Why DNS Security Matters
DNS is the phone book of the internet. It turns your domain name into an address. It also tells the world who may send mail for your domain and who may make certificates for it. Four small records decide that. Most domains have none of them, because nobody adds them by default. This page says what each one does, what goes wrong without it, and the exact record to add.
SPF and DMARC: who may send mail as you
Mail has no built-in proof of who sent it. Anyone can write your address in the From line. SPF and DMARC are two DNS records that fix this.
- SPF lists the servers that may send mail for your domain. A mail server that gets a message checks the list.
- DMARC says what to do when a message fails that check: do nothing, put it in spam, or reject it. It also tells receivers to compare the From line with the check, which SPF alone does not.
Without them, a scammer can send "pay this invoice" from your address to your clients, and the mail arrives. Gmail and Outlook now also push mail from domains without these records into spam, so your own mail suffers too. This is the most common real-world harm on this page, and the cheapest to fix.
If your domain sends no mail, two records close the door:
@ TXT "v=spf1 -all" _dmarc TXT "v=DMARC1; p=reject; adkim=s; aspf=s"
If your domain does send mail (Google Workspace, Microsoft 365, a newsletter tool), put the sender's include in the SPF record and start DMARC in monitor mode, then move to reject once the reports look clean:
@ TXT "v=spf1 include:_spf.google.com -all" _dmarc TXT "v=DMARC1; p=none; rua=mailto:[email protected]"
Your mail provider gives you its include line and a DKIM record. DKIM signs each message, and it is what lets DMARC pass for mail sent through a third party. Set all three.
CAA: who may issue your certificate
About 150 companies can issue the certificate that puts the padlock on your site. By default every one of them may issue one for your domain. A CAA record names the ones you allow. If one of the others is tricked into issuing a certificate for your domain, the record stops it.
Add one row per certificate authority you use. Behind Cloudflare, allow the ones Cloudflare and your host use for renewals. Example rows:
@ CAA 0 issue "pki.goog" @ CAA 0 issue "letsencrypt.org"
One warning: a CAA record that leaves out the authority your host uses blocks the next renewal, and the site goes down when the certificate expires. Check the issuer of your current certificate before you add the record, and list every authority in the chain between you and your visitors.
DNSSEC: signed answers
DNS answers travel unsigned. A device on the path can answer "your site lives here" with a fake address, and a visitor lands on a copy of your site. DNSSEC signs the answers, so a resolver can tell a real one from a fake one.
At Cloudflare this is one button: DNS, then DNSSEC, then Enable. If your domain is registered somewhere else, Cloudflare shows a DS record, which you paste at the registrar the same day. Half-done DNSSEC (enabled on one side only) breaks the domain, so finish both steps in one sitting.
How the scanner grades this
DNS Security is 20% of the score. A domain with no DMARC policy is capped at a B, whatever the rest of the page does, because anyone can send mail as that domain. The scanner also checks HTTPS, TLS versions, headers and the page itself; see the feature list.
The ten-minute checklist
- Add the SPF and DMARC records for your case (no mail, or your provider's include).
- Add your provider's DKIM record if you send mail.
- Enable DNSSEC, and paste the DS record at your registrar if asked.
- Check the issuer of your certificate, then add CAA rows for every authority you use.
- Run the scanner again.