Add a provider's DNS verification record and remove it only when appropriate Providers commonly ask you to add a TXT or CNAME record to demonstrate control of a domain. Verification records should come from the exact service…

Check DNS over TCP when large or signed answers fail DNS needs TCP as well as UDP for reliable operation. Larger answers, including some signed responses, may require TCP fallback. Allowing only UDP port…

Check forward-confirmed reverse DNS for a mail server address Forward-confirmed reverse DNS means that a sending IP resolves through PTR to a hostname and that hostname resolves back to the sending IP. Mail…

Choose an address that public DNS users can actually reach An A or AAAA record can be syntactically valid while pointing to an address that public visitors cannot reach. Use the public endpoint allocated for the…

Coordinate a DNSSEC key rollover with the registrar's DS update A DNSSEC key rollover replaces signing keys while allowing cached trust information to remain valid during the transition. A KSK or combined signing key…

Delegate a subdomain to another authoritative DNS provider Delegating a subdomain lets another DNS service manage a branch such as shop.example.com while the main domain stays with its current provider. This is…

Delegate certificate DNS validation without exposing the main zone credential DNS-01 certificate validation proves control through a TXT record at an _acme-challenge name. A supported CNAME or NS delegation can move that challenge…

Diagnose DNSSEC validation failures that appear as SERVFAIL DNSSEC validation can turn an otherwise visible DNS answer into SERVFAIL when the chain of trust is broken. A stale parent DS record, missing DNSKEY,…

Diagnose a listed nameserver that does not serve the delegated zone A delegation is lame when a nameserver listed for a zone cannot provide the expected authoritative service for that zone. Symptoms can be intermittent…

Diagnose a website that fails only over IPv6 after an AAAA change An incorrect AAAA record can send IPv6-capable visitors to an unavailable server while IPv4 visitors continue to work. Diagnose the address family…

Diagnose different internal and public DNS answers for one hostname Split DNS intentionally gives different answers to different networks or clients. An internal user may receive a private server address while a public…

Find a CNAME loop or an alias chain that points to an absent target A CNAME follows a hostname to another hostname. A chain that returns to an earlier name, or ends at a nonexistent target, cannot provide a usable…

Fix a private nameserver delegation that depends on missing glue A nameserver such as ns1.example.com can host example.com only when resolvers can find its address without first depending on the same unreachable zone.…

Fix an MX target that cannot deliver mail even though the domain resolves An MX record identifies a mail-exchange hostname, not an IP address or website URL. The target must resolve and accept mail for the recipient domain. A…

Investigate DNS answers that fail on one network but work elsewhere A DNS answer can fail on one network when a large UDP response is fragmented or filtered while a smaller response succeeds. EDNS advertises additional…

Keep a portable DNS inventory when the provider has no export button A portable DNS inventory lets you review changes and prepare a migration even when the current provider has no export button. It should describe the…

Make www and the root domain reach the same website consistently The root domain and its www hostname are separate DNS names. They can reach the same site, but both must be accepted by the hosting service and covered…

Move a branded nameserver to a new IP without breaking its customer zones Moving a branded nameserver to a new IP can affect every customer zone that delegates to its hostname. Plan the address move as shared DNS…

Move a signed domain to another DNS provider without a stale DS record Moving authoritative DNS for a signed domain requires a DNSSEC transition as well as a nameserver change. If the parent retains a DS for keys that the…

Point an apex domain at a hosted service without an invalid CNAME The apex is the domain itself, such as example.com. An ordinary CNAME cannot coexist there with the zone's required SOA and NS data. Some DNS providers…

Prepare a reversible DNS change with an exact before-and-after record list A reversible DNS change starts with an exact record inventory and a working destination that can remain available during cached transitions. Clicking…

Publish a child zone's DS record in the correct parent zone A DS record belongs in the parent of the signed zone it authenticates. For a registered domain, the registrar usually submits DS data to the registry.…

Publish a long TXT value without adding unintended quotes or spaces A DNS TXT record can contain more than one character-string. Long DKIM keys and other provider values may be displayed as several quoted chunks even…

Publish a null MX for a domain that intentionally receives no email A null MX explicitly declares that a domain does not accept email. It is useful for a domain that intentionally has no mail service, because simply…

Publish an SRV record using the service's priority, weight and port An SRV record tells compatible clients which host and port provide a named service. Its service label, protocol, priority, weight, port and target must…

Review unexplained DNS changes and recover control of the authorised account An unexplained DNS change can come from an authorised deployment, an automation error or account compromise. Preserve the evidence and identify the…

Understand HTTPS and SVCB records before adding them to a hosting zone HTTPS and SVCB records can advertise service endpoints and connection parameters to compatible clients. They add information beyond ordinary address…

Understand the limits of publishing several A or AAAA records Publishing several A or AAAA records can make a hostname resolve to several server addresses. It does not by itself provide health checks, shared…

Understand when a wildcard DNS record does and does not apply A wildcard DNS record can supply an answer for names that do not have a more specific place in the zone. It does not override every existing record,…

Use CAA records to authorise the certificate authorities your services need CAA records let a domain operator express which certificate authorities may issue certificates for its names. An incomplete policy can block a…

Why changing DNS alone does not create a working domain parking page DNS can point a domain to a server, but it cannot generate the page shown to visitors. A working parking page requires a service that recognises the…