Standards
What every zone here carries.
A domain is not finished when it resolves. These records decide whether your mail arrives and whether anyone can issue a certificate for your name — so they are part of the zone from the first minute.
The template
Applied on creation, not left as homework.
Every new zone is rendered from one template. When the standard changes, it is rolled out to all existing zones, not only to the next new one.
| Record | What we set | Why |
|---|---|---|
| SPF | v=spf1 +a +mx +a:<serverfqdn> -all |
The a: mechanism covers A and AAAA and follows the host automatically, so IPv6 does not silently fail. -all, not ~all — a softfail is a warning waiting to happen. |
| DKIM | Public key published under the mail selector | Signed mail is the half of authentication that survives forwarding. |
| DMARC | Policy record with a working rua address |
Reports go to a mailbox that exists. A DMARC record pointing at a dead address tells you nothing. |
| CAA | Issuer policy plus iodef contact |
Only the authority we use may issue for your name, and a misissue attempt reaches a real address. |
| TLSRPT | _smtp._tls reporting record |
Failures in transport encryption become visible instead of staying silent. |
| SOA | Contact dnsmaster@ctpfdns.com |
One real, monitored contact across every zone — not a hostmaster address nobody reads. |
| NS | All four nameservers | Any single nameserver can answer the domain on its own. |
| DNSSEC | Signing, DS at the registrar | Being rolled out as domains complete their move to CTPFDNS. |
How we keep it honest
Rules that stop a bad record from shipping.
No unresolved placeholder
A record whose value still contains a template placeholder is refused, never written.
Serial must move
If the serial does not rise, the secondaries ignore the change — so the serial is checked, not assumed.
Checked at a secondary
Verification happens where the world reads, not where we write.
One template, all servers
The same template on every nameserver, so no zone depends on which machine created it.
Standards are retrofitted
A new standard is applied to every existing zone, with serial bump and notify.
Reports go somewhere
Every reporting address in a zone points at a mailbox that is actually read.
Want your current zone checked against this?
Send us the domain. You get the list of what is missing, whether you move or not.