Securing Your Domain: DNSSEC, SPF, DMARC and CAA Explained

Most domains — including corporate ones — leave two doors wide open: email sender spoofing, and certificate issuance by any authority whatsoever. Four DNS records, all free, close those doors. In order of impact:

1 — SPF: who may send email as you

A TXT at the apex: v=spf1 include:_spf.google.com ~all (adapted to your provider). The forgotten case: a domain that never sends email should publish v=spf1 -all — otherwise spammers can impersonate @your-domain addresses with impunity.

2 — DMARC: the policy that gives SPF/DKIM teeth

Without DMARC, a failed SPF check often has zero consequence. The _dmarc TXT sets the policy: start with v=DMARC1; p=quarantine; rua=mailto:you@… then move to p=reject after a few weeks of reports. For a no-email domain: go straight to p=reject with adkim=s; aspf=s.

3 — DNSSEC: authenticated DNS answers

DNSSEC cryptographically signs your zone: validating resolvers detect any forged answer (cache poisoning). On Cloudflare it's one button (DNS → DNSSEC → enable; the DS record flows to the registry automatically if the domain is registered there). Verify the real state in RDAP — plenty of domains believe DNSSEC is on without a published DS.

4 — CAA: who may issue your SSL certificates

The CAA record whitelists certificate authorities: 0 issue "letsencrypt.org" for example. Every other CA must refuse to issue for your domain — neutralizing a whole family of fraudulent-certificate attacks. List only the CAs you actually use.

Check your grade in 30 seconds

Our free online checker reads DNSSEC state and records for any domain; the RegistrarPilot app goes further with an A–E health grade per domain (site up, HTTPS, SPF, DMARC, DNSSEC, expiry).

Frequently asked questions