DNS records explained simply: a plain-English guide for small business

98% of Australian small business domains run no DNSSEC, 79% have no IPv6 address at the apex, and 95% publish no CAA record at all (Red Bridge Cyber SMB Posture Baseline, June 2026). DNS is the layer that turns your domain name into the address of your website, the address of your email server, the proof that you control your domain, and the boundary that decides who can sign mail as you. The default state of small business DNS is "whatever the registrar put there when you signed up in 2018," and that default is not safe.

This is a tour of the DNS records that actually matter to an Australian small business owner, in plain English, with no expectation that you set them yourself.

What DNS actually does

When someone types yourbusiness.com.au into a browser, the browser asks the global DNS system "where is this?" The system answers with an IP address, a string of numbers that identifies the server hosting your site. The browser then connects to that IP and asks for the page.

DNS sits between two layers you control: your domain registrar, who sells you the name, and your hosting provider, who runs the server. The records themselves usually live with your registrar or with a DNS specialist like Cloudflare. The owner-operator job is to know which records exist, what they do, and whether they are doing it correctly.

The records every small business should know

A and AAAA records point your domain at an IPv4 address (A) or an IPv6 address (AAAA). Almost every small business site has an A record. Only 21% have an AAAA record at the apex in our baseline, which leaves the other 79% invisible to visitors whose home or mobile internet is IPv6-first, and that share keeps growing.

MX records tell the world where to deliver email sent to your domain. If your MX record is wrong, nobody can email you. If it points at a server that has stopped working, your domain silently drops messages. We have seen six businesses this month where the MX still included defunct providers left over from a change made years before.

SPF, DKIM and DMARC are three records that together stop other people sending email as you. In our baseline, 93% of Australian small business domains publish SPF and 83% publish DMARC, but only 43% set DMARC strict enough (quarantine or reject) to actually stop spoofed mail. Spoofing is the mechanism behind most "I just got a weird invoice email from you" calls.

CAA records restrict which certificate authorities are allowed to issue HTTPS certificates for your domain. 95% of Australian small business domains publish no CAA record. The exposure is that any authority can issue a certificate for your domain to whoever asks, including an attacker.

DNSSEC signs your DNS records so resolvers can verify that the answer they got is the answer your registrar published. 98% of Australian small business domains run no DNSSEC. The exposure is DNS cache poisoning: an attacker substitutes their own IP for yours and intercepts everything that follows.

What to check yourself

Run this in a terminal:

dig yourbusiness.com.au MX

Or use MXToolbox's MX lookup in a browser. The answer should be the hostname of your email provider's server (commonly aspmx.l.google.com for Google Workspace, or mail.protection.outlook.com for Microsoft 365). If you do not recognise the answer, ask whoever set up your mail.

Run:

dig yourbusiness.com.au TXT

(Or use the same MXToolbox tool with "TXT" selected.) You should see at least one line starting with v=spf1. If you don't, your domain has no SPF and other people can send mail as you with no resistance.

Run:

dig _dmarc.yourbusiness.com.au TXT

You should see a line starting with v=DMARC1. If it contains p=none, DMARC is only monitoring and is not blocking spoofed mail. If there is no record at all, DMARC was never set up.

If you want to see what an uneven result looks like before you check your own, our examples page publishes a full scan of example.com, run exactly the same way a customer's site is: top marks for speed and DNS, failing grades for web security and search visibility.

What to ask whoever runs your DNS

Three questions, in order:

Does our domain have DNSSEC enabled, and if not, can it be turned on? At most registrars (Crazy Domains, VentraIP, Cloudflare, Route 53) it is a one-click change.

Does our domain publish a CAA record naming the certificate authority we actually use? If not, can it be added? Same registrar, same console, same one-click change.

Is our DMARC policy p=reject or p=quarantine? If it is p=none or absent, can it be moved to enforcement, in stages, with monitoring turned on first?

If your registrar cannot do any of those, your registrar is the problem. The auDA policy framework lets any accredited registrar support DNSSEC; some simply choose not to. Migrating is a half-day job.

The limits of what an outside scanner can tell you

We can read every record published in public DNS. We can tell you whether SPF, DKIM, DMARC, DNSSEC and CAA are present, what they contain, and whether they are configured correctly. We cannot tell you whether your internal DNS for office workstations is healthy, because that is private. We cannot tell you whether the person controlling your registrar account is who you think it is, because that is an identity question, not a DNS question.

Start with the three questions above. If you want a continuous view of the public DNS posture an external scanner sees, start a scan.

Common questions

What DNS records does a small business actually need? At minimum: an A (and ideally AAAA) record so people can reach your website, correct MX records so you receive email, and SPF, DKIM and DMARC so other people cannot send email as you. CAA and DNSSEC are the hardening layer most small businesses are missing: 95% publish no CAA and 98% run no DNSSEC in our June 2026 baseline.

How do I check my own DNS records? Use dig in a terminal or MXToolbox in a browser. Check MX for mail delivery, TXT for an SPF line starting v=spf1, and _dmarc.yourdomain for a v=DMARC1 line. If DMARC shows p=none or is missing, spoofed mail is not being blocked, and that is the first thing worth fixing.

Published by the Red Bridge Cyber team. Sources: Red Bridge Cyber SMB Posture Baseline, June 2026; auDA policy framework; ACSC small business hub; MXToolbox.