dns11 min readUpdated 2025-12-15

DNS Security Basics

DNS is where every request starts. Missing records here undermine every other security control you've configured.

CAA

Restricts which certificate authorities can issue certificates for your domain. One line prevents rogue issuance.

SPF, DKIM, DMARC

Together they authenticate email from your domain. Without them, spoofing your brand costs nothing.

Frequently asked questions

Nice to have. It prevents DNS response tampering but adoption is uneven. If your registrar supports one-click DNSSEC, turn it on.

Try it on your site

Run a free Website Auditor scan and see which of these controls you're missing.

Run a scan

Related tools

More guides