DNS setup and audit
A, AAAA, CNAME, MX, TXT, SRV and CAA records reviewed and corrected, with TTLs chosen for the situation rather than left at whatever the panel defaulted to.
Servers, Hosting & DevOps
Email & DNS configuration
DNS and email are the two areas where a small mistake has outsized, delayed consequences. A wrong MX record silently bounces invoices. A too-permissive SPF record gets your domain spoofed. A missing DMARC policy means you have no idea either is happening.
This work is quick when done deliberately and expensive when done by trial and error on a live domain.
How I work on it
Process
Adjusted to the job, but this is the shape it usually takes.
-
Record what exists
A full export of current DNS before any change. This is the rollback.
-
Lower TTLs first
Changes made after TTLs are reduced, so a mistake is minutes to correct rather than a day.
-
Authenticate in stages
SPF, then DKIM, then DMARC at p=none with reporting. Enforcement comes only once the reports show all legitimate mail passing.
-
Verify externally
Test sends to multiple providers and header inspection. Provider-side dashboards are not enough on their own.
Questions
Things people ask
SPF alone is not enough for most providers now. Without DKIM signing, forwarded mail fails authentication, and without DMARC there is no policy telling receivers what to do. Add to that missing reverse DNS or a shared IP with a poor history, and SPF being correct barely moves the needle.
Start at p=none with an rua address so you get reports without affecting delivery. Read them for a few weeks, fix whatever legitimate sender is failing, then move to quarantine and eventually reject. Jumping straight to reject is how internal mail disappears.
Usually not, for a business that depends on email. Separating them means a website compromise or an overloaded server does not take your mail down with it, and mailbox providers handle spam filtering and storage better than a self-hosted setup will.