ShowDNS Learn
DNS, SSL & Security
Knowledge Base
Clear, in-depth articles on DNS records, email authentication, SSL/TLS, and HTTP security headers — everything you need to understand and manage your domain infrastructure.
Featured articles
HSTS Header (Strict-Transport-Security) Explained
Understand Strict-Transport-Security directives and configure HSTS safely for your domains.
FeaturedWhat Is HSTS Preload? How Browser Preloading Works
Learn how the HSTS preload list works, the requirements to be listed, and the implications.
FeaturedThe Role of SPF, DKIM, and DMARC in Email Security
See how SPF, DKIM, and DMARC work together to prevent spoofing and improve deliverability.
FeaturedWhat Is DNS? Domain Name System Explained
DNS is the internet's address book. Learn how domain names are translated into IP addresses.
FeaturedDNS Records Explained: All Record Types
A complete guide to DNS record types — A, AAAA, CNAME, MX, TXT, NS, SOA, SRV, CAA, and more.
FeaturedWhat Is DMARC?
Learn what DMARC is, how it uses SPF and DKIM to protect your domain, and what policies mean.
DNS
2410 Best DNS Providers to Use in 2025
Compare the fastest DNS providers and choose the right resolver for performance and privacy.
What Is DNS? Domain Name System Explained
DNS is the internet's address book. Learn how domain names are translated into IP addresses.
How DNS Works: Step-by-Step Explained
Follow the complete DNS resolution process step by step — from browser query to authoritative answer.
DNS Resolution Explained
Understand recursive resolvers, iterative queries, and caching in the DNS resolution process.
What Is DNS TTL?
Learn what DNS TTL (Time to Live) is, how it affects propagation, and how to choose the right value.
DNS Cache Explained
Understand how DNS caching works at the browser, OS, and resolver levels, and how TTL controls it.
What Is Reverse DNS?
Learn what reverse DNS (rDNS) is, how PTR records work, and why it matters for email and security.
DNS Lookup vs NS Lookup
Understand the difference between DNS lookup and NS lookup, and when to use dig vs nslookup.
What Is DNSSEC?
Learn how DNSSEC adds cryptographic signatures to DNS responses, preventing cache poisoning.
DNS Records Explained: All Record Types
A complete guide to DNS record types — A, AAAA, CNAME, MX, TXT, NS, SOA, SRV, CAA, and more.
What Is an A Record?
Learn what an A record is, how it maps a domain to an IPv4 address, and how to configure it.
What Is an AAAA Record?
Learn what an AAAA record is and how it maps a domain to an IPv6 address.
What Is a CNAME Record?
Learn what a CNAME record is, how aliases work in DNS, and common CNAME use cases.
What Is an MX Record?
Learn what MX records are, how email routing works, and how to configure them for Google Workspace.
What Is an NS Record?
Learn what NS records are, how nameserver delegation works, and how to verify NS records.
What Is a TXT Record?
Learn what TXT records are and how they are used for SPF, DKIM, DMARC, and domain verification.
What Is an SOA Record?
Learn what an SOA record is, what each field means, and how serial numbers control zone transfers.
What Is a Domain Name?
Learn what a domain name is, how the domain name system is structured, and how domains are registered.
What Are Nameservers?
Learn what nameservers are, the difference between authoritative and recursive nameservers.
Domain Expiration Explained
Learn what happens when a domain expires, the grace period timeline, and how to prevent domain loss.
DNS vs CDN
Understand the difference between DNS and a CDN, how they work together, and when you need each one.
Cloud DNS Explained
Learn what Cloud DNS is, how it differs from self-hosted DNS, and how to choose a provider.
What Is DNS over HTTPS (DoH)? Encrypted DNS Explained
DNS over HTTPS (DoH) encrypts your DNS queries inside HTTPS so no one can snoop or tamper with them. Learn how DoH works, its benefits, and its limits.
What Is DNS over TLS (DoT)? Encrypted DNS Explained
DNS over TLS (DoT) encrypts your DNS queries over a dedicated TLS connection on port 853. Learn how DoT works, how it differs from DoH, and its trade-offs.
Security
11HSTS Header (Strict-Transport-Security) Explained
Understand Strict-Transport-Security directives and configure HSTS safely for your domains.
What Is HSTS Preload? How Browser Preloading Works
Learn how the HSTS preload list works, the requirements to be listed, and the implications.
HTTP Security Headers Explained
A complete guide to HTTP security headers — HSTS, CSP, X-Frame-Options, X-Content-Type-Options.
What Is Content Security Policy?
Learn what Content Security Policy (CSP) is and how it prevents XSS and data injection attacks.
CSP Examples for Websites
Real-world Content Security Policy examples for static sites, WordPress, Next.js, and API servers.
X-Frame-Options Explained
Learn what X-Frame-Options does, the difference between DENY and SAMEORIGIN, and frame-ancestors.
X-Content-Type-Options Explained
Learn what X-Content-Type-Options: nosniff does and how it prevents MIME type sniffing attacks.
Referrer Policy Explained
Learn what the Referrer-Policy header does and how to choose the right value for privacy and analytics.
CORS Explained
Learn what CORS is, how the same-origin policy works, and how to configure Access-Control headers.
HSTS Max-Age Explained
Understand the HSTS max-age directive, how to choose the right value, and the risks of setting it too high.
What Is security.txt? Vulnerability Disclosure Explained
Learn what the RFC 9116 security.txt file is, where it must be served, what Contact and Expires mean, and how to publish one so researchers can reach you.
Email Security
21The Role of SPF, DKIM, and DMARC in Email Security
See how SPF, DKIM, and DMARC work together to prevent spoofing and improve deliverability.
What Is an SPF Record?
Learn what SPF records are, how they prevent email spoofing, and how to read SPF syntax.
How SPF Works
Understand the SPF verification process step by step — from DNS lookup to pass/fail decision.
SPF Record Syntax Guide
A complete reference for SPF record syntax — mechanisms, qualifiers, modifiers, and examples.
What Is DKIM?
Learn what DKIM is, how cryptographic signatures verify email authenticity, and how to check records.
How DKIM Works
Follow the DKIM signing and verification process from message composition to inbox delivery.
What Is DMARC?
Learn what DMARC is, how it uses SPF and DKIM to protect your domain, and what policies mean.
How DMARC Works
Understand the DMARC evaluation process — alignment checks, policy enforcement, and reporting.
DMARC Policy Explained
Understand DMARC policies — none, quarantine, and reject — and how to safely move to enforcement.
DMARC Alignment Explained
Alignment is why mail passes SPF and still fails DMARC. Learn which domains DMARC compares and how relaxed and strict differ.
DMARC Aggregate (RUA) Reports Explained
RUA reports are the daily XML feedback that makes DMARC enforceable. Learn what each element means and what they leave out.
RUA vs RUF: Aggregate vs Forensic Reports
DMARC sends two kinds of report. Compare aggregate XML with forensic failure reports — contents, cadence, real-world support and privacy risk.
DMARC Tag Reference
Every DMARC record tag — v, p, sp, np, pct, rua, ruf, adkim, aspf, fo, rf and ri — with defaults, valid values and when each matters.
What Is BIMI?
Learn what BIMI is and how it displays your brand logo in email clients for authenticated messages.
What Is MTA-STS? SMTP TLS Enforcement Explained
Learn how MTA-STS forces inbound email over valid TLS, what the policy file and DNS records do, and how testing and enforce modes work.
What Is TLS-RPT? SMTP TLS Reporting Explained
Learn how TLS-RPT and the _smtp._tls record give you daily reports of SMTP TLS successes and failures — the essential companion to MTA-STS.
SPF Generator: Every Input Explained
Every field in the SPF Record Generator, card by card — domain, mx and a, ip4/ip6, provider includes, custom includes, the all policy and redirect.
DMARC Generator: Every Input Explained
Every field in the DMARC Record Generator, card by card — p, pct, rua, ruf, ri, fo, adkim, aspf and sp, with the trade-off behind each choice.
MTA-STS Generator: Every Input Explained
Every field in the MTA-STS & TLS-RPT Generator, card by card — policy mode, allowed MX hosts, max_age caching and the TLS-RPT reporting address.
TLSA Generator: Every Input Explained
Every field in the DANE TLSA Record Generator, card by card — host, port and protocol, the PEM certificate, and the usage, selector and matching fields.
SMTP Reply Codes Explained
What 2xx, 4xx and 5xx mean in an SMTP session, how enhanced status codes narrow down the cause, and when a failure is worth retrying.
SSL
7What Is an SSL Certificate?
Learn what SSL/TLS certificates are, how they encrypt web traffic, and the different types available.
How SSL Certificates Work
Understand the complete SSL/TLS certificate lifecycle — issuance, validation, handshake, and renewal.
Types of SSL Certificates
Compare DV, OV, EV, and wildcard SSL certificates — what each validates and when to use each type.
TLS vs SSL Explained
Understand the difference between TLS and SSL and why TLS 1.3 is the current standard.
HTTPS Handshake Explained
Learn how the TLS handshake establishes a secure encrypted channel — from ClientHello to session keys.
What Is a Certificate Chain?
Learn how the SSL certificate chain of trust works and how to fix incomplete chain errors.
Common SSL Problems
Identify and fix the most common SSL certificate errors — expired certs, hostname mismatches, and more.
SSH
2SSH Keys Explained: Public vs Private Keys
Understand how SSH key pairs work, the difference between public and private keys, and how RSA, ECDSA, and Ed25519 compare.
PEM vs PPK: SSH Key Formats Compared
Learn the difference between PEM (OpenSSH) and PPK (PuTTY) private key formats, when to use each, and how to convert between them.