Domains, DNS, SSL and email authentication (SPF, DKIM, DMARC) for business owners

Your domain, DNS, SSL certificate and email authentication records are the plumbing behind your website and email. When they are set up correctly, nobody notices. When they are wrong, your site goes down, browsers show security warnings or your invoices land in spam. Every business owner should know who controls these settings, where they live and whether SPF, DKIM and DMARC are in place.

This guide explains each piece without assuming a technical background.

The four pieces and how they fit together

Domain names: own them properly

A domain is not bought once. It is rented, usually a year at a time, from a registrar. Three things go wrong more often than they should:

• The domain is in someone else's account. A former employee, a nephew who built the first site or a past web agency registered it. Getting it back can take weeks.
• It expires. The card on file expired, the renewal email went to an old inbox and the site and email stop working.
• The account is not protected. A stolen registrar login lets someone redirect your website and email.

What we recommend:

1. Register the domain in an account owned by the business, using a role-based email (like admin@ or it@) that more than one person can access.
2. Turn on auto-renew and keep a current payment method on file.
3. Enable two-factor authentication on the registrar account.
4. Turn on registrar lock (transfer lock) so the domain cannot be moved without your approval.
5. Keep a record of where the domain is registered and who has access.

DNS: the records that make everything work

DNS (the Domain Name System) translates your domain into the addresses computers use. Your DNS zone holds a list of records. The most common ones:

• A and AAAA records point the domain to your web server's address.
• CNAME records point one name to another, like www.yourbusiness.com to your website platform.
• MX records tell the world which servers receive your email (Google Workspace, Microsoft 365 or another provider).
• TXT records hold verification codes and the SPF, DKIM and DMARC settings described below.

The most important thing to know is where your DNS is managed. It is often at the registrar, but if you moved to a different provider or use Cloudflare, the records live there instead. When something breaks, that is where someone will need to look.

A common cause of email outages: someone changes DNS for a website move, replaces the whole zone and forgets the MX and TXT records. Before any website launch or migration, export or screenshot the current DNS records. We cover this in more detail in how to choose web hosting.

SSL/TLS: the padlock in the browser

An SSL/TLS certificate encrypts the connection between a visitor's browser and your website, so form submissions and logins cannot be read in transit. Browsers label sites without it as "Not secure," and search engines favor secure pages.

The good news: for most businesses this is free and automatic. Most hosts and platforms (WordPress hosts, Webflow, Shopify, Squarespace and modern hosting for Next.js sites) issue certificates through services like Let's Encrypt and renew them on their own.

Things to check:

• The whole site uses HTTPS, and HTTP addresses redirect to HTTPS.
• The certificate covers both versions of your domain (with and without www).
• No mixed content warnings. Old pages sometimes load images or scripts over HTTP.
• Renewal is automatic. If you have a manually installed certificate, someone needs a reminder. Certificate lifetimes are getting shorter across the industry, so manual renewal will become more of a burden, not less.

Paid certificates with extended validation are rarely necessary for a small business. They do not make the padlock look different in modern browsers.

Email authentication: SPF, DKIM and DMARC

Email was designed without any built-in way to prove who sent a message. That is why criminals can send email that appears to come from your domain, and why legitimate email sometimes lands in spam. Three DNS records fix this.

SPF (Sender Policy Framework)

SPF is a TXT record listing the services allowed to send email for your domain: your email provider, your CRM, your newsletter tool, your website's contact form service.

Common mistakes:

• Multiple SPF records. You can only have one. Combine them.
• Too many lookups. SPF has a limit of ten DNS lookups. Adding every tool you have ever used can break it.
• Forgotten senders. If your invoicing tool sends from your domain but is not listed, those emails may fail.

DKIM (DomainKeys Identified Mail)

DKIM adds a digital signature to every outgoing message. Your email provider gives you a public key to publish in DNS, and receiving servers use it to confirm the message was not altered and really came from an authorized sender. Each sending service (Google Workspace, Microsoft 365, your email marketing platform) usually has its own DKIM record.

DMARC (Domain-based Message Authentication, Reporting and Conformance)

DMARC ties SPF and DKIM together. It tells receiving servers what to do if a message claiming to be from you fails the checks, and it sends you reports about who is sending email using your domain.

A DMARC policy has three levels:

Start at p=none with a reporting address, review the reports (a DMARC reporting service makes them readable), fix any legitimate senders that fail, then move to quarantine and eventually reject.

Why this matters now

Major mailbox providers have tightened their rules. Google and Yahoo introduced requirements in 2024 for bulk senders to authenticate with SPF and DKIM and publish a DMARC record, and Microsoft followed with similar requirements for Outlook.com consumer addresses in 2025. Even if you do not send in bulk, a missing or broken setup makes it more likely your ordinary business email gets filtered. And DMARC at an enforcing policy is one of the best defenses against criminals impersonating your domain in phishing emails, which we discuss in our website security checklist.

A simple checklist

• The domain is registered in a business-owned account with two-factor authentication.
• Auto-renew is on, with a current payment method.
• Registrar lock is enabled.
• You know where DNS is managed and have a copy of the current records.
• The website uses HTTPS everywhere, with automatic certificate renewal.
• There is exactly one SPF record, and it includes every service that sends as your domain.
• DKIM is enabled for your email provider and each marketing or transactional email tool.
• A DMARC record exists, with reports going to someone who reads them.
• You have a plan to move DMARC from none to quarantine to reject.

How we'd decide who handles this

If you have an IT provider, DNS and email authentication usually belong with them, and your web team coordinates on website records. If you do not, your web partner should at least document the setup, own the website-related records and flag gaps in email authentication. What matters most is that someone specific is responsible, and that the business, not a vendor, owns the accounts.

We check domains, DNS, SSL and email authentication as part of every launch and our care and security plans. If you are not sure your setup is right, ask us to take a look.