Modern Domains in Practice: Registrar Choice, DNS, and Full SPF/DKIM/DMARC Setup
A domain costs $10 — sounds simple. But the same domain renews at 5x the price at certain registrars; one missing DNS record sends all your email to spam; after years of use you discover transferring out costs $60.
A domain is the foundation of every internet project. Wrong registrar, wrong DNS setup, wrong email authentication — almost every self-hosting enthusiast has stepped on these three traps.
This guide covers everything that happens after you buy a domain: how to pick a registrar, how to configure DNS records, how to nail the email anti-spam trinity (SPF + DKIM + DMARC), and finally DNSSEC and domain security.
Registrar Comparison
Mainstream Registrars
| Registrar | .com Renewal | Whois Privacy | Transfer Out | Verdict |
|---|---|---|---|---|
| Cloudflare Registrar | $9.77 (at-cost) | Free | Free | ⭐⭐⭐ Best for long holding |
| Porkbun | $10.37 | Free | Free | ⭐⭐⭐ Great UX, slow access in China |
| Namecheap | $14.58 | Free | Free | ⭐⭐ Veteran with frequent promo codes |
| Name.com | $12.99 | $9/year | Free | ⭐⭐ Average |
| GoDaddy | $21.99 | $9.99/year | Free | ⭐ Expensive renewals, lots of upsells |
| Aliyun Wanwang | ~$10 | Default ID-locked in China | Complicated | ⭐⭐ Needed for China ICP filing |
| Tencent Cloud DNSPod | ~$11 | Same | Complicated | ⭐⭐ Same |
Prices are early-2026 references — check the registrar for current pricing. Cloudflare Registrar promises near-wholesale renewal forever — no markup, no surprise hikes. Other registrars cannot match this.
My Recommended Strategy
International project / personal long-term holding:
- Register at Namecheap / Porkbun (first-year promos often $1-3)
- After the 60-day registrar lock, transfer to Cloudflare Registrar for the lifetime best renewal price
China business needing ICP filing:
Aliyun Wanwang / Tencent Cloud DNSPod. Once filed, transferring out is hard — plan carefully.
What to Look For in a Registrar
| Aspect | Key Question |
|---|---|
| Price | Not just first year — renewal price, transfer-in price, is privacy free? |
| Transfer policy | Is transfer-out free and smooth? (GoDaddy often delays) |
| Whois privacy | Default on? Charged extra? |
| DNS | Does it include free DNS? (Doesn't matter much — just use Cloudflare DNS) |
| Security | Registry Lock, 2FA support |
| Management | Is the control panel usable? Is the API complete? |
Cloudflare Registrar caveats (avoid surprises):
- Doesn't accept new registrations, only transfers from other registrars
- Must host DNS at Cloudflare
- Doesn't support all TLDs (.com/.org/.net/.io and other mainstream ones are fine)
DNS Record Types
The 6 Essentials
| Type | Purpose | Example |
|---|---|---|
| A | Domain → IPv4 | example.com → 1.2.3.4 |
| AAAA | Domain → IPv6 | example.com → 2001:db8::1 |
| CNAME | Domain → Another domain | www.example.com → example.com |
| MX | Mail server | example.com → mx.mail.com |
| TXT | Arbitrary text (most often verification) | example.com → "v=spf1 ..." |
| NS | Name servers | example.com → cf.dns.com |
Advanced (Common)
| Type | Purpose |
|---|---|
| SRV | Service discovery (SIP, Minecraft, Matrix) |
| CAA | Restrict which CAs can issue certificates for the domain |
| PTR | IP → Domain (reverse DNS, essential for mail servers) |
| DNSKEY / DS | DNSSEC-related |
| ALIAS / ANAME | CNAME alternatives for the apex (vendor-specific) |
Two CNAME Traps
Trap 1: The apex domain cannot use CNAME
example.com (the apex) can only use A/AAAA records pointing to IPs — not CNAME. To point the apex to another domain, you need:
- A vendor-provided ALIAS / ANAME / CNAME Flattening (Cloudflare's CNAME Flattening handles it transparently)
- Or A records pointing directly to IPs
Trap 2: CNAME can't coexist with other records
If www.example.com has a CNAME, it cannot also have MX/TXT records — this is enforced by RFC. If you need a subdomain to serve both web and email, either use A records or put email on the apex.
DNS Provider Comparison
The registrar and the DNS host can be different — newcomers often miss this. Register at vendor A, host DNS at vendor B, no problem.
| Provider | Free Tier | Performance | China Performance | Recommendation |
|---|---|---|---|---|
| Cloudflare DNS | ✅ Unlimited | Top-tier global Anycast | Mediocre (China Unicom OK) | ⭐⭐⭐ Default choice |
| DNSPod (Tencent) | ✅ Basic is enough | China's best | Best in China | ⭐⭐⭐ China mainland first pick |
| Aliyun DNS | ✅ | Strong in China | Excellent in China | ⭐⭐ For Alibaba Cloud ecosystem |
| Route 53 | ❌ ($0.5/zone/mo) | Strong global | Mediocre | ⭐⭐ AWS ecosystem |
| Google Cloud DNS | ❌ ($0.4/zone/mo+) | Strong global | Poor | ⭐ GCP ecosystem |
| NSOne | ❌ | Top-tier | Mediocre | ⭐⭐ Enterprise smart routing |
Recommended combos:
- International: register at Cloudflare, DNS at Cloudflare
- China: register at Aliyun/Tencent, DNS at DNSPod
- Mixed: register at Cloudflare (cheap), DNS at DNSPod (fast in China) — registrars don't force you to use their DNS
The Email Anti-Spam Trinity: SPF + DKIM + DMARC
If you send email from your domain (whether self-hosted mail, Mailgun/SendGrid, or app notifications), missing any of these three means landing in spam. Gmail tightened up in 2024 — high-volume domains without DMARC get outright rejected.
SPF (Sender Policy Framework)
Purpose: declare "which IPs/servers are allowed to send mail on behalf of this domain".
Add a TXT record at the apex:
Fields:
| Part | Meaning |
|---|---|
v=spf1 | Version, fixed |
include:_spf.google.com | Trust Google Workspace senders |
include:mailgun.org | Trust Mailgun |
ip4:1.2.3.4 | Trust this specific IP |
-all | Hard fail everything else (strictest, recommended) |
~all | Soft fail (don't reject, mark suspicious) |
?all | Neutral (not recommended) |
SPF has a hard limit of 10 DNS lookups — each include counts as one. Exceed it and the entire SPF record becomes invalid. include:_spf.google.com itself triggers 4 internal lookups — budget carefully.
DKIM (DomainKeys Identified Mail)
Purpose: sign email with public/private keys to prove the message wasn't tampered with in transit.
The mail provider generates the key pair, the public key goes into your DNS, and the private key signs mail on their servers.
Using Google Workspace as an example:
- Workspace console → Apps → Gmail → Email Authentication
- Generate a new record (default 1024 bits, recommended 2048)
- Get the selector and public key, add a DNS record:
The google in google._domainkey is the selector — different providers use different selectors, multiple selectors can coexist (one domain can have multiple DKIM records).
DMARC (Domain-based Message Authentication)
Purpose: tell receivers how to handle email that fails SPF/DKIM, and ask them to email you verification reports.
Minimal config:
Fields:
| Field | Meaning |
|---|---|
v=DMARC1 | Version |
p=none | Policy: none=observe only / quarantine=mark as spam / reject=outright refuse (the goal) |
rua=mailto:... | Aggregate reports go here (daily XML) |
ruf=mailto:... | Failure reports (optional, high volume) |
pct=100 | Apply policy to 100% of email (can be ramped) |
Gradual rollout path:
- Week 1:
p=none(observe only, no email actions) - Inspect reports to confirm legitimate mail passes SPF/DKIM
- Month 2:
p=quarantine; pct=10ramp - Slowly raise to
p=quarantine; pct=100 - Once stable, upgrade to
p=reject; pct=100
DMARC reports are hard to eyeball — use a free service like Postmark / dmarcian / Cloudflare DMARC Management to aggregate and analyze.
BIMI (Optional, Nice-to-Have)
Once DMARC reaches p=reject, you can configure BIMI to display your brand logo in Gmail/Apple Mail inboxes. Requires a VMC certificate ($1000+/year) — for brand email campaigns.
DNS in Practice: From Purchase to Production
Suppose you bought example.com and want to deploy:
- Main site
example.comat 1.2.3.4 - API
api.example.comat 5.6.7.8 - Cloudflare Pages at
app.example.com - Google Workspace email
- Vercel at
blog.example.com
Full record set:
Domain Security
1. Enable 2FA on Registrar Account
Namecheap/Porkbun/Cloudflare all support it. Strongly prefer hardware keys (YubiKey) over SMS.
2. Enable Registry Lock
Normal domain lock only prevents typos; Registry Lock is registry-level — any transfer/NS change requires manual phone confirmation. Only a few registrars support it (Cloudflare Enterprise / MarkMonitor). Worth it for critical domains.
3. Enable DNSSEC
Prevents DNS hijacking and cache poisoning — signs DNS responses.
One-click in Cloudflare; then add the DS record at the registrar:
- Cloudflare DNS settings → Enable DNSSEC, copy the DS record
- Registrar console → DNSSEC option → Paste the DS record
- Wait 24 hours for global propagation
Once enabled, browsers/resolvers reject forged DNS responses.
4. Whois Privacy
On by default. Hides your real name/email/phone from Whois lookups — avoids spam and social engineering.
5. Auto-Renewal + Multiple Reminders
Forgetting to renew and losing your domain to a squatter is a real thing. Check:
- ✅ Auto-renewal enabled
- ✅ Registrar contact email is actively used (many people use an abandoned one)
- ✅ Payment method (credit card) not expired
- ✅ Critical domains renewed for multiple years (5 or 10)
Debugging and Troubleshooting
Query DNS Records
Or use the DNS Lookup tool for a visual interface.
Global Propagation Check
DNS changes take time to propagate globally. Use:
- dnschecker.org: 50+ nodes simultaneously
- whatsmydns.net: same
Validate SPF/DKIM/DMARC
- mxtoolbox.com: comprehensive email config checks
- mail-tester.com: send mail to their address, get immediate score and detailed report
Bounced or Spam-Foldered Email
Check in this order:
- Are SPF/DKIM/DMARC all in place (mxtoolbox all green)?
- Is the sending IP on a blacklist (mxtoolbox covers this)?
- Is there a PTR reverse DNS record (critical for self-hosted mail)?
- Does the email content contain spam triggers?
Summary
Domain + DNS looks like "background infrastructure", but configuration quality directly determines availability and security of the whole project:
| Key Decision | Recommendation |
|---|---|
| Registrar | Namecheap year 1 → transfer to Cloudflare year 2 |
| DNS provider | International: Cloudflare; China: DNSPod |
| Apex pointing to another domain | A records or CNAME Flattening |
| Email config | SPF + DKIM + DMARC trinity (DMARC ramps to reject) |
| Domain security | 2FA + DNSSEC + Whois Privacy + multi-year renewal |
Three don'ts:
- Don't hold domains long-term at GoDaddy (expensive renewals)
- Don't configure SPF without DMARC (post-2024 Gmail enforcement is strict)
- Don't skip CAA records (prevents any CA from issuing a cert for your domain)
Tooling combo: use the DNS Lookup tool to verify records are live, IP Lookup tool to confirm the resolved IPs are correct — paired with mxtoolbox for email specifics, you cover 95% of day-to-day domain operations.