Category: DNS

Domain-based Message Authentication, Reporting, and Conformance (DMARC) records can be used with SPF and/or DKIM records to help protect domains against email spoofing.

A DMARC record is added to DNS as a TXT record. There are 5 key parts to a DMARC record:

• The Host Name: This is always _dmarc
  
  The host name is required in a DMARC record
• The Version Number: This is always v=DMARC1, which means the first version of DMARC.
  
  The version number is required in a DMARC record
• The Policy: This tells mail servers what to do if a message fails SPF and/or DKIM checks. The policy can be to reject an email, quarantine and email, or to do nothing. Setting p=reject means messages won’t be delivered if they fail checks. Setting p=none means the receiving mail server can decide what to do. Setting p=quarantine means the mail will get delivered but it will be marked as spam.
  
  A policy is required in a DMARC record.
• The Reports Address: This lets you collect statistics on email usage on your domain and how often messages fail SPF and DKIM checks. The general format is rua=mailto:dmarcreport@example.com, where you replace dmarcreport@example.com, with an address that should receive the statistics.
  
  A Reports address is optional in a DMARC record.
• The Authentication Methods: You can specify if SPF and/or DKIM should be checked, and whether the checks should apply to sub-domains.
  
  Authentication methods are optional.

A DMARC record if you only want statistics

You can add this record if you want statistics about email usage without doing anything else.

Host Name: _dmarc
Text: v=DMARC1; p=none; rua=mailto:dmarcreport@example.com

Replace dmarcreport@example.com with an address that should receive reports about messages sent from the domain.

A DMARC record if you want to quarantine mail

You can add this record if you want to quarantine mail that fails checks.

Host Name: _dmarc
Text: v=DMARC1; p=quarantine; rua=mailto:dmarcreport@example.com

You can remove ; rua=mailto:dmarcreport@example.com if you do not want to receive statistics.

Additional Information About DMARC Records

Authentication methods can be SPF, DKIM, or both. The methods also include whether you want Strict matching or Relaxed matching.

Strict matching means the domain in the From address must match the domain in the headers. Relaxed means the domain in the From address can match with the domain or subdomain in the headers. If you send email from name@example.com but the message comes from name@mail.exmaple.com, strict matching will not authenticate the message. Relaxed matching will authenticated the message. If you mail host uses sub-domains, you may want to use relaxed matching.

You can add one type of DKIM matching and/or one type of SPF matching, but you can’t use both relaxed and strict matching for the same type of authentication. Here are some options you can add to your record:

adkim=r;	Use DKIM authentication with relaxed matching
adkim=s;	Use DKIM authentication with strict matching
aspf=r;	Use SPF authentication with relaxed matching
aspf=s;	Use SPF authentication with strict matching

You can visit the DMARC FAQ for more detailed information.

DomainKeys Identified Mail (DKIM) records are a way to authenticate email sent from a domain. DKIM requires setup in DNS and on the sending email server(s).

A DKIM record is added to DNS as a TXT record. The record contains a public digital key. The sending email servers are set up with a private digital key. When an email is sent, the sending server uses the email and the private key to generate a digital signature. The signature is added to the email headers. Receiving email servers verify the digital signature using a public key from the TXT record. If an email has fake headers or has been tampered with, the signature won’t be valid. A separate DMARC record can be used to tell mail servers what to do if the signature isn’t valid.

The sending email server uses a private digital key to generate a digital signature which is added to the email headers. The receiving email server verifies the signature using a public digital key from the DKIM DNS record. If an email has fake headers or has been tampered with, the signature won’t be valid.

How to Add a DKIM Record

Contact your email provider if you want to use DKIM. Your provider will give you a TXT record to add to your domain. The record will have a selector and signature. You can add the record as a TXT record:

  Host Name: selector._domainkey
(replace selector with the selector name provided by your email host)
Text: paste the signature text provided by your email host

The email host will then verify that the record was added. After they verify, they can start using a private key to sign outgoing email from your domain. 

DKIM Records with Pair Networks

If you use Pair Networks for email, you can set up DKIM through the Account Control Center:

1. Log in to the Account Control Center.
2. In the left sidebar, click Domains.
3. In the drop-down, click Manage Your Domain Names.
4. Click the domain you want to add DKIM to.
5. Scroll down to the DomainKeys Identified Mail (DKIM) section, and click Change DKIM Settings.
6. Click Activate DKIM.
   If you use Pair Networks name servers, the records are added automatically and you don’t need to do anything else. You can skip the rest of these steps.
   If you use Pair Domains Custom DNS, you will need to manually add the records.
7. In a new browser tab, log into the Domain Name Management System.
8. Click the domain to update.
9. If Custom DNS is already on, click Edit DNS.
   If Custom DNS is not on, click Use our DNS, and confirm changing the name servers.
10. Click Add New Record
11. Select TXT from the Add New Record menu
12. Paste the DKIM Hostname from the Account Control Center into the Host Name box
13. Paste the DKIM TXT Record Value from the Account Control Center into the Text box
14. Click Add Record

Sender Policy Framework (SPF) records are a way to authenticate emails sent from a domain. Spam and phishing emails often use fake From and Reply-To addresses to hide the actual senders. An SPF record lists mail servers that are allowed to send email from a domain. If an email is sent from a server that is not listed in the SPF record, the receiving email host knows the message is spam.

An SPF record is added to Custom DNS as a TXT. You want to make sure that any mail servers you use are included in the record. A server missing from the records may cause undelivered mail.

How to Add an SPF Record

Contact your email provider(s) to get their recommended records. If you use multiple providers, all of them need to be combined into a single record.

When you have the information, you can add the record to Custom DNS as a TXT record:

1. Log into to the Domain Name Management System.
2. Click the domain to update.
3. If Custom DNS is already on, click Edit DNS.
   If Custom DNS is not on, click Use our DNS, and confirm changing the name servers.
4. Click Add New Record.
5. Select TXT from the Add New Record menu.
6. Enter @ as the Host Name, or leave the field blank.
7. Enter the SPF record from the into the Text box.
8. Click Add Record.

SPF Records with Pair Networks

If you use Pair Networks for email, you can create a default SPF record that will include any Pair Networks server that might send email for a domain. You can follow these steps to generate the SPF record:

1. Log into the Account Control Center.
2. Click Domains.
3. Click Manage Your Domain Names.
4. Click the domain to update.
5. Click Change SPF Settings.
6. If you use Pair Networks name servers, you can click Activate SPF to activate the record. Then you can skip the rest of these steps.
   If you use Pair Domains name servers, copy the displayed SPF record.
7. In a new browser tab, log into to the Domain Name Management System.
8. Click the domain to update.
9. If Custom DNS is already on, click Edit DNS.
   If Custom DNS is not on, click Use our DNS, and confirm changing the name servers.
10. Click Add New Record.
11. Select TXT from the Add New Record menu.
12. Enter @ as the Host Name, or leave the field blank.
13. Paste the SPF record from the Account Control Center into the Text box.
14. Click Add Record.

Please Note: If you use additional email services like mailing lists, you should contact your service provider to find out what additional information might need to be added to the SPF record.

Additional Information About SPF Records

The host name for SPF records is usually @. That means the record is for the domain itself. It affects email from mailbox@example.com. If you want the record to affect email from mailbox@subdomain.example.com, you can enter subdomain as the host name.

The Text field always starts with v=spf1 which means the record uses the first version of SPF. That is followed by a list of servers authorized to send email. The servers may be listed as IP addresses and/or host names. These are the primary ways you can list the mail servers:

Mechanism	Meaning
a	the A record for the domain itself
a:host_name	the A record for host_name
include:host_name	include the TXT record for host_name
ip4:ipv4_address	the specified IPv4 address or addresses
ip6:ipv6_address	the specified IPv6 address or addresses
mx	the mx record for the domain itself
mx:host_name	the mx record for host_name

There are additional mechanisms, but you are unlikely to use them unless your mail host requests them.

The record ends with a qualifier and the word all. This tells mail servers what to do with messages that come from unauthorized servers.

Using ~all is a soft failure. This means messages that fail SPF checks will be flagged as likely spam but the messages are still delivered.

Using -all is a hard failure. This means message that fail SPF checks will not be delivered.

SPF Lookup Limits

Mail Servers are limited to 10 DNS lookups that can be performed when checking SPF records. It is unlikely that you will encounter this limit, but it is possible.

When checking the SPF record, the IP4 and IP6 mechanisms do not require lookups because they contain the actual IP addresses. Each A, MX, and INCLUDE mechanism will require at least one lookup. Each A requires one to find the IP address of the domain or host name. Each MX requires at least two. The first is to find the mail server(s) listed in the MX record. Then each mail server in the MX record has to be checked to find the corresponding IP address(es). If a domain has multiple MX records, each record needs to be checked and counts as an additional DNS lookup.

Using Google’s Search Console requires verifying that you own a domain. Before starting, check the DNS settings for your domain. If you use our name servers, we can help with verifying a domain. If you use other name servers, you should contact your web host and/or DNS provider to check what methods of verification they support.

These steps will work if you use our name servers:

1. Log into your Google account.
2. Go to https://search.google.com/search-console/welcome.
3. Select Domain as the property type.
4. Enter the domain without www. in the front, and click Continue.
5. Google will display some text that starts with google-site-verification= and is followed by a string of characters. Copy that text.
6. Log into our Domain Name Management System.
7. Click the domain to update.
8. If Custom DNS is already on, click Edit DNS.
   If Custom DNS is not on, click Use our DNS, and confirm changing the name servers.
9. Click Add New Record.
10. Select TXT from the Add New Record menu.
11. Enter @ as the host name and paste the text from Google into the text field.
12. Click Add Record.
13. Go back to Google and click Verify.

Traditionally, DNSSEC has been difficult to set up and use. Multiple digital keys are needed to sign records, and keys need to be changed on a regular basis. Changing keys involves uploading new files at the domain name registrar, allowing for a period where both the old and new keys are used, and then deleting the old keys. The frequency of changes varies depending on the type of keys.

We’ve made DNSSEC easy. If you use pair Domains name servers, all you have to do is click a button. We take care of generating and changing the keys.

You can follow these steps to use DNSSEC with our name servers:

1. Log into the Domain Name Management System.
2. Click the domain to update.
3. If Custom DNS is already on, click Edit DNS.
   If Custom DNS is not on, click Use our DNS, and confirm changing the name servers.
4. Under DNSSEC, select ON.

If you use name servers from other providers, you can add DNSSEC records by following these steps:

1. Log into the Domain Name Management System.
2. Click the domain to update.
3. Click Upload DS Records.
4. You can add records by entering the Key Tag, selecting the Algorithm, selecting the Digest Type, and entering the Digest.
   Alternately, you can upload a DSSET file.

You can register name servers within your domain, like ns1.example.com and ns2.example.com. Most customers will not need to do this, and you should only do this if you manage your own name servers.

You can follow these steps to create a name server based on your domain:

1. Log into the Domain Name Management System.
2. Select Account Settings from the drop-down navigation menu.
3. Click Child Hosts.
4. Select the domain of the name server, and click Continue.
5. Enter the new name server name and IP address, and click Create.

This will register the name server with every top-level registry that we work with.

You can follow these steps to change the IP address of a name server that is registered through us:

1. Log into the Domain Name Management System.
2. Select Account Settings from the drop-down navigation menu/
3. Click Child Hosts.
4. Select the domain of the name server, and click Continue.
5. Click Modify next to the name server.
6. Enter the new IP address or addresses, and click Modify.

Domain Name System Security Extensions (DNSSEC) is a method of adding security to DNS to protect against forged or manipulated DNS information.

Standard DNS information is not authenticated, name servers trust any response they receive. Since they trust any response, it is possible for somebody to send incorrect information to a name server. Once the name server has the incorrect information, anyone else who uses that name server will see the incorrect info. An attacker could use this to temporarily disable or redirect a domain.

DNSSEC adds security by letting name servers verify that DNS info is coming from the correct place. When DNSSEC is set up, DNS records are digitally signed. When checking records, name servers check for a signature and compare it to the correct signature. If there is no signature or if the signatures don’t match, the name server will not trust or save the incorrect information.

Failure to keep DNSSEC records up to date can cause problems with resolving DNS records. If you use Pair Domains DNSSEC, we keep the records up to date, so this should only be an issue if a domain uses DNSSEC on other name servers.

The registry for UK domains, Nominet, accepts no liability in relation to the use or operation of DNSSEC records. They will take reasonable steps to correct any error that is the result of a mistake on Nominet’s part, but they accept no liability for the error.

To learn how to use DNSSEC, please visit our Knowledge Base article Using DNSSEC.

If you have a server attached to a business-class network, the server probably has a static IP address. This means that the network address the server uses does not change from one day to the next. You can easily create Custom DNS records pointing to static IP addresses and they do not require using Dynamic DNS.

However, computers connecting to the Internet through residential Internet service (home fiber, cable modem, DSL, or dial-up) can have dynamic IP addresses. When you connect, the provider assigns an IP address. It may be an address you have used before, or it may be a new IP address. Depending on your Internet service provider, the IP address could change after weeks, days, or even hours.

Dynamic DNS updates DNS records on our name servers within minutes of a change to your IP address. It works by running a simple client on your computer, which connects to us frequently. When we detect that your IP address has changed, we update your DNS records to match.

For a practical example, let’s say you want to access your home computer while you are at work. You set up Pair Domains Dynamic DNS. With Dynamic DNS, you can create a host name like yourserver.example.com. This host name will allow you to find your home server even if your IP address changes.

Using Dynamic DNS

To use Dynamic DNS, you need to be using our name servers. Any domain registered with us can use our name servers and Dynamic DNS at no extra cost.

If you are not already using our Custom DNS, please follow these steps to set it up:

1. Log into the Domain Name Management System.
2. Click the domain to update.
3. If Custom DNS is already on, click Edit DNS.
   If Custom DNS is not on, click Use our DNS, and confirm changing the name servers.
4. Add any records that won’t be updated with Dynamic DNS. You can add records individually, or you can import a DNS zone file with multiple records
5. Click Enable Dynamic DNS.
6. Read and agree to the Pair Domains Terms of Service and the Pair Domains Dynamic DNS Terms of Service.
7. Click Enable Dynamic DNS.
8. You will be given a  Dynamic DNS Key. You will need this later. It is a good idea to copy it and save it somewhere, but you can come back to this screen to get the key again later.

Finally, you will need to set up a client on your computer to contact us when your IP address changes. We provide a Web client:

1. Go to: https://dynamicdns.pairdomains.com/
2. Enter your Dynamic DNS Key and the hostname you want to update. If you want to update dynamic.example.com, you would enter it here, and click Continue.
   
   *Important* If you previously had a record set up in your Custom DNS for dynamic.example.com, it will now be over-written, and the old information will be lost.
3. Read the next page, agree to the Terms of Service, and click Enable Dynamic DNS.
4. Minimize your browser window and leave it running. As long as the window is open, your DNS will continue to update.

Other Dynamic DNS Clients

You can use other Dynamic DNS clients that support the dyndns2 protocol. When you set up your client, you can enter this information:

Username: pairdomains
Password: dynamic_dns_key
Alias or Host Name: the domain or sub-domain that you want to update
Dynamic DNS Server Name: dynamic.pairdomains.com
Dynamic DNS Server URL: /nic/update?
IP Server Name: myip.pairdomains.com /

The IP Server Name field might need to be entered as “Other Information” or “Other Settings” using this format: ip_server_name myip.pairdomains.com /

Please note: connections should be limited to every 5 minutes (300 seconds).

Direct URL

If you want to call a URL directly, this format will work:

https://pairdomains:dynamic_dns_key@dynamic.pairdomains.com/nic/update?hostname=hostname_to_update

ddclient

ddclient is a Perl based dynamic DNS client available from SourceForge. To run ddclient, you should create a configuration file named ddclient.conf. It should contain this information:

daemon=300 # check every 300 seconds
syslog=yes # log update msgs to syslog
pid=/var/run/ddclient.pid
ssl=yes
use=web,
web=https://myip.pairdomains.com/,
web-skip=’IP Address:’
protocol=dyndns2
server=dynamic.pairdomains.com
login=pairdomains
password=dynamic_dns_key
hostname_to_update

Before running it, make sure that there is a /var/cache directory on your computer. If you do not have one already, you can make one. Then this command can be used to run ddclient:

sudo /full/path/to/ddclient -daemon=0 -file /full/path/to/ddclient.conf

If you run into problems with ddclient, please run this command and send us the full output:

sudo /full/path/to/ddclient -debug -verbose -noquiet -daemon=0 -file /full/path/to/ddclient.conf

Router Software

DD-WRT software can be run directly on some routers. These settings should work:

DDNS Service: Custom DYNDNS
DYNDNS Server: dynamic.pairdomains.com
Username: pairdomains
Password: dynamic_dns_key
Hostname: hostname you want to update
URL: /nic/update?
Additional DDNS Options: –ip_server_name myip.pairdomains.com /
Use external ip check: no
Use SSL: yes
Force update interval:10

pfSense is an open source firewall/router computer software distribution based on FreeBSD. These settings should work:

Service Type: Custom
Username: [leave blank]
Password: [leave blank]
Update URL: https://pairdomains:dynamic_dns_key@dynamic.pairdomains.com/nic/update?hostname=hostname_to_update

Unifi Gateway

If you use Unifi Gateway, you can use this information in your configuration file

Service: custom
hostname = “hostname you want to update”
username = “pairdomains”
password = “dynamic_dns_key”
ddns-server = “dynamic.pairdomains.com/nic/update?hostname=hostname_to_update”