How do I install the Dns Deep Knowledge skill?

Run npx skillmds add nickgallick/dns-deep-knowledge in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Dns Deep Knowledge safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Dns Deep Knowledge?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Dns Deep Knowledge free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Dns Deep Knowledge?

nickgallick (@nickgallick) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Dns Deep Knowledge by nickgallick — Agent Skill

Name: Dns Deep Knowledge
Rating: 4.2 (5 reviews)
Author: nickgallick

File contents

DNS Deep Knowledge

Review Checklist

SPF record exists and is valid (one record, <10 lookups)
DKIM configured for all sending services
DMARC policy set (at least p=none for monitoring)
MX records point to correct mail provider
TTL appropriate (3600 stable, 60-300 during changes)
No conflicting CNAME records
CAA record restricts certificate issuance

Record Types

Type	Maps	Example	Notes
A	domain → IPv4	`76.76.21.21`	Vercel's IP
AAAA	domain → IPv6
CNAME	domain → domain	`cname.vercel-dns.com`	Can't coexist with other types on same name
MX	domain → mail server	`10 mx1.google.com`	Priority + hostname
TXT	domain → text	SPF, DKIM, DMARC, verification
NS	domain → nameserver	`ns1.cloudflare.com`
CAA	domain → allowed CAs	`0 issue "letsencrypt.org"`

Email DNS (Critical for OUTBOUND)

SPF

v=spf1 include:_spf.google.com include:sendgrid.net -all

Authorizes which servers can send for your domain
ONE SPF record per domain (multiple = both fail)
-all (hard fail) in production, ~all (soft fail) during testing
Max 10 DNS lookups — each include: costs 1-2
Exceeding 10 lookups = SPF broken silently

DKIM

selector._domainkey.yourdomain.com TXT "v=DKIM1; k=rsa; p=<public_key>"

Cryptographic signature proving email wasn't modified
2048-bit minimum key
Rotate every 6-12 months
Generated by email provider

DMARC

_dmarc.yourdomain.com TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com"

p=none → monitor only (start here)
p=quarantine → spam folder
p=reject → block entirely (goal)
rua → aggregate reports destination

DNS for Vercel

Root domain:     A    → 76.76.21.21
www subdomain:   CNAME → cname.vercel-dns.com
api subdomain:   CNAME → cname.vercel-dns.com

SSL auto-provisioned by Vercel via Let's Encrypt.

Cold Email Domains (OUTBOUND)

Separate from web/transactional domains
Each needs: A, MX, SPF, DKIM, DMARC, tracking CNAME
301 redirect all outbound domains to primary domain
If blacklisted, doesn't affect password resets or web

TTL Strategy

Situation	TTL	Why
Stable records	3600 (1h)	Reduce DNS queries
Before DNS change	60 (1min)	Fast propagation
After change verified	3600	Back to normal
MX records	3600	Stability for email
DKIM/SPF	3600	Rarely changes

Sources

Cloudflare DNS documentation
Google Workspace MX setup guide
DMARC.org specification
Vercel custom domains documentation

Changelog

2026-03-21: Initial skill — DNS deep knowledge

---name: dns-deep-knowledgedescription: DNS mastery — record types, email deliverability (SPF/DKIM/DMARC), Vercel DNS, cold email domains, Cloudflare specifics.---# DNS Deep Knowledge## Review Checklist- [ ] SPF record exists and is valid (one record, <10 lookups)- [ ] DKIM configured for all sending services- [ ] DMARC policy set (at least `p=none` for monitoring)- [ ] MX records point to correct mail provider- [ ] TTL appropriate (3600 stable, 60-300 during changes)- [ ] No conflicting CNAME records- [ ] CAA record restricts certificate issuance---## Record Types| Type | Maps | Example | Notes ||------|------|---------|-------|| A | domain → IPv4 | `76.76.21.21` | Vercel's IP || AAAA | domain → IPv6 | | || CNAME | domain → domain | `cname.vercel-dns.com` | Can't coexist with other types on same name || MX | domain → mail server | `10 mx1.google.com` | Priority + hostname || TXT | domain → text | SPF, DKIM, DMARC, verification | || NS | domain → nameserver | `ns1.cloudflare.com` | || CAA | domain → allowed CAs | `0 issue "letsencrypt.org"` | |## Email DNS (Critical for OUTBOUND)### SPF```v=spf1 include:_spf.google.com include:sendgrid.net -all```- Authorizes which servers can send for your domain- **ONE SPF record per domain** (multiple = both fail)- `-all` (hard fail) in production, `~all` (soft fail) during testing- Max 10 DNS lookups — each `include:` costs 1-2- Exceeding 10 lookups = SPF broken silently### DKIM```selector._domainkey.yourdomain.com TXT "v=DKIM1; k=rsa; p=<public_key>"```- Cryptographic signature proving email wasn't modified- 2048-bit minimum key- Rotate every 6-12 months- Generated by email provider### DMARC```_dmarc.yourdomain.com TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com"```- `p=none` → monitor only (start here)- `p=quarantine` → spam folder- `p=reject` → block entirely (goal)- `rua` → aggregate reports destination## DNS for Vercel```Root domain: A → 76.76.21.21www subdomain: CNAME → cname.vercel-dns.comapi subdomain: CNAME → cname.vercel-dns.com```SSL auto-provisioned by Vercel via Let's Encrypt.## Cold Email Domains (OUTBOUND)- Separate from web/transactional domains- Each needs: A, MX, SPF, DKIM, DMARC, tracking CNAME- 301 redirect all outbound domains to primary domain- If blacklisted, doesn't affect password resets or web## TTL Strategy| Situation | TTL | Why ||-----------|-----|-----|| Stable records | 3600 (1h) | Reduce DNS queries || Before DNS change | 60 (1min) | Fast propagation || After change verified | 3600 | Back to normal || MX records | 3600 | Stability for email || DKIM/SPF | 3600 | Rarely changes |## Sources- Cloudflare DNS documentation- Google Workspace MX setup guide- DMARC.org specification- Vercel custom domains documentation## Changelog- 2026-03-21: Initial skill — DNS deep knowledge

Frequently asked questions