# Dns Deep Knowledge

> DNS mastery — record types, email deliverability (SPF/DKIM/DMARC), Vercel DNS, cold email domains, Cloudflare specifics.

- Skill: `nickgallick/dns-deep-knowledge` (Agent Skill)
- Install (CLI): `npx skillmds add nickgallick/dns-deep-knowledge`
- Raw SKILL.md: https://api.skillmd.com/api/skills/nickgallick/dns-deep-knowledge/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Productivity
- Author: nickgallick (https://skillmd.com/u/nickgallick)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/nickgallick/dns-deep-knowledge

---


# DNS Deep Knowledge

## Review Checklist

- [ ] SPF record exists and is valid (one record, <10 lookups)
- [ ] DKIM configured for all sending services
- [ ] DMARC policy set (at least `p=none` for monitoring)
- [ ] MX records point to correct mail provider
- [ ] TTL appropriate (3600 stable, 60-300 during changes)
- [ ] No conflicting CNAME records
- [ ] CAA record restricts certificate issuance

---

## Record Types

| Type | Maps | Example | Notes |
|------|------|---------|-------|
| A | domain → IPv4 | `76.76.21.21` | Vercel's IP |
| AAAA | domain → IPv6 | | |
| CNAME | domain → domain | `cname.vercel-dns.com` | Can't coexist with other types on same name |
| MX | domain → mail server | `10 mx1.google.com` | Priority + hostname |
| TXT | domain → text | SPF, DKIM, DMARC, verification | |
| NS | domain → nameserver | `ns1.cloudflare.com` | |
| CAA | domain → allowed CAs | `0 issue "letsencrypt.org"` | |

## Email DNS (Critical for OUTBOUND)

### SPF
```
v=spf1 include:_spf.google.com include:sendgrid.net -all
```
- Authorizes which servers can send for your domain
- **ONE SPF record per domain** (multiple = both fail)
- `-all` (hard fail) in production, `~all` (soft fail) during testing
- Max 10 DNS lookups — each `include:` costs 1-2
- Exceeding 10 lookups = SPF broken silently

### DKIM
```
selector._domainkey.yourdomain.com TXT "v=DKIM1; k=rsa; p=<public_key>"
```
- Cryptographic signature proving email wasn't modified
- 2048-bit minimum key
- Rotate every 6-12 months
- Generated by email provider

### DMARC
```
_dmarc.yourdomain.com TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com"
```
- `p=none` → monitor only (start here)
- `p=quarantine` → spam folder
- `p=reject` → block entirely (goal)
- `rua` → aggregate reports destination

## DNS for Vercel

```
Root domain:     A    → 76.76.21.21
www subdomain:   CNAME → cname.vercel-dns.com
api subdomain:   CNAME → cname.vercel-dns.com
```
SSL auto-provisioned by Vercel via Let's Encrypt.

## Cold Email Domains (OUTBOUND)

- Separate from web/transactional domains
- Each needs: A, MX, SPF, DKIM, DMARC, tracking CNAME
- 301 redirect all outbound domains to primary domain
- If blacklisted, doesn't affect password resets or web

## TTL Strategy

| Situation | TTL | Why |
|-----------|-----|-----|
| Stable records | 3600 (1h) | Reduce DNS queries |
| Before DNS change | 60 (1min) | Fast propagation |
| After change verified | 3600 | Back to normal |
| MX records | 3600 | Stability for email |
| DKIM/SPF | 3600 | Rarely changes |

## Sources
- Cloudflare DNS documentation
- Google Workspace MX setup guide
- DMARC.org specification
- Vercel custom domains documentation

## Changelog
- 2026-03-21: Initial skill — DNS deep knowledge