Written by the GR.IT Consultancy team. GR.IT is a UK managed IT provider with more than 25 years of experience running cloud hosting, IT support and cyber security for businesses across London and Kent.

TL;DR

DNS management is the ongoing job of controlling the records that tell the internet where your website, your email and your business applications actually live. It covers who holds the registrar account, which nameservers are authoritative, which records exist, who is allowed to change them and how those changes are monitored.

Get it right and nobody notices. Get it wrong and your website disappears, your inbound email stops, or your outbound email starts landing in junk folders. In most small and medium UK businesses, DNS is owned by nobody in particular, which is exactly why it fails at the worst possible moment.

If you only do three things this quarter: find out who controls the registrar account, turn on multi-factor authentication and registrar lock, and set the domain to auto-renew on a company payment method.

What is DNS management?

DNS stands for Domain Name System. The NCSC describes it as “the address book of the internet”. It translates a name a human can remember, such as yourcompany.co.uk, into the IP address a computer needs in order to make a connection.

DNS management is the administration of that address book for the domains your business owns. In practice it involves five things:

• Registration. Holding the domain with a registrar, keeping ownership details accurate and keeping the renewal paid.
• Delegation. Deciding which nameservers are authoritative for your domain and pointing the registry at them.
• Records. Creating, editing and removing the individual entries that route web traffic, email and third-party service verification.
• Access control. Deciding who can log in and make changes, and proving it afterwards.
• Monitoring. Watching for unexpected changes, expiring records and certificates issued against your domain without your knowledge.

People also search for this as DNS administration, DNS network management or managed DNS. They all describe the same underlying task, sometimes with a different level of service attached.

The distinction worth understanding: DNS hosting is where your records physically live. DNS management is the discipline of keeping them correct, secure and accounted for. A registrar sells you the first one. The second one is a job, and someone in your business has to do it.

Why does DNS management matter to a business, not just to IT?

Because almost every digital thing your business depends on resolves through DNS first. The NCSC is direct about the consequences of losing control of your public domains: communications with customers can be disrupted or intercepted, access to services can be impaired, traffic can be harvested and transactions can be defrauded.

Four business risks sit behind that:

1. Total outage from a single wrong character. A mistyped A record or a deleted MX record takes your site or your mail offline instantly. There is no gradual degradation, and depending on the time to live setting the fix can take hours to reach everyone.

1. Silent revenue loss through email. DNS records are what prove your email is legitimate. If SPF, DKIM and DMARC are missing or misconfigured, your quotes, invoices and marketing land in spam. Nobody tells you. You just stop hearing back.

1. Domain hijacking. DNS services are actively targeted. If an attacker gets into your registrar account, they can repoint your entire domain, intercept your mail and obtain valid TLS certificates in your name. In March 2025 the NCSC published dedicated guidance for domain registrars and DNS providers aimed at reducing exactly this.

1. Loss of the asset itself. If the domain lapses, administrative access is gone and somebody else can register it. We have seen businesses lose a domain because the auto-renewal was tied to a former director’s personal credit card that expired.

Which DNS records actually matter?

You do not need to memorise the whole list. You do need to know what these do and what breaks when they are wrong.

CAA is worth singling out. In its 2025 guidance for domain registrars, the NCSC suggests that additional DNS-based security features, certificate authority authorisation records among them, could be offered as standard. Treat CAA as part of your baseline rather than an optional extra.

What is the difference between registrar DNS, managed DNS and self-hosted DNS?

For most businesses we work with in London and Kent, the sensible answer is managed DNS on a resilient platform, with the registrar account held by the business and access granted to the IT provider. That combination gives you resilience without giving away ownership.

Who should own your DNS?

This is the question that causes the most damage, and it is not a technical question.

The pattern we see repeatedly: the domain was registered years ago by a web designer, a marketing agency or a member of staff who has since left. The renewal notices go to an inbox nobody reads. When the business needs an urgent change, a Friday afternoon disappears into working out who has the password.

The NCSC’s guidance is unambiguous on this point. If a domain was registered using a personal email account, change it so all interaction with the registrar runs through the organisation’s own systems. If a web hosting company registered it, make sure the domain is managed by your business and not by them.

A workable ownership model for an SME:

• The business owns the registrar account. Company email address, company payment method, company billing contact.
• A named internal group acts as internal registrar. One team registers and manages every domain, so nobody buys a campaign domain on a personal card with a different provider.
• The IT provider holds delegated administrative access, not ownership. They make the changes. You keep the keys.
• At least two trusted people can get in. One person with the password is a single point of failure, and people leave.
• Everything is documented in a place that survives staff turnover.

If you cannot currently answer “who can log in and change our DNS today”, that is the finding, and it is worth fixing before anything else on this page.

How do DNS mistakes take a business offline?

Five failure modes account for most of the real incidents.

Time to live set too high before a migration. TTL controls how long resolvers cache a record. A typical value is 3600 seconds, one hour, although defaults vary by provider. If you are moving hosting or changing mail providers, drop the TTL to around 300 seconds at least 24 to 48 hours in advance, make the change, then raise it again once things are stable. Skip that step and some users keep hitting the old server for a day or more.

Deleting a record you did not recognise. Verification TXT records look like noise. They are usually the only thing keeping a SaaS integration or an email authentication check alive.

Subdomain takeover. You point a CNAME at a third-party service, then stop using the service. The CNAME stays. Someone else claims the abandoned target and now controls content on a subdomain of your brand. The NCSC recommends removing delegations and alias records as soon as the underlying service is retired.

Changing hosting without changing MX. Web and email are separate. Moving a website and letting the new host overwrite the whole zone is one of the most common ways a business loses its inbound mail.

Expiry. Not exotic, but still the most permanent. Auto-renewal on a maintained company payment method removes the risk entirely.

How does DNS affect whether your email gets delivered?

More than most business owners realise, and the bar has risen sharply.

From February 2024, Google and Yahoo required bulk senders, broadly those sending around 5,000 or more messages a day to personal accounts, to authenticate with SPF and DKIM, publish a DMARC record of at least p=none with alignment, offer one-click unsubscribe and keep spam complaints below 0.3 percent. Google’s own guidance goes further and asks senders to aim below 0.1 percent.

Microsoft followed. From 5 May 2025, high-volume senders to Outlook.com, Hotmail.com and Live.com must have valid SPF, DKIM and DMARC in place. Non-compliant mail is not junked, it is rejected outright.

All of those controls are DNS records. Every one of them lives in the zone file that nobody owns.

Two practical points:

• The thresholds apply to high-volume senders, but the direction of travel is clear. Receivers increasingly treat unauthenticated mail as suspicious regardless of volume. Publishing SPF, DKIM and DMARC is now baseline hygiene for any business that sends email.
• Start DMARC at p=none with a reporting address, read the reports for a few weeks to find every legitimate system sending on your behalf, then tighten to p=quarantine and eventually p=reject. Going straight to p=reject is how businesses accidentally block their own CRM, accounting system or booking platform.

The NCSC publishes its own guidance on using DMARC, SPF and DKIM as anti-spoofing controls, and recommends these records are added to all public domains.

What does good DNS management look like?

A practical checklist you can work through in an afternoon.

Ownership and access

• Registrar account is in the company name, with a company email and a company payment method
• Multi-factor authentication is enabled for every administrator. The NCSC calls two-step verification with the registrar the single most important recommendation for an organisation with one public domain
• Registrar lock is applied, at minimum to your primary trading domain
• Auto-renewal is on
• At least two trusted people have access
• You know the registrar’s process for reclaiming a hijacked domain, and you hold the paperwork that proves ownership

Records

• A full inventory of every record exists, with a note of what each one is for
• SPF, DKIM and DMARC are published and passing
• CAA records restrict which certificate authorities can issue for your domain
• Unused CNAMEs and delegations have been removed
• TTLs are appropriate, and lowered deliberately ahead of any migration

Monitoring and change control

• Critical records, particularly NS and MX, are monitored for unexpected change
• Certificate transparency logs are watched for certificates you did not request
• Change logging is enabled and retained
• Every change is requested, approved and recorded rather than made ad hoc

How often should you review your DNS?

Quarterly is sensible for most SMEs, plus a mandatory review at three trigger points:

1. Before and after any migration, whether that is hosting, email or a new line of business application
2. When a service is decommissioned, so its records leave with it
3. When someone with access leaves the business

Domain expiry dates and TLS certificate expiry dates should sit on a calendar that somebody actually looks at, not in an inbox.

For a wider view of how DNS fits alongside networking, endpoints, backup and identity, see how we approach managed IT support (https://www.grit-consultancy.com/managed-it-support/) as a whole estate rather than a set of separate tickets.

DNS management services: what should an IT provider actually do?

If you are considering handing DNS to a managed provider, this is a reasonable list to hold them to:

• Audit and document every domain you own, including the ones you forgot about
• Move DNS hosting to a resilient platform where that makes sense
• Harden the registrar account with MFA, registrar lock and auto-renewal
• Publish and tune SPF, DKIM, DMARC and CAA, and monitor the DMARC reports
• Provide a documented change process rather than an engineer editing a zone from memory
• Monitor critical records and certificate transparency logs and alert you to unexpected changes
• Plan TTLs properly around every migration
• Leave ownership with you

Note the last one. A provider who insists on holding your domain in their own account is creating a dependency, not delivering a service.

Where GR.IT fits

DNS sits underneath everything else we manage. It is part of how we run managed cloud hosting services (https://www.grit-consultancy.com/cloud-hosting/), it is checked as part of onboarding for managed IT support (https://www.grit-consultancy.com/managed-it-support/), and the authentication and certificate side of it belongs to managed cyber security (https://www.grit-consultancy.com/cyber-security/).

If you are not certain who controls your domain today, that is the most common answer we get, and it is a quick thing to establish.

Talk to the GR.IT team about a DNS and domain review (https://www.grit-consultancy.com/contact-us/) for your business in London or Kent. We will tell you what we find, whether or not you go on to work with us. You can also see straightforward IT support pricing (https://www.grit-consultancy.com/pricing/) before you get in touch.

Related reading

• Cloud Migration Services in London: Costs, Timelines and How to Avoid a Failed Move (https://www.grit-consultancy.com/cloud-migration-services-in-london/) covers the TTL and cutover planning side in more depth
• Data Backup and Recovery for UK Businesses: The Complete 2026 Guide (https://www.grit-consultancy.com/data-backup-and-recovery/) explains why a DNS record inventory belongs in your recovery documentation
• Multi-Factor Authentication for Business UK: 7-Step MFA Plan (https://www.grit-consultancy.com/multi-factor-authentication-business-uk/) covers the MFA rollout that should include your registrar account
• Cloud Server for Small Business: Do You Still Need On-Premise in 2026? (https://www.grit-consultancy.com/cloud-server-for-small-business/) for the hosting decision that sits behind your A records

Frequently asked questions

What is DNS management in simple terms? DNS management is the job of keeping the records that point your domain at the right servers accurate, secure and under your control. It covers who owns the registrar account, which nameservers are authoritative, what records exist and who is allowed to change them.

What is the difference between DNS hosting and DNS management? DNS hosting is where your records are stored, usually with your registrar or a cloud DNS platform. DNS management is the ongoing discipline of maintaining them: auditing records, controlling access, monitoring changes and planning migrations. You can buy hosting for a few pounds a year. Management is a responsibility somebody has to hold.

Who should manage DNS for a small business? The business should own the registrar account, and a named internal owner or an IT provider with delegated access should make the changes. Ownership and administration are separate things, and keeping them separate is what protects you if a relationship ends.

How long do DNS changes take to take effect? It depends on the time to live value on the record. A one hour TTL means resolvers may serve the old answer for up to an hour after your change. Some resolvers ignore short TTLs, so allow up to 48 hours in the worst case and lower your TTLs a day or two before any planned migration.

Do I need DNSSEC? DNSSEC adds cryptographic integrity checking to DNS responses and protects against certain kinds of manipulation. It also adds key management and zone signing complexity, and some services do not support it. The NCSC’s position is that organisations should consider deploying it while weighing the associated risks, costs and benefits. For most SMEs, MFA, registrar lock and correct email authentication deliver more risk reduction per hour spent.

What is a DNS manager? The term is used two ways. It can mean the web interface your registrar or DNS provider gives you for editing records, or the person or provider responsible for keeping those records correct. If someone asks who your DNS manager is, they usually mean the second one.

Can DNS problems affect my email deliverability? Yes, significantly. SPF, DKIM and DMARC are all DNS records, and Google, Yahoo and Microsoft now require them for high-volume senders. Missing or misconfigured authentication is one of the most common reasons legitimate business email is junked or rejected.

How do I check my DNS is set up correctly? Start by confirming who controls the registrar account, then check that MFA and registrar lock are on, that auto-renewal is enabled, and that SPF, DKIM and DMARC records exist and pass. A DMARC report will quickly reveal every system sending email as your domain, including ones you had forgotten about.