DNS configuration is one of those tasks that looks simple until something breaks.
A website may stop resolving, email may fail, a subdomain may point to the wrong service, or a third-party platform may refuse domain verification.
Most of these problems begin with the same thing:
the DNS zone is incomplete, incorrect, or managed in the wrong place.
This guide explains how to create a DNS zone, configure the most important DNS records, and verify that everything is working correctly.
What Is a DNS Zone?
A DNS zone is the part of the Domain Name System that contains the DNS records for a domain.
For example, the DNS zone for:
example.com
may contain records for:
www.example.com
mail.example.com
api.example.com
A zone can contain:
A records
AAAA records
CNAME records
MX records
TXT records
NS records
SOA records
The nameservers assigned to the domain determine which DNS provider controls the live zone.
LeadCanal's NS Record Guide explains how nameservers connect a domain to the DNS service that manages its records.
Step 1: Choose Your DNS Provider
Your DNS zone may be hosted by:
Your domain registrar
Your hosting provider
Cloudflare
Amazon Route 53
Azure DNS
Another managed DNS service
The important thing is to know which nameservers are authoritative for the domain.
A common mistake is editing DNS records in one platform while the domain is actually using another provider's nameservers.
In that case, your changes will not affect the live domain.
You can verify which nameservers are active with:
dig NS example.com
or:
nslookup -type=NS example.com
Step 2: Create the DNS Zone
The exact interface varies by provider, but the general process is similar.
Create a new DNS zone for:
example.com
The DNS provider will usually create basic records automatically, including:
SOA
NS records
If you are using a cloud DNS provider such as Route 53 or Azure, it will provide a set of nameservers.
Those nameservers must then be added at your domain registrar.
LeadCanal's NS guide covers this process for providers including Route 53 and Azure DNS.
Step 3: Add an A Record
An A record maps a hostname to an IPv4 address.
Example:
Type: A
Name: @
Value: 192.0.2.10
TTL: 3600
This might make:
example.com
resolve to:
192.0.2.10
You can verify it with:
dig A example.com
Step 4: Add a CNAME Record
A CNAME record points one hostname to another hostname.
Example:
Type: CNAME
Name: www
Value: example.com
This allows:
to resolve using the destination hostname.
CNAME records are also commonly used for:
SaaS integrations
Email providers
CDN services
Verification records
Marketing platforms
LeadCanal's CNAME Record Troubleshooting Guide explains how to identify CNAME misconfigurations and verify third-party integrations.
Step 5: Configure MX Records
MX records define which mail servers receive email for the domain.
A simplified example might look like:
Type: MX
Name: @
Priority: 10
Value: mail.example.com
If your business uses Google Workspace, Microsoft 365, or another hosted provider, use the MX records supplied by that provider.
You can inspect MX records with:
dig MX example.com
Incorrect MX records can prevent incoming email from working.
Step 6: Add TXT Records
TXT records are used for several purposes, including:
Domain verification
SPF
DKIM
DMARC
Security policies
This makes TXT records especially important for business email.
SPF
SPF identifies which systems are authorized to send mail for the domain.
LeadCanal provides an SPF Checker that performs live DNS checks and identifies missing, invalid, or problematic SPF records.
DKIM
DKIM uses cryptographic signatures to verify outgoing email.
The public key is usually stored under a selector such as:
selector1._domainkey.example.com
You can verify DKIM using the LeadCanal DKIM Checker.
DMARC
DMARC adds alignment, policy, and reporting on top of SPF and DKIM.
Example:
v=DMARC1; p=none;
You can inspect the current policy using the LeadCanal DMARC Record Lookup.
Step 7: Configure Email Authentication Together
Do not treat SPF, DKIM, and DMARC as unrelated records.
A safer email setup usually follows this sequence:
Identify all legitimate sending platforms
Create or update the SPF record
Publish DKIM keys
Enable DKIM signing
Verify SPF and DKIM
Publish DMARC
Monitor reports
Move toward stronger DMARC enforcement when ready
LeadCanal's SPF, DKIM and DMARC Setup Database explains this full authentication workflow.
Step 8: Verify the DNS Zone
After creating or editing the zone, test each important record.
Useful commands:
dig A example.com
dig MX example.com
dig TXT example.com
dig NS example.com
You can also verify multiple DNS and email-authentication records from one place with the LeadCanal Domain Scanner.
The scanner checks SPF, DKIM, DMARC, BIMI, and other DNS configuration issues that can affect email deliverability.
Step 9: Understand DNS Propagation
DNS changes are not always visible everywhere immediately.
Resolvers can cache old records until their TTL expires.
This is why a domain may:
Work on mobile data
Fail on office Wi-Fi
Show an old server in one country
Show the new configuration somewhere else
Before assuming the new configuration is broken, check whether the old record is still cached.
LeadCanal's NS record guide also explains DNS propagation and resolver caching behavior.
Common DNS Configuration Mistakes
Some of the most common mistakes are:
Editing DNS at the wrong provider
Incorrect A record IP
Broken CNAME destination
Missing MX records
Multiple SPF records
Missing DKIM selector
Incorrect DMARC syntax
Deleting the old DNS zone before migration is complete
Forgetting to update registrar nameservers
Copying third-party DNS records incorrectly
For email infrastructure specifically, LeadCanal's DNS & Email Authentication for Cold Email Guide covers SPF, DKIM, DMARC, MX records, verification, and troubleshooting together.
A Simple DNS Setup Checklist
Before considering your DNS zone complete, verify:
Nameservers → A/AAAA → CNAME → MX → TXT → SPF → DKIM → DMARC → propagation
If email is involved, always test authentication after making DNS changes.
Final Takeaway
Creating a DNS zone is not just about pointing a website to an IP address.
A correctly configured zone controls:
website routing + email delivery + domain verification + authentication + third-party services
The safest workflow is to configure records carefully, verify the authoritative nameservers, and test everything after changes are made.
For a complete multi-record check, use the LeadCanal Domain Scanner before troubleshooting individual records one by one.
Top comments (0)