Guides
DNS and email security, briefly explained
The terms from your audit report in plain language: what they do and how to set them up.
DNS, web and certificates
- DNS What is DNS? DNS is the phone book of the internet: it translates a domain name into a server's address. How a lookup works, and what nameservers and TTL are.
- RECORDS DNS record types The DNS records you'll meet most often: A, AAAA, CNAME, MX, TXT, NS and SOA. For each: what it does, what you use it for, and an example.
- DNSSEC What is DNSSEC? DNSSEC signs your DNS answers so resolvers can detect tampering. Understanding the chain of trust, DS/DNSKEY records, risks, and how to check it.
- CAA What is CAA? CAA publishes intended issuer names for new certificates. Learn its DNS walk, wildcard and email rules, CA-dependent parameters, and scan limits.
- HTTPS / SVCB What is an HTTPS/SVCB record? An HTTPS record can tell supporting HTTP clients about endpoints and parameters such as ALPN, address hints and ECH before they connect.
- TLSA / DANE What is DANE (TLSA)? With DANE you declare in DNS which TLS certificate is valid for your server. Especially useful for mail, and it requires DNSSEC. How the TLSA record works.
- SSL / TLS What is an SSL/TLS certificate? An SSL/TLS certificate gives you the padlock in the browser: an encrypted, verified connection. How it works, and what a CA and CT logs are.
Email security and deliverability
- SPF What is SPF? SPF declares which servers may send email for your domain. What an SPF record looks like, the 10-lookup limit, and how to set it up and check it.
- DKIM What is DKIM? DKIM digitally signs your outgoing email so receivers can verify the message wasn't altered in transit. What it is, record anatomy, keys, and how to check it.
- DMARC What is DMARC? DMARC tells receivers what to do with mail that fails SPF/DKIM, and sends you reports. Understanding policy, alignment and growing safely to p=reject.
- MTA-STS What is MTA-STS? After discovering an enforce policy, MTA-STS lets supporting senders deliver only securely to the right mail server. TLS-RPT can report TLS problems.
- BIMI What is BIMI? With BIMI your logo can appear next to your emails in the inbox. It requires a strict DMARC policy. What you need for it, and what a VMC is.
- BLACKLIST What is a blacklist (DNSBL)? A blacklist (DNSBL) is a list of IP addresses known for spam. If your server is on one, your mail can be refused. And how to get off again.
- PTR What is reverse DNS (PTR)? Reverse DNS links an IP address back to a name, via a PTR record. For mail servers it matters for deliverability. What it is and why it counts.