DNS management done right: email, records, and domain verification

DNS is the plumbing of the internet — invisible when it works, and the source of mysterious, maddening problems when it doesn't. Email lands in spam, a service won't verify, a subdomain points nowhere, and nobody can say why. Almost always, the answer is in the DNS, and the fix is unglamorous but exact.

Here's a plain-spoken tour of the DNS work that keeps a domain healthy — especially the part that trips up most organizations: email.

Get email authentication right: SPF, DKIM, DMARC

If your email is landing in spam or getting spoofed, this is where to look. Three records, working together, tell the world that mail claiming to be from your domain is actually yours.

SPF (Sender Policy Framework) is a record listing which servers and services are allowed to send email on your behalf. DKIM (DomainKeys Identified Mail) adds a cryptographic signature to your messages, so a recipient can verify the mail wasn't tampered with and really came from your domain. DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties the two together: it sets a policy for what should happen to mail that fails the checks — monitor, quarantine, or reject — and can report back on who's sending as you.

Configured properly, these three do two big things at once: they improve deliverability (your legitimate mail reaches inboxes) and they protect your brand (impersonators can't easily send as you). Get them wrong, and you get the worst of both — your real mail bounces while spoofers slip through.

Know your record types

Beyond email, a healthy domain relies on a handful of record types, each with a job: A and AAAA records point a domain at an IP address (IPv4 and IPv6); CNAME records alias one name to another — useful for subdomains and third-party services; MX records direct your email to the right mail servers; TXT records hold verification strings and the SPF/DMARC values above.

Managing these well means knowing which record a given task needs, and changing it precisely — because in DNS, a small typo or a wrong record type is the difference between working and silently broken.

Nameservers and domain verification

Nameservers decide who actually answers DNS questions for your domain — your registrar, your DNS host, or a provider like a CDN. Pointing them correctly is foundational; everything else depends on the right nameservers being in charge.

Domain verification is the step that connects your domain to the services you run on it. When you bring your domain into a tenant like Microsoft 365 or Google Workspace, the provider asks you to prove you own it — usually by adding a specific TXT (or sometimes CNAME) record. Add the record, the provider confirms ownership, and your domain is wired into the platform. The same pattern — add a record the provider gives you — verifies your domain across virtually any service.

Subdomains: structure without new domains

Subdomains (like portal.yourfirm.com or app.yourfirm.com) let you stand up distinct services under your main domain without buying or managing new ones. Set up with the right A or CNAME records, they point a clean, branded address at wherever the service actually lives — a portal, an app, a landing environment.

Used well, subdomains keep your web presence organized and professional: one domain, many purposes, each pointed exactly where it should go.

The quiet discipline of good DNS

DNS rewards precision and punishes guesswork. Authenticate your email with SPF, DKIM, and DMARC. Use the right record types for the right jobs. Point your nameservers correctly and verify your domain cleanly into the platforms you use. Structure services with subdomains. None of it is glamorous — but a domain managed this way simply works, which is the highest compliment DNS can earn.

What are SPF, DKIM, and DMARC?

Three DNS records that authenticate your email. SPF lists who can send for your domain, DKIM cryptographically signs your messages, and DMARC sets the policy for handling mail that fails — together improving deliverability and preventing spoofing.

How do you connect a domain to Microsoft 365 or Google Workspace?

By verifying ownership: the provider gives you a specific TXT (or CNAME) record to add to your DNS. Once it's detected, the provider confirms you own the domain and connects it to the tenant.

What's the point of a subdomain?

A subdomain lets you run a separate service — like a client portal or app — under your main domain without registering a new one, using DNS records to point the branded address at wherever that service is hosted.