Back to security articles

How DNS Records Affect Website Security and Availability

Understand A, AAAA, CNAME, NS, SOA, MX, TXT, CAA and DNSSEC records and why their configuration matters.

DNS is the public directory that connects a domain name to website, email and security infrastructure. Incorrect DNS configuration can cause downtime, email-delivery problems and weaker protection.

A and AAAA records

An A record maps a hostname to an IPv4 address. An AAAA record maps it to an IPv6 address. A website may intentionally use only IPv4, but every published address should point to expected infrastructure.

Nameserver and SOA records

NS records identify the authoritative DNS providers for the domain. Using multiple properly configured nameservers improves resilience.

The SOA record includes the primary nameserver, responsible mailbox, zone serial and DNS timing values such as refresh, retry and expiry periods.

Mail-related records

MX records identify where the domain receives email. TXT records commonly contain verification values, SPF policies and other public service configuration.

CAA records

CAA records allow a domain owner to state which certificate authorities may issue certificates for the domain. They provide an additional DNS-level certificate issuance restriction.

DNSSEC indicators

DNSSEC adds cryptographic authenticity to DNS information. A scanner may check for DS or DNSKEY records, but full DNSSEC validation normally requires a validating resolver and additional chain verification.

Recommended DNS practices

  • Use at least two authoritative nameservers.
  • Remove obsolete address and verification records.
  • Protect DNS provider accounts with strong authentication.
  • Review TTL values before planned infrastructure changes.
  • Enable DNSSEC when the provider and registrar support it.
Continue Reading

Related Security Guides