Your Domain Is Only as Trustworthy as Its DNS
When you registered your company’s domain, you probably accepted whatever DNS settings your registrar handed you and never looked at them again. That’s normal. It’s also a problem, because that one quiet setting decides whether your website loads, whether your email gets delivered, and whether someone can convincingly pretend to be you.
Almost everything that makes your domain trustworthy lives in DNS — the integrity of your address, the legitimacy of your email, even who’s allowed to issue security certificates in your name. So the company you choose to run your DNS isn’t a technical footnote. It’s the foundation the rest of your domain’s security stands on.
Two different things both called DNS
Let’s clear up a confusion we run into constantly — partly because we sell a product with “DNS” in the name.
Authoritative DNS is the service that answers the rest of the internet when someone looks up your domain. A customer types your web address or sends you an email, their computer asks “where does this domain live?”, and your authoritative DNS provider answers. It points inward, toward you.
NerdSec’s Secure DNS points the other way. It protects your employees’ outbound lookups — when someone on your team clicks a link, it checks the destination and blocks known-malicious sites before they load. We wrote about why that’s one of the easiest security wins a small business can make.
Same three letters, different jobs. This post is about the first one: the provider that answers for your domain. A good one does two things — keeps your domain reachable, and lets you prove it’s really yours.
Job one: keeping your domain reachable
If your authoritative DNS goes down, you don’t just lose your website. Email relies on DNS to find your mail server, so inbound mail stops too — along with everything else attached to the domain. DNS is your switchboard, not just your street sign. That makes “does it stay up?” the first question, and a few things separate a provider that stays up from one that doesn’t.
Anycast. Anycast lets one address be answered from many locations at once, with the internet automatically routing each request to the nearest one — like a national chain with a single phone number that always connects you to the closest branch, and rolls to the next one if yours is closed. You get faster lookups and automatic failover, with nothing to configure.
Points of presence. Those locations are points of presence, or PoPs. More of them, spread across continents, buys you three things at once: more customers near a server (faster), more capacity to absorb a traffic surge, and more places to fail over to if one dies. Geographic spread matters more than raw count.
DDoS protection. DNS is a favorite target for denial-of-service attacks, precisely because taking it out takes down everything at once. Anycast helps by spreading attack traffic across the network, but it’s not a force field — the 2016 attack on the provider Dyn knocked Twitter, Spotify, and Reddit offline despite Dyn running anycast. Real protection is a large network plus active, always-on mitigation.
DNSSEC support. The provider also has to be able to cryptographically sign your domain — more on that below. Treat it as a fifth box to check, not an afterthought.
Reliability. Finally, look at the uptime commitment. The strongest providers stand behind their service with a real uptime guarantee — not a promise that nothing ever breaks, but a sign they’ve built the redundancy to back it up.
What this means for you: the free DNS bundled with a cheap registrar works fine on an ordinary day. The trouble is that the day it buckles — an outage, a traffic surge, or an attack — is the day you can least afford to be offline. For a business whose bookings, invoices, and email all ride on the domain, resilient DNS is cheap insurance.
Job two: proving the domain is really yours
Reachability is only half the job. The other half is proof — a handful of DNS records that let the rest of the internet verify they’re dealing with you and not an impostor. This is what turns your domain from a name into a trusted identity.
DNSSEC: proving the address itself is real
Plain DNS is like a phone book anyone can scribble in. An attacker who slips a fake entry next to your business’s name can send your customers to an impostor — that’s spoofing, or cache poisoning. DNSSEC adds an un-forgeable signature to every entry. It builds a chain of trust — the root vouches for .com, .com vouches for your domain, each link cryptographically signed — so a validating resolver can follow the signatures up to a name it already trusts and throw out any answer that isn’t properly signed.
Two things DNSSEC is not. It isn’t a cure-all — it only helps when the visitor’s resolver actually checks the signatures. And it isn’t encryption. Picture a tamper-evident wax seal: it proves the letter is genuine and unopened, but anyone handling the envelope can still read the address. DNSSEC proves an answer is authentic; it does nothing to hide which sites are being looked up.
Turning it on is a two-key job in two places: your DNS provider signs the zone, and a matching DS record has to be published at your domain registrar. Do only the first and nothing switches on; get the two out of sync and the whole domain can go dark.
What this means for you: this is powerful but unforgiving. A DNSSEC mistake doesn’t slow your site down — it takes your website and email offline together for everyone whose resolver validates (which now includes the big public resolvers and a large share of users), and caching can keep you down for hours after you’ve fixed it. You want a provider that signs, rotates keys, and publishes the DS record automatically — not something you wire up by hand.
SPF, DKIM, and DMARC: proving your email is real
These three are DNS records — not software in your inbox — that let receiving mail servers tell your real email from forgeries. They matter more than ever: since early 2024, Gmail and Yahoo have required bulk senders to have them, and Microsoft has followed.
SPF is your published list of which mail servers are allowed to send email as your domain. DKIM adds a signature to each message, proving it really came from you and wasn’t altered in transit. The catch with SPF alone is that it only checks a hidden address your customers never see, so a scammer can still put your name on the front of the envelope. DMARC closes that gap: it ties SPF and DKIM to the name recipients actually see, sets a policy for mail that fails (none = watch and report, quarantine = send to spam, reject = block outright), and gives receiving servers an address to send you reports. Start at none to learn who’s legitimately sending as you, then tighten toward reject — none on its own is monitoring, not protection.
One warning, because it bites small businesses constantly: SPF is capped at 10 DNS lookups, and a domain may publish only one SPF record. Add one email tool too many, or end up with two SPF records, and the whole thing silently fails. It’s exactly the kind of quiet breakage nobody notices until mail stops landing.
CAA: proving who can issue your certificates
A CAA record lists which certificate authorities are allowed to issue TLS certificates — the browser padlock — for your domain. It’s a guest list at the door: a legitimate authority has to check it before issuing and refuse if it isn’t named. The catch most people miss is that with no CAA record at all, any authority may issue for you. Silence means “anyone,” not “no one.” Publishing one narrows issuance to the providers you actually use and limits the damage a tricked or misconfigured authority can do.
Where we’d point you
All of this hangs off one decision: who runs your authoritative DNS. For that, we recommend our sister company, Nikosa. It’s built on a global anycast network with points of presence around the world, comes with DDoS protection, and supports DNSSEC — so it covers job one out of the box. It’s also where your SPF, DKIM, DMARC, and CAA records live, which makes job two easier to set up and keep correct. It’s the foundation we’d want under our own domain.
DNS drifts — so don’t watch it by hand
DNS isn’t set-and-forget. A DNSSEC key falls out of sync. An SPF record gets edited when you add a new tool and quietly breaks. A DMARC policy slips. A certificate or the domain itself drifts toward expiration. Any one of these can take down your email or your website, and you usually find out when a customer tells you.
No one can watch DNS around the clock by hand — and they shouldn’t have to. That’s the same philosophy behind everything we build: the things that fail quietly are exactly the things worth automating. NerdSec can continuously monitor your domain’s DNS — DNSSEC status, the presence and correctness of your SPF, DKIM, DMARC, and CAA records, unexpected changes, and looming expirations — and alert you when something breaks or drifts, instead of months later.
Not sure what your domain’s DNS is actually doing right now? Start for free — no credit card required — or schedule a call and we’ll walk through it with you.