DNS Records Checklist for Small Business Websites: The 2026 Owner's Guide

DNS is boring until it breaks.

Then your website disappears, email stops landing, ads keep spending, forms stop sending, and nobody on the team knows whether the domain is at GoDaddy, Cloudflare, Squarespace, Google Domains, or inside an old agency account.

That is why DNS deserves an owner-level checklist. Not because every business owner needs to become a network engineer. Because one wrong record can knock out sales, email, tracking, or trust.

This guide gives you a practical DNS records checklist for small business websites. Use it before a launch, redesign, domain transfer, email migration, hosting move, or agency handoff.

Quick DNS records checklist

Use this table as the short version. The rest of the guide explains what each record does, how it breaks, and who should own it.

What DNS records actually control

DNS is the internet’s lookup system. When someone types your domain into a browser, opens an email from your company, clicks a booking link, or lands on a campaign page, DNS helps route that request to the right service.

For a small business, DNS usually controls five things:

1. Website traffic, including the root domain, www version, subdomains, and landing pages.
2. Email delivery, including where mail is received and whether your sending services are trusted.
3. Security signals, including domain authentication, certificate rules, and sometimes DNSSEC.
4. Vendor verification, including Google Search Console, Microsoft 365, HubSpot, Mailchimp, Shopify, Stripe, and similar tools.
5. Recovery speed, because a clean DNS map makes outages easier to fix.

The mistake is treating DNS like a launch task. DNS is not finished after launch. It changes when you add email tools, move hosting, rebuild the site, connect a CRM, add call tracking, change agencies, create subdomains, or clean up old software.

Step 1: Confirm who owns the domain

Start at the registrar, not the website platform.

The registrar is where the domain is registered. The DNS host is where records are managed. The web host is where the website lives. Those can be three different companies.

For example, a business might register the domain at Namecheap, manage DNS in Cloudflare, host the website on WordPress, run email through Microsoft 365, send newsletters through Mailchimp, and verify search tools through Google. That setup can work fine, but only if someone has a map.

Check these items first:

ICANN’s registrant guidance says domain holders should have access to information about registering, managing, transferring, renewing, and restoring a domain name. Source That sounds basic, but it is where many ugly website emergencies start.

A good rule: if losing access to a login would stop your website or email, it belongs in a company-controlled password manager, not in one person’s inbox.

Step 2: Identify the active nameservers

Nameservers tell the internet where to find the DNS zone for your domain. If your nameservers point to Cloudflare, records inside GoDaddy’s DNS screen will not matter. If your nameservers point to your web host, records inside Cloudflare will not matter.

Before you change anything, check the active nameservers with a public lookup tool such as ICANN Lookup, MXToolbox, DNSChecker, or your registrar’s dashboard.

Write down:

This prevents the classic DNS mistake: editing records in the wrong place and waiting hours for a change that was never active.

Step 3: Audit website records

Most small business websites need the root domain and the www version to resolve correctly.

The root domain is example.com. The www version is www.example.com. Depending on the platform, the root might use an A record, AAAA record, ALIAS, ANAME, or flattened CNAME. The www version often uses a CNAME.

Common website records:

For lead generation sites, test the exact paths that make money. A homepage resolving correctly is not enough. Check the main service page, contact page, thank-you page, booking subdomain, quote request form, and any paid ad landing pages.

Google’s Core Web Vitals documentation says site owners should aim for Largest Contentful Paint within 2.5 seconds, Interaction to Next Paint under 200 milliseconds, and Cumulative Layout Shift under 0.1. Source Google has also said that 53% of mobile visits are likely to be abandoned if pages take longer than 3 seconds to load. Source DNS is not the only performance factor, but bad redirects, broken CDN records, and old hosting records can still turn into lost calls and lost forms.

Step 4: Clean up redirects and canonical versions

Your website should have one preferred version.

That usually means:

https://www.example.com/ redirects to https://example.com/, or https://example.com/ redirects to https://www.example.com/.

Either choice can work. The problem is inconsistency.

Check http://example.com, http://www.example.com, https://example.com, and https://www.example.com. Each version should either load the preferred version or redirect once. Avoid redirect chains where a visitor bounces from http to https, then non-www to www, then a trailing slash, then a new URL. Every hop creates delay and another place for something to fail.

If you use HSTS, be careful. Chrome’s HSTS preload guidance lists a preload-ready header as Strict-Transport-Security: max-age=63072000; includeSubDomains; preload. Source That is strong protection, but it also means subdomain mistakes can become harder to work around. Do not preload a domain until every important subdomain is HTTPS-ready.

Step 5: Verify email DNS before you blame the inbox

Email DNS is where many small businesses quietly bleed leads.

A website can be beautiful and still lose money if form notifications go to spam, quote emails fail authentication, or newsletters damage the domain reputation.

At minimum, check MX, SPF, DKIM, and DMARC.

Google’s sender guidelines say all senders to Gmail accounts must set up SPF or DKIM, and senders above 5,000 messages per day to Gmail accounts have more requirements. Source Microsoft says DKIM alone is not enough and recommends SPF and DMARC as part of the overall email authentication strategy for custom domains. Source

CISA’s SPF, DKIM, and DMARC guidance warns that incorrect configuration can cause delivery problems, and it recommends identifying the DNS provider and all email senders before implementation. Source

That last part matters. Do not let someone paste a new SPF record over the old one without checking every sender. Many domains are allowed to have only one SPF TXT record for the domain. If your business uses Microsoft 365, HubSpot, Mailchimp, and a website form plugin, the SPF plan needs to account for the real sending path.

Step 6: Add CAA records if your setup is mature enough

CAA records tell certificate authorities which companies are allowed to issue SSL certificates for your domain. They are not mandatory for every small business, but they are a sensible security control when you know your certificate setup.

For example, if your site uses Let’s Encrypt, your CAA policy may allow Let’s Encrypt. If your host uses a different certificate authority, the record needs to match that provider.

Do not add CAA records casually. A wrong CAA record can block certificate renewal. Since Let’s Encrypt says its default certificates are valid for 90 days, renewal automation needs to work reliably. Source

The practical approach is simple: ask your web host or developer whether CAA is recommended for your stack, then document the issuing authority. If nobody can answer, fix the ownership map first.

Step 7: Decide whether DNSSEC is worth enabling

DNSSEC helps protect DNS answers from certain types of tampering by adding validation to DNS responses. It can be useful, but it also adds operational responsibility.

For a small business, DNSSEC is usually worth considering when you use a stable DNS provider with easy DNSSEC support, the domain handles payments or logins, and you have a technical owner who can manage registrar and DNS changes.

The caution is that DNSSEC involves the registrar and DNS host. If you move DNS providers and do not handle DS records correctly, the domain can fail resolution. That is not a reason to avoid DNSSEC forever. It is a reason to document it and test changes carefully.

Step 8: Remove stale vendor records

Old DNS records are like keys left under the mat.

Not every stale TXT or CNAME record is dangerous, but old vendor records create confusion and sometimes risk. A retired landing page tool, forgotten email sender, abandoned helpdesk, or old CDN subdomain may still have DNS pointing at it.

Review records tied to:

Before deleting anything, identify who uses it. Some verification records are harmless and still needed. Others are leftovers from tools the business stopped paying for two years ago.

A good cleanup process is to label each record as active, unknown, or remove. Unknown records should not be deleted on the spot. Put them through a short review with the marketing, sales, IT, and web teams.

Step 9: Monitor the things that usually fail

DNS and domain problems are preventable more often than people think.

Set alerts for:

Uptime Institute reported in 2026 that 57% of respondents said their most recent major outage cost more than $100,000, and 1 in 5 reported costs above $1 million. Source Your local service business may not face that kind of number, but the lesson scales down: outages cost more when nobody notices early.

For a small business, the best monitoring setup is not fancy. It is boring and reliable. Someone gets alerted before customers do.

Step 10: Create a DNS change log

Every DNS change should leave a trail.

Use a simple change log with:

This is overkill until the day it saves you. During a launch or email migration, the change log tells the next person what happened, why it happened, and how to reverse it.

The owner-friendly DNS audit process

If you want to clean this up without stopping normal work, use this order:

1. Map the registrar, nameservers, website host, email host, and key vendors.
2. Export or screenshot the current DNS zone.
3. Label every record as website, email, security, verification, vendor, unknown, or stale.
4. Test the root domain, www version, forms, email sending, email receiving, SSL, and top landing pages.
5. Fix ownership and access before making technical changes.
6. Remove stale records only after a short review.
7. Add monitoring and a change log.

That order matters. If you start by deleting records, you are guessing. If you start by mapping ownership, you are reducing risk.

Before a launch, confirm registrar access, active nameservers, website records, redirects, SSL, form delivery, MX, SPF, DKIM, DMARC, Search Console verification, analytics, and the rollback window. This is the kind of checklist that makes a launch boring. Boring is good. Exciting DNS usually means someone is refreshing a broken site at 11 p.m.

FAQ

How often should a small business audit DNS records?

Audit DNS at least twice a year, and before any website launch, hosting move, email migration, domain transfer, CRM change, or marketing platform change. If multiple vendors can request DNS changes, audit quarterly.

Should the web designer control DNS?

The web designer can help manage DNS, but the business should own the registrar account and have admin access. Vendor access should be delegated where possible, not trapped inside a vendor-owned account.

Is Cloudflare required?

No. Cloudflare is a popular DNS, CDN, and security provider, but it is not required for every small business. The right DNS host is one your team can access, document, secure, and monitor.

What is the most dangerous DNS mistake?

The worst mistake is not one specific record. It is nobody knowing who controls the domain. After that, the most common expensive mistakes are expired domains, bad nameserver changes, broken MX records, and overwritten SPF records.

Do DNS changes happen instantly?

Not always. DNS records have TTL values that influence caching. Some changes appear quickly, while others take longer to propagate across resolvers. Plan important changes during a low-risk window and keep rollback values ready.

Need someone to check your DNS before it breaks?

Your DNS records should not be a mystery folder only one vendor understands. If you want a second set of eyes on your domain, email, website launch, or vendor handoff, start here. We’ll help you find the weak spots before they become a bad day.