Help4 Net
DNS learning center

DNS and email setup without guesswork.

Move a domain to Help4, preserve website and email service, configure SPF, DKIM, and DMARC, and verify the result before enforcing anything that can reject legitimate mail.

Open free checkerChoose your registrar

Watch the short walkthroughs

Move nameservers safely

Find the registrar, preserve the zone, replace old nameservers, and verify Help4 answers.

SPF, DKIM, and DMARC

Authorize senders, publish signing keys, monitor alignment, and move toward enforcement safely.

Choose a focused walkthrough

Registrar nameserver cutover

GoDaddy, WordPress.com, Namecheap, Squarespace, preflight, DNSSEC stop conditions, and post-cutover proof.

Google Workspace email DNS

MX, one SPF record, provider-generated DKIM, DMARC monitoring, and message-header verification.

Microsoft 365 email DNS

Tenant-specific mail routing, SPF, both DKIM CNAME selectors, alignment, and staged enforcement.

cPanel and website forms

Local versus remote routing, authenticated SMTP, aligned From addresses, host SPF, and cPanel DKIM.

Email DNS troubleshooting

Symptom-based checks for delivery failures, SPF errors, unsigned mail, alignment, forwarding, DNSSEC, and propagation.

DNS record types

Beginner examples for A, AAAA, CNAME, MX, TXT, SRV, CAA, NS, names, priorities, and TTLs.

Proxy versus DNS-only

Choose safe delivery modes for websites, APIs, mail, verification records, and private services.

DNSSEC cutover

Understand DS, DNSKEY, RRSIG, persistent signing, validation, stop conditions, and rollback.

Cutover verification

Prove authority, recursive DNS, visual rendering, TLS, edge controls, origin protection, and email.

Before changing nameservers

  1. Find the registrar. This is where the domain is paid and renewed. It may not be the website host or email provider.
  2. Export every DNS record. Preserve A, AAAA, CNAME, MX, TXT, SRV, CAA, verification, SPF, DKIM, and DMARC records.
  3. Build and review the Help4 zone. Mail records must exist before delegation changes.
  4. Coordinate DNSSEC. Old parent DS records must not point at keys from the previous DNS provider.
  5. Change only nameservers. Use ns1.help4.net through ns6.help4.net.
  6. Verify the complete service. Check NS, website, TLS, email send/receive, DKIM signing, and DMARC reports.

Provider paths

ServiceWhere to change nameserversWhat not to loseOfficial help
GoDaddyDomain Portfolio → domain → DNS → NameserversExport the zone and review Domain Protection/DNSSEC prompts.GoDaddy guide
WordPress.comUpgrades → Domains → domain → Name servers → disable WordPress.com nameserversWordPress.com-hosted DNS stops applying; recreate email and verification records first.WordPress.com guide
NamecheapDomain List → Manage → Nameservers → Custom DNSHost records do not move automatically.Namecheap guide
SquarespaceDomains dashboard → domain → DNS → Domain NameserversSquarespace DNS and attached Google Workspace records must be recreated.Squarespace guide
Other registrarLook for Nameservers, DNS delegation, authoritative DNS, or custom nameservers.Do not create glue records or enter IP addresses for a normal Help4 cutover.Interactive helper

What each email record does

MX: where mail is received

MX records route incoming mail. Lower priority values are preferred. They do not authorize outgoing senders.

SPF: who may send

One TXT record at the sending domain lists authorized IPs and provider includes. SPF has a ten-DNS-lookup processing limit.

DKIM: signed outbound mail

The provider keeps the private key and signs messages. DNS contains only the public key at selector._domainkey.

DMARC: alignment and policy

DMARC checks whether SPF or DKIM passes and aligns with the visible From domain, then applies monitoring, quarantine, or rejection policy.

Safe setup order

1. InventoryList mailboxes, forms, CRMs, invoices, newsletters, scanners, and support tools that send mail.
2. SPF + DKIMPublish one SPF record and every provider's exact DKIM record. Confirm outbound messages are signed.
3. DMARC monitorStart with p=none and collect aggregate reports at a monitored address or service.
4. EnforceAfter aligned legitimate traffic is proven, move gradually to quarantine and then reject.

Record examples

Examples are not universal answers. Combine only the services that actually send for your domain and use provider-generated DKIM values.
Google SPF@ TXT "v=spf1 include:_spf.google.com ~all"
Microsoft SPF@ TXT "v=spf1 include:spf.protection.outlook.com ~all"
Google + host@ TXT "v=spf1 include:_spf.google.com ip4:YOUR_SERVER_IP ~all"
DMARC monitor_dmarc TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com; adkim=r; aspf=r;"
Google DKIMgoogle._domainkey TXT "v=DKIM1; k=rsa; p=PROVIDER_PUBLIC_KEY"
Microsoft DKIMselector1._domainkey CNAME PROVIDER_TENANT_TARGET

Provider email setup

Google Workspace

  1. Add Google's SPF include alongside every other legitimate sender.
  2. In Google Admin, generate the DKIM record and publish its exact selector/value.
  3. After DNS is visible, start DKIM authentication in Google Admin.
  4. Wait until SPF and DKIM are stable before DMARC enforcement.

Google SPF · Google DKIM · Google DMARC rollout

Microsoft 365

  1. Publish the Microsoft SPF include with other legitimate senders.
  2. Create the two tenant-specific DKIM CNAME records shown by Microsoft 365.
  3. Enable DKIM signing after both CNAMEs resolve.
  4. Publish DMARC and validate alignment before enforcing.

Microsoft authentication overview · Microsoft DKIM

cPanel and website forms

  1. Open cPanel → Email Deliverability for the domain.
  2. Use its DKIM key and SPF guidance, but merge SPF into the single existing record.
  3. Add the hosting IP only when that server actually sends mail.
  4. Prefer authenticated SMTP from WordPress/forms instead of unauthenticated local PHP mail.

Multiple senders

Google or Microsoft may host mailboxes while cPanel sends forms and another platform sends newsletters. SPF must include every required source, but DKIM alignment from each sender is preferable to continually expanding SPF.

DNS and email FAQ

Can I publish two SPF records?

No. Merge authorized sources into one SPF TXT record at each hostname. Multiple SPF records produce a permanent error.

Should my website server IP be in SPF?

Only if that server sends mail using the domain. Hosting a website, receiving form submissions, or appearing in an A record does not by itself authorize mail.

Does changing nameservers transfer my domain?

No. Registration, renewal, and billing stay with the registrar. Help4 becomes the authoritative DNS provider.

Why did email stop after nameserver cutover?

The new zone is usually missing MX, SPF, DKIM, DMARC, verification, or service-specific records. Compare it with the pre-cutover export.

Can Help4 generate my DKIM private key?

The sending mail provider should generate and retain the private key. Help4 DNS publishes the provider's public TXT or CNAME record only.

Which DKIM selector should I check?

Use the selector provided by the sender, such as google, selector1, selector2, or default. Guessing selectors is not reliable.

Should DMARC start at reject?

Not unless every legitimate sender and alignment path is already proven. A staged monitor → quarantine → reject rollout prevents accidental mail loss.

Why can SPF pass while DMARC fails?

The SPF-authenticated envelope domain may not align with the visible From domain. Aligned DKIM can satisfy DMARC when SPF alignment cannot.

What happens to DNSSEC during a nameserver move?

The parent DS must match keys served by the new authoritative DNS. Old DS records can cause validating resolvers to return SERVFAIL even when ordinary DNS answers look correct.

How long should propagation take?

Many updates appear within minutes or hours, but registrars commonly advise allowing 24–72 hours. Verify authoritative servers separately from recursive caches.