Records and mail authentication

The service-locator record: structure, where helpdesk techs meet them (Teams, SIP, autodiscover), and the format mistakes that break vendor onboardings.

A small DNS change with a delayed, expensive failure mode. Never publish a CAA without checking what currently issues.

Handing off a subdomain to a different DNS host, when glue is needed, and why delegation is escalation territory unless from a runbook.

Reverse DNS is owned by the IP-block holder, not the registrant. Editing PTR at the client's DNS host can't work; the fix is a ticket with the hosting provider.

The four ways to query DNS from the helpdesk, and the diagnostic split between authoritative and cached.

The gotcha that catches every tech once: dig ANY is neutered, AXFR is closed, and there is no public way to dump every record. The calibrated answer when a client says "send me all the records".

The three records (SPF, DKIM, DMARC) and why none of them alone solves the unauthenticated-email problem SMTP left open.

The two firm rules helpdesk techs trip over: only one SPF per domain, and a 10-DNS-lookup limit on evaluation. Both violations silently turn SPF off.

Per-message cryptographic signature, public key in DNS at a selector subdomain. The two forms (TXT or CNAME), and why multi-selector setups matter for key rotation.

The policy layer on top of SPF and DKIM. Adding p=none is helpdesk; ramping to enforcement is design and escalates.

The four-step routine to run after any SPF, DKIM, or DMARC change. Catches the four common errors before the client notices.