GoDaddy

Guide: Implement DKIM and DMARC for Google Workspace

A technical step-by-step guide explains how to configure DKIM and DMARC for domains managed in Google Workspace. The article describes enabling DKIM via the Google Admin console (generating a DKIM TXT record, adding it to DNS, then starting authentication) and building a DMARC TXT record (with example tags and reporting addresses) placed at the _dmarc subdomain. It covers alignment requirements with SPF, recommended initial DMARC policy (p=none), DNS TTL suggestions, propagation timing, monitoring DMARC aggregate/forensic reports, common troubleshooting issues, and best practices for gradual policy enforcement to improve deliverability and protect brand reputation.

DNS Security Checklist for Small Businesses

A practical, beginner-friendly checklist for small business domain and DNS security. The guide prioritizes securing the domain registrar (2FA, transfer lock, current contact email, auto-renew), configuring email authentication (SPF, DKIM, DMARC with enforcement at p=quarantine or p=reject), and validating website SSL and redirects. It also covers DNS best practices (DNSSEC, MTA-STS, CAA records), blacklist checks, and monitoring options. The article lists simple tools and checks (MXToolbox, Verisign Labs DNSSEC analyzer, SSLShopper, internet.nl) and recommends either quarterly manual reviews or automated monitoring (ZeroHook offers a free tier for one domain). Publication date: 2026-06-04.

Automating SOC2 CC6.6 DNS and Email Evidence

This technical guide explains how SOC2 Trust Services Criterion CC6.6 applies to DNS and email controls and shows how to automate evidence collection so auditors can verify continuity across an audit period. It identifies five specific controls auditors test — DMARC enforcement (p=quarantine/reject), SPF/DKIM coverage for all senders, MTA-STS in enforce mode, DNSSEC validation, and CAA records — and details the evidence auditors require (timestamped records, DMARC RUA reports, continuous logs). The guide warns auditors evaluate control state at the start of the audit window (so p=none during any part of the period is a failure) and emphasizes MFA on all accounts that can modify DNS/email settings. It recommends continuous, timestamped scanning and tamper-evident logs to replace manual, point-in-time evidence assembly.