Guides

DNS and email security, briefly explained

The terms from your audit report in plain language: what they do and how to set them up.

• DNS What is DNS? DNS is the phone book of the internet: it translates a domain name into a server's address. In plain language: what DNS is, how a lookup works, what nameservers and TTL are, and why a change isn't visible everywhere right away.
• RECORDS DNS record types An overview of the DNS records you'll meet most often: A, AAAA, CNAME, MX, TXT, NS and SOA. For each, in plain language: what it does, what you use it for, and an example.
• SPF What is SPF? SPF declares which servers may send email for your domain, so receivers can block fake mail. In plain language: what it is, what an SPF record looks like, the 10-lookup limit, and how to set it up and check it.
• DKIM What is DKIM? DKIM digitally signs your outgoing email so receivers can verify the message wasn't altered in transit. What it is, record anatomy, keys, and how to check it.
• DMARC What is DMARC? DMARC tells receivers what to do with mail that fails SPF/DKIM, and sends you reports. Understanding policy, alignment and growing safely to p=reject.
• DNSSEC What is DNSSEC? DNSSEC signs your DNS answers so resolvers can detect tampering. Understanding the chain of trust, DS/DNSKEY records, risks, and how to check it.
• CAA What is CAA? A CAA record declares which certificate authorities (CAs) may issue a TLS certificate for your domain. In plain language: what it does, what the record looks like, and how it prevents abuse.
• MTA-STS What is MTA-STS? MTA-STS forces other mail servers to deliver mail to you only over encryption and only to the right server. With TLS-RPT you get reports when that fails. Explained in plain language.
• TLSA / DANE What is DANE (TLSA)? With DANE you declare in DNS which TLS certificate is valid for your server. Especially useful for mail. It requires DNSSEC. In plain language: what it does, how the TLSA record works, and what to watch for.
• BIMI What is BIMI? With BIMI your logo appears next to your emails in the inbox. It requires a strict DMARC policy. In plain language: what it does, what you need for it, and what a VMC is.
• WHOIS What is WHOIS (RDAP)? WHOIS (and its modern successor RDAP) shows who registered a domain, at which registrar, and when it expires. In plain language: what it is, what you get from it, and why contact details are often hidden.
• BLACKLIST What is a blacklist (DNSBL)? A blacklist (DNSBL) is a list of IP addresses known for spam. If your mail server is on one, your mail can be refused. In plain language: how it works, why you can end up on one, and how to get off.
• PTR What is reverse DNS (PTR)? Reverse DNS links an IP address back to a name, via a PTR record. For mail servers it's important for your deliverability. Explained in plain language: what it is and why it matters.
• SSL / TLS What is an SSL/TLS certificate? An SSL/TLS certificate gives you the padlock in the browser: an encrypted, verified connection. In plain language: what it is, how it works, what a CA and CT logs are, and what to watch for.