DNS is configured during setup, edited occasionally under pressure, and reviewed essentially never. The zone becomes an archaeological record: verification strings from tools long abandoned, subdomains for finished campaigns, mail records for providers replaced years ago.
Why it matters
Your zone is public. It reveals which services you use, where things are hosted, and what exists at names you may not have published. Records pointing at deprovisioned services enable subdomain takeover. Stale mail records weaken your email authentication. And the registrar account itself is among the highest-value targets you own — control of it means control of your domain, mail, and certificates.
The annual review
- Export the full zone and go through every record: what is it for, is it still needed, who owns it?
- Remove CNAMEs pointing at services you have cancelled.
- Consolidate and correct SPF records — multiple SPF records break authentication, and long include chains hit lookup limits.
- Remove verification TXT records for tools you no longer use.
- Check that MX records point where mail actually goes.
Protect the registrar account
- Strong authentication on the registrar, ideally a hardware key.
- Registrar lock enabled to prevent unauthorised transfers.
- Ownership under the company, not an individual, with contact details that do not depend on one person's mailbox.
- Auto-renew on, plus a calendar reminder as a backstop — expiry causes complete outage.
Consider DNSSEC and CAA
DNSSEC signs your records so resolvers can detect tampering. CAA records specify which certificate authorities may issue certificates for your domain, limiting mis-issuance. Neither is complicated to add, and both are quiet improvements most domains lack.
Log changes
DNS changes are high-impact and frequently made under time pressure. Use a provider that records who changed what and when, restrict who holds access, and treat the zone as production infrastructure rather than as settings.