DNS

Pre-Migration TTL

• Lower TTL to 300s at least 48h before changing records—current TTL must expire first
• Check current cached TTL before planning: dig +nocmd +noall +answer example.com
• After migration stable 24h, raise TTL back to 3600-86400s
• Test with multiple resolvers: Google (8.8.8.8), Cloudflare (1.1.1.1), local ISP—they cache independently

Email Authentication (All Three Required)

• SPF alone insufficient—DKIM and DMARC both needed for deliverability
• DMARC record: _dmarc.example.com TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
• SPF must be single TXT record—multiple SPF records invalid; use include: for multiple sources
• SPF ending: -all (reject) or ~all (soft fail)—never +all or ?all
• Verify complete setup with mail-tester.com after configuration

CAA Records