Valla DNS Learning Ecosystem
Start with the most common hosting problems, then level up into email records, SSL, and advanced DNS security. This Learning Hub now includes 130 practical guides for anyone running a domain, each with plain-English troubleshooting steps and free tool links.
Skip the browsing. Pick the problem you have right now and jump straight to the fix.
Set up MX, SPF, DKIM and DMARC so inboxes trust your mail.
A calm checklist to find out what broke and where.
Why changes take time to show up, and how to tell if yours actually worked.
Trace a delivery problem end to end until you find the broken link.
Recover a broken SSL padlock, most common right after a DNS move.
Do it right once: SPF, DKIM, DMARC, DNSSEC and SSL from day one.
Not sure what's wrong? Run a free check on your domain and we'll point out the problems for you.
Latest article
Check if your DNS is secure: confirm DNSSEC validation, encrypted DNS, no open resolver exposure, and sane records, with a quick self-audit and clear fixes.
130 articles ready to learn
Check if your DNS is secure: confirm DNSSEC validation, encrypted DNS, no open resolver exposure, and sane records, with a quick self-audit and clear fixes.
Verify DNS propagation: query multiple global resolvers, read the TTL, and tell when a record has truly propagated versus a stale cache that is lying to you.
Confirm DNS over HTTPS is really on: test your browser and OS resolver, read the signals that prove queries are encrypted, and fix DoH that silently falls back.
Verify if an SSL certificate is valid: check expiry, hostname match, a trusted chain, and revocation, plus the common reasons a cert shows as invalid online.
Want a LeafDNS alternative? Run a free DNS health check that tests delegation, SOA, MX, SPF, and DNSSEC, then explains exactly what to fix and why it matters.
Check your domain delegation step by step: compare the parent TLD and child nameserver records, catch lame delegation, and confirm every NS answers correctly.
Find which DNS resolver your device uses on Windows, macOS, and Linux, test that it answers correctly, and see why switching resolvers changes what you get.
Public versus private IP and IPv4 versus IPv6 explained: what the internet sees, what your router assigns, and why you often hold both address types at once.
A CNAME is a DNS alias, not a redirect. See how it differs from 301 and 302 HTTP redirects and registrar URL forwarding, and when each one is the right tool.
A head to head on A and AAAA records: what each maps to, running dual stack, how Happy Eyeballs picks, and when a stray AAAA quietly breaks reachability.
Read an SSL certificate check field by field: issuer and CA, the chain to root, validity and expiry, and the SAN list that sets which hostnames it covers.
Configure the DMARC rua and ruf tags: aggregate versus forensic reports, sending to several mailboxes, and the external destination TXT record you need.
How DDNS keeps a hostname pointed at a residential IP that changes, how update clients and the DNS UPDATE protocol work, TTL choices, and the security risks.
How to run ns1 and ns2 on your own domain as branded nameservers, the glue records that make them resolvable, and when vanity NS is worth the maintenance.
The two jobs in every lookup: recursive resolvers that chase and cache the answer, and authoritative servers that hold the zone, plus where TTLs sit between.
How IPv6 PTR records work in the nibble-format ip6.arpa zone, why reverse DNS still matters for IPv6 mail senders, and how to build and verify the entry.
Three ways DNS steers traffic: plain round-robin, weighted records, and geolocation answers, what each can and cannot guarantee, and how caching limits them.
Why DNSSEC keys must rotate, the pre-publish and double-signature rollover methods, DS-record timing with the parent, and the TTL math that prevents SERVFAIL.
What NAPTR records do, how order, preference, flags, service, and regexp fields work, and where they appear in SIP/VoIP discovery and ENUM number mapping.
How a DNAME remaps a whole namespace below a name, how that differs from a single-name CNAME, resolver synthesis of CNAMEs, and when DNAME is the right tool.
How to hand a subdomain to another DNS provider using NS records at the parent, when delegation beats adding records, and how to trace that it resolves.
How forwarding rewrites the path and fails SPF, what Sender Rewriting Scheme (SRS) does at the forwarder, and how ARC preserves authentication across hops.
Why DNS TXT strings cap at 255 characters, how long DKIM and SPF values split into multiple quoted strings in one record, and the gotchas that break them.
Why a message can pass SPF and DKIM yet still fail DMARC: identifier alignment, relaxed vs strict mode with aspf and adkim, and how to fix misalignment.
How to move safely from p=none to quarantine to reject, using the pct tag to roll the policy out gradually, and the monitoring milestones before each step.
What each SPF qualifier tells a receiver, why ~all is the safe default while testing, when to move to -all, and how DMARC changes what all really does.
What the MX priority number means, how mail servers pick the lowest value first, when a backup MX actually helps, and the backscatter risks it brings.
Point the apex A record to Shopify's IP and the www CNAME to the shops subdomain, remove conflicting records, and confirm the cutover with a live lookup.
Microsoft 365 DNS done right: the MX record, Autodiscover CNAME, SPF include for Exchange Online, the two DKIM selector CNAMEs, and the Teams SIP records.
Apex A and AAAA records vs the www CNAME for GitHub Pages, the CNAME file, enforcing HTTPS, and why DNS propagation matters before the TLS certificate.
CDNs, GeoDNS, anycast, and propagation lag: why a global DNS check returns different IPs per region, and how to tell expected variation from a problem.
The full Google Workspace email record set: MX records, the SPF include, generating and publishing DKIM, and a starter DMARC policy, with verify steps.
What Cloudflare's orange cloud actually changes, when to use DNS only (grey), why proxied records hide your origin IP, and how proxying affects a DNS lookup.
Exact flush DNS commands per OS: ipconfig /flushdns, dscacheutil and mDNSResponder on macOS, systemd-resolved on Linux, plus clearing a browser DNS cache.
Copy-paste dig recipes for real DNS debugging: +short, +trace, querying a specific resolver with @, record types, reverse lookups, and reading the answer flags.
A Windows nslookup walkthrough: interactive and non-interactive mode, set type=MX/TXT/NS, querying a specific server, and why its results differ from dig.
RPZ turns a recursive resolver into a DNS firewall. Learn the QNAME, IP, and NSDNAME triggers, actions such as NXDOMAIN and PASSTHRU, and writing policy zones.
RFC 2308 negative caching explained: NXDOMAIN vs NODATA, how the SOA minimum field sets the negative TTL, and why it can delay new records from going live.
EDNS0 (RFC 6891) lets DNS exceed 512 bytes. Learn the OPT record, why 1232 bytes is the safe default, how the TC bit forces TCP fallback, and how to test it.
How DNS reflection and amplification DDoS attacks work, why open resolvers and ANY queries fuel them, and how to defend with RRL, BCP 38, and access control.
DoH (RFC 8484, port 443) and DoT (RFC 7858, port 853) encrypt your DNS queries. Compare them, see real dig and curl tests, and deploy without lockout.
How DNS zone transfers sync secondaries: AXFR vs IXFR, what an open transfer leaks, and how to secure transfers with TSIG keys in BIND with real dig tests.
How anycast DNS uses BGP to serve one IP from many locations for lower latency, automatic failover, and DDoS resilience, with dig probes and real trade-offs.
Glue records break the circular lookup when nameservers live inside the domain they serve. See in-bailiwick rules, dig referrals, and how to set glue safely.
Why you cannot put a CNAME on your root domain, and how ALIAS, ANAME, and CNAME flattening let the apex follow a hostname with real A records and dig examples.
Understand DNSSEC without the jargon: how DNSKEY, RRSIG, and DS records build a chain of trust to the root, with dig examples and a safe rollout plan.
Learn how CAA records tell certificate authorities which CAs may issue TLS certificates for your domain, with dig examples, syntax, and a safe rollout plan.
How PTR records and reverse DNS work, why forward-confirmed reverse DNS (FCrDNS) decides your email deliverability, and how to set and verify them with dig.
Compare MTA-STS and DANE for enforcing TLS on inbound SMTP: web PKI policy files vs DNSSEC-pinned TLSA records, prerequisites, failure modes, and running both.
How split-horizon (split-brain) DNS returns private IPs internally and public IPs externally, using BIND views with ACLs or separate servers, plus pitfalls.
Map the gTLD expiry timeline: auto-renew grace, the 30-day redemption period with its fee, pending delete, and the drop, plus how to recover a lost domain.
Break down every SOA field: MNAME, RNAME, the serial and YYYYMMDDnn convention, refresh, retry, expire, and the minimum field that sets negative-cache TTL.
Round-robin DNS spreads load but is not failover: DNS cannot see a dead server. Learn health-checked failover, short TTLs, and when a load balancer wins.
Rotate DKIM keys with zero downtime using the dual-selector method: publish the new key, switch the signer, wait 48 hours, then retire the old selector.
Transfer a domain between registrars safely: check the 60-day lock, unlock it, get the EPP auth code, approve, and keep your DNS, site, and email alive.
How a *.example.com wildcard answers any undefined subdomain, the leftmost-label rule, when to use it for SaaS tenants, and the takeover and MX traps.
Pick DNS TTL values by record type and lower them to 300 seconds before a migration so cutovers are fast, with a clear pre-change timeline and the reasons.
Decode a DMARC aggregate RUA report: read the report metadata, the published policy, and the per-source rows for SPF, DKIM, alignment, and disposition.
Learn how TXT verification records prove domain ownership, where to place them, how multiple tokens coexist, and the pitfalls that make verification fail.
Understand the SRV record and its _service._proto naming, the priority, weight, port and target fields, real examples for SIP, XMPP and LDAP, plus pitfalls.
Publish a BIMI record at default._bimi, meet the DMARC enforcement and SVG logo rules, and learn when a VMC or CMC certificate is needed to show your logo.
Set up MTA-STS to force TLS on inbound SMTP and TLS-RPT to receive failure reports. Covers the policy file, _mta-sts and _smtp._tls records, and a safe rollout.
Understand SVCB (type 64) and HTTPS (type 65) records: AliasMode vs ServiceMode, the alpn, port, ipv4hint, ipv6hint and ech parameters, how ECH hides the SNI, and how to publish and verify them with dig.
How a dangling CNAME or ALIAS lets an attacker claim your subdomain, how to detect orphaned records with dig and Certificate Transparency logs, and the correct decommission order that closes the window: remove DNS first, wait out the TTL, verify, then release the resource.
A lame delegation is a nameserver listed for your domain that does not answer authoritatively. Here is how to find the lame server and fix the delegation.
An incomplete chain means your server sends its own certificate but not the intermediate that links it to a trusted root. Desktop browsers hide it; curl and mobile do not.
SERVFAIL means the resolver tried to answer and something upstream failed, usually DNSSEC, a broken delegation, or unreachable nameservers. Here is how to isolate the cause.
A 550 bounce is a permanent rejection, and the enhanced code after it (5.1.1, 5.7.1, 5.7.26) tells you whether the address is wrong or your sending domain is the problem.
What DNS over HTTPS and DNS over TLS actually do, how encrypted DNS changes troubleshooting and filtering, and what it means for your site and email.
What a glue record is, the chicken-and-egg problem it solves for custom nameservers, and how to tell when a missing glue record is breaking your domain.
Why a website loads fine for you but is blocked for visitors in certain countries, how DNS-level filtering like Nawala works, and how to confirm it.
A complete DNS test covers delegation, records, propagation, mail, and security. Here is what each check proves, the tools that run them, and how to read the results.
A plain-English tour of the DNS records that run your domain, what each one does, when you need it, and how they fit together.
Changing nameservers moves who answers for your whole domain. Here is how to do it safely, the one step people skip, and how to verify it worked.
The plain-English manual for the Domain Health Report, decode each section and learn which failing grade to fix first and why the order matters.
A pre-send checklist that catches the eight things that dump a first campaign into spam, most of them verifiable in one health scan before you send.
Moving your website or DNS to a new host? Here is the safe order: lower the TTL, test with your hosts file before you switch, then cut over DNS with zero downtime.
Your website is down and you do not know why. Here is how to tell whether the problem is your domain, your server, or your website code, and exactly who to contact for each.
Getting an "app password required" error in your mail app? Here is what an app password is, how to create one for Gmail, Outlook, iCloud, and Yahoo, and how to enter it in every major client.
DNS_PROBE_FINISHED_NXDOMAIN means the domain could not be found. Here is what it means and how to fix it in 5 minutes, for visitors and for site owners.
A WHOIS lookup reveals a domain registrar, dates, nameservers, and status codes. Here is how to read it, what privacy hides, and how RDAP is replacing it.
Your website stopped loading? Work this 5-minute checklist, ordered by what is most likely: is it just you, expired domain, DNS, hosting, SSL, then firewalls.
NTP stratum levels rank time servers by distance from a reference clock. Learn what stratum 0 through 15 mean and how to check any server's stratum.
Why DNS changes take time, what TTL really controls, and how to check propagation with dig, nslookup, and global DNS checkers. A practical guide.
Learn why an IP address maps to a location, how geolocation databases build that mapping, how accurate the results are, and how to look up any IP.
Deliverability is a reputation puzzle. Learn to combine IP blacklists, domain URIBLs and raw headers into one clear picture of why mail gets filtered.
A recursive trace shows how a lookup walks from the root to your domain's nameservers. Learn to read delegation, glue records, and lame delegation.
Moving DNS providers without downtime is a process, not a prayer. A before/during/after checklist using lookup, nameserver trace and propagation.
A launch-day security checklist for a fresh domain, lock down email spoofing, sign your DNS, and get TLS right before anyone abuses the gaps.
HTTP response headers reveal your server, cache behavior, redirect chains, and security posture. Learn which headers matter and what good looks like.
Mail suddenly bouncing or landing in spam? A calm, ordered playbook that walks the whole email path, MX, auth, reputation and headers, to the root cause.
Ping says timeout but the site loads for others? Learn why a TCP reachability check beats a classic ICMP ping and how to read the result.
Your IP is clean but mail still lands in spam? The domains in your links may be listed on a URIBL. Learn what URIBLs are and how to check yours.
A skewed clock breaks TLS, logins, and 2FA. Learn how to test an NTP server and read stratum, offset, and root dispersion without the jargon.
A missing or mismatched PTR record is a top reason mail gets rejected. Learn what reverse DNS is, what forward-confirmed means, and how to fix it.
A calm, layer-by-layer triage for a site that won't load, DNS, reachability, TLS and HTTP, so you find the real cause instead of rebooting at random.
Should you use IMAP or POP3 to connect your email? Compare setup, ports, sync behavior, and common error fixes so your mailbox works reliably across devices.
Learn why emails fail without DKIM, how DKIM signatures are validated, and the exact DNS and server checks to fix spam placement and authentication rejections fast.
Learn how to create a DMARC record with the right policy, alignment, and reporting tags so you can prevent spoofing, reduce phishing risk, and improve email deliverability.
Learn how SPF works, why misconfigurations cause bounce-backs and spam placement, and how to build a valid DNS SPF record that improves deliverability.
Practical 2026 guide to how to configure outlook and apple mail with custom domain with tailored validation steps, commands, and recovery actions.
Practical 2026 guide to dns cache vs browser cache, clear the right one with tailored validation steps, commands, and recovery actions.
Practical 2026 guide to fix delayed email delivery after mx record update with tailored validation steps, commands, and recovery actions.
Practical 2026 guide to spf record exceeds 10 lookup limit, fix it fast with tailored validation steps, commands, and recovery actions.
Practical 2026 guide to mx, spf, dkim, and dmarc setup for better inbox delivery with tailored validation steps, commands, and recovery actions.
Practical 2026 guide to ipv6 (aaaa records) missing, why some users can’t reach you with tailored validation steps, commands, and recovery actions.
Practical 2026 guide to why emails are delayed (greylisting, queues, and dns) with tailored validation steps, commands, and recovery actions.
Practical 2026 guide to aname / alias records at root domain explained with tailored validation steps, commands, and recovery actions.
Practical 2026 guide to complete dns propagation troubleshooting checklist 2026 with tailored validation steps, commands, and recovery actions.
Practical 2026 guide to use the hosts file to test dns changes locally with tailored validation steps, commands, and recovery actions.
Practical 2026 guide to dns hosting vs registrar, where should your records live? with tailored validation steps, commands, and recovery actions.
Practical 2026 guide to .com vs country tld dns differences, what changes in 2026 with tailored validation steps, commands, and recovery actions.
Practical 2026 guide to local network or router dns issues, office fix guide with tailored validation steps, commands, and recovery actions.
Practical 2026 guide to how to enable dnssec on any domain with tailored validation steps, commands, and recovery actions.
Practical 2026 guide to full timeline for migrating dns to a new provider with tailored validation steps, commands, and recovery actions.
Practical 2026 guide to why is my website not reachable after dns change? with tailored validation steps, commands, and recovery actions.
Practical 2026 guide to my domain was hijacked, emergency recovery steps with tailored validation steps, commands, and recovery actions.
Practical 2026 guide to website down after dns change, a record fix checklist with tailored validation steps, commands, and recovery actions.
Practical 2026 guide to ssl certificate shows not secure after dns move with tailored validation steps, commands, and recovery actions.
Practical 2026 guide to dnssec and caa records explained without the jargon with tailored validation steps, commands, and recovery actions.
Practical 2026 guide to whois and domain lookup checks before renewals and transfers with tailored validation steps, commands, and recovery actions.
Practical 2026 guide to imap vs pop3 vs smtp, which one do you need? with tailored validation steps, commands, and recovery actions.
Practical 2026 guide to ssl not secure warning after dns move, easy recovery plan with tailored validation steps, commands, and recovery actions.
Practical 2026 guide to www vs non-www, set it up correctly once with tailored validation steps, commands, and recovery actions.
Practical 2026 guide to read email headers to diagnose spf and dkim fails with tailored validation steps, commands, and recovery actions.
Practical 2026 guide to blockchain domains and web3 dns, what traditional hosts should know with tailored validation steps, commands, and recovery actions.
Practical 2026 guide to common dns typos that break everything with tailored validation steps, commands, and recovery actions.
Practical 2026 guide to domain not working, quick dns lookup steps anyone can follow with tailored validation steps, commands, and recovery actions.
Practical 2026 guide to gmail and yahoo bulk sender rules 2026 (dmarc + one-click unsubscribe) with tailored validation steps, commands, and recovery actions.
Practical 2026 guide to dns propagation basics for small business sites with tailored validation steps, commands, and recovery actions.
Use this quick reference while editing DNS records in Valla DNS.
| Record Type | Purpose | Example Value | Where to Use |
|---|---|---|---|
| A | Points to IPv4 address | 192.0.2.1 | Root domain, www |
| AAAA | Points to IPv6 address | 2001:db8::1 | Modern devices |
| CNAME | Alias to another name | www → example.com | Subdomains only |
| ANAME / ALIAS | Root alias (provider-specific) | @ → target.host | Root to CDN |
| MX | Mail server destination | 10 mail.example.com | Email routing |
| TXT | SPF, DKIM, DMARC text policies | v=spf1 mx ~all | Authentication |
| CAA | Allowed certificate authorities | 0 issue "letsencrypt.org" | SSL security |
One short email when we publish a new guide. No spam, unsubscribe any time.