DNS Records & Email Security

A DNS record is a single entry in a domain’s zone that answers a particular kind of query. Each has a name, a type (which decides what the value means), and a value. Setting up a domain is largely a matter of creating the right records.

A / AAAA

Name → IPv4 / IPv6 address.

CNAME

An alias pointing one name at another.

MX

Which mail servers receive email for the domain.

NS

Which name servers are authoritative for the domain.

TXT

Arbitrary text — used for verification and email security.

The workhorses. An A record maps a name to an IPv4 address; an AAAA record maps it to an IPv6 address. When you point a domain at a server, you are creating an A/AAAA record.

A CNAME makes one name an alias of another. For example, www.example.com as a CNAME to example.com means both resolve to the same place — change the target once and everything follows.

An MX (Mail Exchange) record tells other mail servers where to deliver email for your domain. Each MX has a priority; lower numbers are tried first, so you can list backups. Without a correct MX, your domain simply cannot receive mail.

SPF (Sender Policy Framework) is a TXT record listing which servers are allowed to send email for your domain. A receiving server checks whether the mail came from an authorized IP; if not, it is likely spoofed and can be rejected. This is the first line of defence against forged senders.

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each outgoing email. The receiver fetches the sender’s public key from a TXT record and verifies the signature — proving the message really came from the domain and was not altered in transit.

DMARC ties SPF and DKIM together and tells receivers what to do when checks fail — do nothing, quarantine (spam folder), or reject outright. It also asks receivers to report abuse back to you. Together, SPF + DKIM + DMARC are why modern email spoofing is hard.