses.
CAA (Certification Authority Authorisation) is a DNS record that specifies which certificate authorities are permitted to issue SSL certificates for your domain. It is optional but adds a layer of protection against certificate mis-issuance. If you use Let's Encrypt, your CAA record would include letsencrypt.org. Without a CAA record, any certificate authority can issue a certificate for your domain.
DNSSEC (Domain Name System Security Extensions) adds cryptographic signing to DNS responses, preventing DNS spoofing attacks where an attacker intercepts DNS queries and returns false results. Implementation requires support from both your domain registrar and your DNS provider. It is more complex to set up than other records, but worth considering for businesses that handle sensitive data.
Why DNS changes should be staged
DNS changes have a propagation delay — the time it takes for updated records to be visible across the internet's DNS infrastructure. The TTL (Time to Live) value on each record determines how long it is cached. A record with a TTL of 3600 seconds may take up to an hour to update globally after you make a change.
Changes to SPF or DMARC records can affect email delivery immediately for some recipients while others continue seeing the old record. Changes to MX records (which direct incoming email to your mail servers) require extra care — if done incorrectly, incoming email can be lost or directed to the wrong server. Always test critical DNS changes with a staging domain or in a low-traffic window, and use tools like dnschecker.org to confirm that changes have propagated before considering the task complete.
How to keep a record of what changed
DNS changes are easy to forget. A record added by a developer eighteen months ago to verify a third-party service may no longer be needed — or may be the one thing keeping an important email integration working. Keeping a simple log of every DNS change — date, who made it, what was changed and why, and what the old value was — saves significant time when troubleshooting email or SSL issues months later.
- Run an SPF check at mxtoolbox.com/spf.aspx — confirm all your sending services are included.
- Check for a DMARC record at mxtoolbox.com/dmarc.aspx — if none, add one at p=none first.
- Use dnschecker.org to verify that your current DNS records match what you expect.
- Check your SSL certificate status and expiry at ssllabs.com/ssltest.
- Lower TTL values before a planned DNS change — makes propagation faster.
- Keep a dated log of all DNS changes in a simple document or spreadsheet.
DNS tells mail providers, browsers, and services how to trust your domain.
Open the free cyber tools hub