How to fix your email and website security settings (DNS)

Most of the email problems our free check finds are fixed in one place: your domain's DNS settings. This page explains what that means in plain English, what we check, and links to guides showing where the DNS settings are at the companies most UK small businesses use.

What are DNS records?

DNS is the internet's address book. When someone visits your website or emails you, their computer looks up your domain's DNS records to find out where to go.

Some records are simply public notes about your domain. A few of these notes tell the world which services are allowed to send email as you, and what to do with fakes. Without them, it's easy for a scammer to send an email that looks like it came from your business.

You change DNS records by logging in to the company that manages your domain's DNS, adding a record, and saving it. You don't need to install anything or touch your website.

What Tidy Cyber checks

Email records (in your DNS)

• SPF: a TXT record listing who may send email for your domain. Without it, faking your email is much easier.
• DKIM: a digital signature on your email, so receivers can tell it's genuinely from you. We look at the most common places providers put it.
• DMARC: a TXT record telling receivers what to do with email that fails SPF and DKIM. We check whether it actually asks them to block or junk fakes, rather than only watching.
• Mail servers (MX): whether your domain receives email. If it doesn't send or receive email at all, we check it's locked down so it can't be used to fake email in your name.

Domain tamper protection (in your DNS)

• DNSSEC: a digital seal on your DNS records. Availability depends on your provider. We treat it as low priority.

Website settings (not DNS)

We also check a few things about your website. These are fixed by your web host or developer, not in DNS:

• Your security certificate (the padlock): valid, trusted and not about to expire.
• Modern encryption (TLS 1.2 or newer), with old TLS 1.0 and 1.1 switched off.
• Visitors to http:// being moved to the secure https:// address.
• Browser protection headers: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy.
• Whether your website gives away software version numbers.

See how we score for how each one affects your result.

Where are your DNS settings?

Usually with the company you bought your domain from. If you or your web designer moved the domain's nameservers to another company (Cloudflare is a common one), the records live there instead. If you're not sure, look for a "DNS" or "Manage DNS" page in your domain account. If it says your domain uses other nameservers, that tells you where to go.

Guides by provider

Each guide covers logging in, finding your DNS settings and adding or editing TXT and CNAME records. We checked them against each provider's official help in October 2026.

Using a different provider? The steps are almost always similar: find the DNS page, add a record, and save it.

What goes in the records?

The right value depends on your email provider and how your domain is set up today, so we don't list generic ones here. The full report gives the exact records for your domain.

Check it worked

DNS changes can take from a few minutes to 48 hours, depending on the provider. Once you think the change has gone through:

1. Go to the free Tidy Cyber check and enter your domain.
2. Look at your results. The issue you fixed should no longer appear in your top issues (or should show a lower risk).
3. If nothing has changed, wait a little longer and check again. If it still hasn't changed after a day, check the record's Name and Value character by character. A missing character or a doubled domain name is the usual cause.

The free check is passive: it only looks at what your domain already shows the world, and nothing is installed.