Advanced DNS & ExchangeDefender | ExchangeDefender [ Skip to content ](#main) [ ![ExchangeDefender](/assets/images/xd_logo_blue.png) ](/) Email Security ![Platform Overview](/assets/images/m-xd-pro.png)### ExchangeDefender PRO Enterprise-grade email security made simple for every business. [Sign Up](/sign-up) [Live Demo](/demo) [Email Security Stops spam, malware & phishing in real time. ](/email-security) [Encryption Secure your emails, attachments & sensitive data. ](/corporate-email-encryption) [Web File Sharing Easy, safe cloud file sharing with access control. ](/web-file-server) [Live Archive Locked-in email backup & continuity during outages. ](/livearchive-backup) [Emergency Inbox Keep email flowing without interruption if your provider fails. ](/inbox) [Spearphish Train your team with phishing simulations & risk tracking. ](/spearphishing) Managed Email ### Enterprise-Grade Managed Email Reliable, secure, and fully managed email operations for modern organizations. ![ExchangeDefender](/assets/images/managed_email_menu.png) [Microsoft365/Google Email Management Expert management and security for Microsoft 365 and Google Workspace email. ](/managed-email-operations) [AI Advisory Secure, practical AI consulting & implementation for SMBs. ](/management-ai) Company ### ExchangeDefender: 29+ Years of Trust We are a cybersecurity company focused on business email protection, with 29+ years of experience keeping organizations secure, connected, and resilient. ![ExchangeDefender](/assets/images/careers_1.png) [ About Us Learn our purpose, values, and the mission behind every decision. ](/about-us) [ Blog News, product updates and email security insights. ](/blog) [ Capabilities Discover the tech and expertise that keep your email secure around the clock ](/capabilities) [ Careers Be part of a team using modern tech to solve real threats and ship great work. ](/careers) [Partners](/partners) [Docs](/docs) [Contact Us](/contact) Talk to a Human Open menu Menu ---- Email Security [Email Security](/email-security) [Encryption](/corporate-email-encryption) [Web File Sharing](/web-file-server) [Live Archive](/livearchive-backup) [Inbox](/inbox) [Spearphish](/spearphishing) Managed Email [Microsoft365/Google Email Management](/managed-email-operations) [AI Advisory](/management-ai) Company [About Us](/about-us) [Blog](/blog) [Capabilities](/capabilities) [Careers](/careers) [Partners](/partners) [Docs](/docs) [Contact Us](/contact) Talk to a Human Search documentation On this page On this page ------------ - [DNS](#dns) - [MX](#mx) - [SPF](#spf) - [DKIM](#dkim) [ Documentation ](https://www-preview.exchangedefender.com/docs) [Documentation](https://www-preview.exchangedefender.com/docs)Advanced DNS & ExchangeDefender =================================== Advanced DNS & ExchangeDefender ExchangeDefender supports and implements many of the popular DNS-based email auth/signing protocols like SPF and DKIM. To properly implement, manage, and troubleshoot these mechanisms some advanced DNS understanding is required and we hope that this article gives you some basic understanding of how ExchangeDefender relies on these protocols, how to troubleshoot issues, as well as best practices. DNS [¶](#dns) --------------- DNS (Domain Name System) is often referred to as the “phonebook of the Internet” as it translates easy to remember server names ([www.exchangedefender.com](www.exchangedefender.com)) to IP addresses (65.99.255.247). When organizations want a domain name for their company, they go to a business called DNS registrar (Network Solutions, GoDaddy, NameCheap) who registers the domain name and tells the Internet where to find the name servers for the new domain. Name servers are operated by ISPs, major cloud providers, and DNS services that hold the address book for the organization – and their job is to hold all the server/hostname information about your domain and respond to DNS queries. Every time a computer on the Internet is looking for your domain name (to send you email, to look at your web page, etc) a DNS query is made by their computer and often saved locally for a short period of time (caching). DNS servers are a glue that holds the whole Internet together, so when there are DNS issues they often cause cascading problems with services that rely on them like web, email, VoIP, etc. We can troubleshoot DNS by simulating DNS lookups using a tool called nslookup. Here are some examples: Find an IP address of our web server: nslookup www.exchangedefender.com Find out where our mail is going, our MX record: nslookup -q=mx exchangedefender.com Get all the TXT records for the domain, like our SPF record: nslookup -q=txt exchangedefender.com Find our DKIM record: nslookup -q=txt default.\_domainkey.exchangedefender.com MX [¶](#mx) ------------- Mail Exchanger (MX) record designate the mail servers that all mail for your domain should be sent through. For all ExchangeDefender customers, that MX record is: Inbound30.exchangedefender.com To check if your MX record is configured properly, you can use the nslookup tool: C: > nslookup -q=mx exchangedefender.com Address: 8.8.8.8 Non-authoritative answer: exchangedefender.com MX preference = 10, mail exchanger = inbound30.exchangedefender.com If you see more than this in your MX listing, your email is not configured properly **Best practices**: We strongly encourage use of the single MX record. Clients at times use masking hostnames for vanity purposes, or add a third party caching MX record for failover purposes, both of which our support team will ask you to remove before doing any kind of troubleshooting. SPF [¶](#spf) --------------- SPF (Sender Policy Framework) record is used as an email authentication method to prevent sender address spoofing/forging, the most popular form of email identity theft on the Internet. Setting up an SPF record essentially designates a list of mail servers that may send email on behalf of your domain and any mail server that runs an SPF check can verify if the email is in fact legitimate. Using an SPF record with ExchangeDefender is really simple, it’s just ***“v=spf1 include:proxy.exchangedefender.com -all”*** C: > nslookup -q=txt ownwebnow.com Address: 8.8.8.8 Non-authoritative answer: ownwebnow.com text = “v=spf1 include:proxy.exchangedefender.com -all” The SPF record above is published in ownwebnow.com’s DNS and every time someone receives an email from an @ownwebnow.com address the remote server will check if the mail server delivering the message is authorized to relay it. In our case, our SPF record includes exchangedefender.com’s SPF record, allowing all the mail servers that exchangedefender.com uses to relay email to deliver messages on behalf of ownwebnow.com. When a mail server receives an email from a different source, that is not defined in our SPF record, the message is considered fraudulent and discarded. **Best Practices** Most organizations mess up their SPF records. If at all possible, leave the SPF record as recommended by ExchangeDefender. It bears repeating, most organizations mess up their SPF records. After you put any new SPF in production as requested by another organization, please use an SPF checking tool to make certain your new record is valid. ExchangeDefender exclusively recommends -all as the default mechanism, meaning if messages are coming from a mail server not listed in the SPF record the message should not be accepted. Use of the permissive mechanism, ~all, is not recommended or supported when it comes to spoofing or bouncebacks because those domains are often abused in backscatter SPAM schemes. For organizations that are unable/unwilling to follow this advice, ExchangeDefender has an exclusive “override” facility which is designed to block mail spoofing. This feature is available at [https://admin.exchangedefender.com](https://admin.exchangedefender.com) under the Domain Administrator, Mail Delivery > Phishing Options. ExchangeDefender will automatically move any mail that is originating outside of the ExchangeDefender network using your domain name into SureSPAM quarantine. This way you can use a permissive SPF record, and still have anyone forging your domain name end up in SureSPAM and out of your user’s mailbox. [https://exchangedefender.com/docs/domain#mail-delivery-phishing-options](https://exchangedefender.com/docs/domain#mail-delivery-phishing-options) DKIM [¶](#dkim) ----------------- DomainKeys Identified Mail (DKIM) is an email authentication mechanism that uses private/public key cryptography to authenticate that the message is really coming from a legitimate and designated source. DKIM public key is generated by ExchangeDefender and placed in your DNS zone as a txt record. DKIM private key is generated by ExchangeDefender as well, and an encrypted signature is included in every email that goes through the ExchangeDefender network. When the recipients mail server receives a message from you, they look up the DKIM public key via DNS use it to decrypt the signature. Since only the sender (ExchangeDefender, with the private DKIM key) can properly encrypt the signature, there is an additional layer of security assuring the recipient that the message is sent by you. ExchangeDefender DKIM implementation is simple and handled through our support system at [https://support.ownwebnow.com](https://support.ownwebnow.com). [ExchangeDefender DMARC (SPF & DKIM) Setup Guide](https://www.exchangedefender.com/docs/dmarc) - setup full DKIM + SPF + DMARC in under 5 minutes!. Once completed, you can verify it with nslookup: nslookup -q=txt default.\_domainkey.exchangedefender.com Address: 10.10.10.10 Non-authoritative answer: default.\_domainkey.exchangedefender.com text = "v=DKIM1; k=rsa; s=email; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDAYudhJDgtJzZvqslHsBKiFVZdC9j5aCxymCeJcH66La/fpJx3GwPDiG5j3FTl69G7UscyDTEGVblKJ26AE8NxJE82XNUIiajIjJd49KkvOo+zm6cgR4KQgdii1FIJHISeCPMLJu2wQ58A/bqb7P6XkRunHxk8moFuSxEfwRsXAwIDAQAB" Once your DKIM is in, please update the original support ticket and we will clear the domain for signing. **Best Practices** As with SPF, DKIM signatures are very specific and leave no room for error, typos, or mistakes. ExchangeDefender encrypts all outbound messages from your domain using default.\_domainkey name, and we only do so after the domain passes DKIM validation. We do so out of abundance of caution and our experience that it generally takes some checking and tweaking when putting in a new policy in place. For example, if we were to start signing your messages before the public DKIM key has been published in your DNS, remote mail servers would fail validation and reject messages. [ Next Analyzing SMTP Mail Headers → ](https://www-preview.exchangedefender.com/docs/analyzing-smtp-mail-headers) Solutions --------- - [Stop Spam & Malware](/email-security) - [Hands-Free Email Backup](/livearchive-backup) - [Instant Email Recovery](/inbox) - [Send Private Emails](/corporate-email-encryption) - [Train Against Email Threats](/spearphishing) - [Share Files Safely](/web-file-server) Company ------- - [About ExchangeDefender](/about-us) - [Compliance & Legal](/our-compliance) - [Become a Partner](/partners) - [Support Portal Login](https://support.exchangedefender.com/) - [Microsoft 365 Email Management](/managed-email-operations) - [AI Advisory Service](/management-ai) ![ExchangeDefender](/assets/images/dark-xd-logo.png)USA: +1 (407) 465-6800 United Kingdom: 0800 8620149 Australia: +61 0390010641 Fax: +1 (954) 839-8737 [ ](https://www.facebook.com/ExchangeDefender) [ ](https://www.twitter.com/XD_Defender) [ ](https://www.linkedin.com/company/exchangdefender) [ ](/blog) © 2026 Own Web Now Corp - All rights reserved </> with ❤️ in Orlando [SLA](/sla) [TOS](/tos) [PRIVACY](/privacy-end-users) [AUP](/aup) We're Here to Help 👋 -------------------- Tired of AI 🤖 and hold music? Request a call or text (sms/telco charges may apply) and someone with a brain and a pulse will get in touch with you promptly. Close modal Website Name Email Address Company Phone Preferred Contact Method Text me Call me Call Date Call Time Time Zone Eastern Central Mountain Pacific London Paris Madrid Berlin Tokyo Dubai Sydney Request Human Contact Submitting... Close Start Your Free Year -------------------- Enter your details and we will set up your free year of email protection. Close modal Website Full Name Email Continue Submitting... Close Try ExchangeDefender for Free 💰 ------------------------------- We look forward to helping you secure your email. We offer a free 30-day no-risk trial, just fill out the form below and one of our onboarding techs will get you started. If you'd just like to take a look at the demo, click here for a [live demo site](/demo). Close modal Website Name Email Address Company Phone Preferred Contact Method Text me Call me Call Date Call Time Time Zone Eastern Central Mountain Pacific London Paris Madrid Berlin Tokyo Dubai Sydney 💰 Get your free month Submitting... 🏃 Explore a Live Demo Submitting... Close Train Your Team Before the Hackers Do 👋 --------------------------------------- ExchangeDefender Spearphish is our new phishing simulation and training tool, designed to help your team spot scams before they click. Want to be first in line? Request early access or get a personal demo — just drop your name and email below. Close modal Website Name Email Address Company Phone Preferred Contact Method Text me Call me Call Date Call Time Time Zone Eastern Central Mountain Pacific London Paris Madrid Berlin Tokyo Dubai Sydney Request Early Access Submitting... Close