How-To Guides7 min read

DNS Records Explained: A, MX, SPF, DKIM & DMARC

DNS is the phonebook of the internet — and misconfigured records are behind most email and website outages. Here's what each record does and how the email-authentication trio stops spoofing.

Published July 29, 2026Updated July 29, 2026
DNSSPFDKIMDMARCEmail SecurityNetworkingMicrosoft 365

Why DNS matters

When email stops flowing or a website goes dark, the cause is frequently a DNS misconfiguration. Whether your zone lives at GoDaddy, Cloudflare, or Microsoft 365, the record types are the same.

The record types you'll actually touch

RecordPurpose
A / AAAAPoints a hostname to an IPv4 / IPv6 address (your website).
CNAMEAlias one name to another (e.g., autodiscover, www).
MXDirects email to your mail provider (Microsoft 365).
TXT / SPFLists servers allowed to send mail for your domain.
DKIMCryptographically signs outbound mail.
DMARCTells receivers what to do with mail that fails SPF/DKIM — and reports on it.

The email-authentication trio

SPF, DKIM, and DMARC together are the single most effective defense against spoofing and the biggest factor in whether your legitimate email lands in the inbox. A missing DMARC policy is an open door for impersonation.

Common pitfall: when moving DNS between GoDaddy, Cloudflare, and Microsoft 365, records get orphaned. IDENETY audits and consolidates your zone so nothing breaks silently.

TTL & propagation

Lower TTLs before a migration so changes propagate quickly; raise them afterward for stability. IDENETY manages DNS as part of Microsoft 365 migrations and as a standalone service. Ask our engineers about a DNS audit.