TL;DR: More than 40% of independently managed domains have at least one critical DNS issue, according to EasyDMARC research based on 30,000 domains, while MSP-managed domains show far stronger configuration accuracy and resilience. Email trust depends on DNS hygiene as much as SPF, DKIM and DMARC.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on EasyDMARC's research: DNS health gaps are undermining email authentication and resilience, with independently managed domains far more likely to carry critical configuration issues.
Why it matters: This matters because email authentication controls inherit the quality of DNS records, so domain owners, IAM teams and email security leads need continuous governance rather than one-time setup.
By the numbers:
- More than 40% of randomly selected domains have at least one critical DNS issue.
- Over 95% of MSP-managed domains maintain clean, valid core DNS configurations.
- DNSSEC adoption stands at 6.99% among MSP-managed domains.
Context
DNS is the control plane that makes email authentication, service discovery and domain resilience work, but it fails silently when records drift, duplicate or conflict. Email security depends on that layer staying accurate, monitored and recoverable, not merely configured once.
The report's contrast between MSP-managed and independently managed domains shows that operational discipline matters as much as the protocol stack. When DNS is treated as a static setup task, resilience erodes through small errors that are easy to miss but hard to unwind.
Key questions
Q: How do DNS misconfigurations affect email authentication?
A: DNS misconfigurations can break email authentication by publishing incorrect SPF, DKIM or DMARC records, or by making those records unreachable during lookups. That can cause legitimate mail to fail validation, be quarantined, or be rejected. Common failures include wrong TXT records, missing selectors, stale delegation, and split-brain DNS between authoritative servers.
Q: Why does DNS redundancy matter for email security?
A: DNS redundancy matters because email security checks depend on reliable DNS lookups for MX, SPF, DKIM and DMARC records. Multiple authoritative nameservers reduce the chance that a single outage or misconfiguration stops receivers from validating mail policy. Without redundancy, mail delivery and authentication can fail even when the records themselves are correct.
Q: What is the difference between DNSSEC and DNS redundancy?
A: DNSSEC adds cryptographic validation to DNS records, while DNS redundancy provides multiple authoritative servers so DNS remains available if one server fails. DNSSEC helps confirm that a response was not altered in transit. Redundancy helps ensure the response can still be served. They solve different problems and are often used together.
Q: How should teams govern DNS as a resilience control rather than just a routing layer?
A: They should classify DNS as part of the service control plane, with clear ownership, availability targets, change control, and integrity safeguards. When DNS becomes a customer-facing dependency, operational resilience depends on more than record lookup speed. It also depends on authenticated changes, tested failover, and monitoring that links DNS health to application availability.
Technical breakdown
Why DNS errors break SPF, DKIM and DMARC
SPF, DKIM and DMARC depend on DNS lookups to publish policy, public keys and authorisation data. If records are missing, malformed, duplicated or propagated inconsistently, receivers cannot validate messages reliably. That turns a mail-authentication problem into a governance problem, because the security controls are only as trustworthy as the DNS zone serving them. The report's findings reflect a common operational failure mode: authentication frameworks can be technically correct while the underlying records remain unstable or incomplete. See the Email Security Guide.
Practical implication: Treat DNS record integrity as a prerequisite for email authentication assurance, not as a separate administrative task.
What DNS redundancy actually protects
Redundancy in DNS is not just about having multiple name servers. It is about preserving query availability, consistency and failover when one component, region or provider fails. Good redundancy reduces outage risk, but it does not automatically fix bad data, and it does not guarantee geo-distributed recovery unless the architecture is designed for it. The report's distinction between basic redundancy and geographically distributed failover matters because many organisations confuse mere replication with real resilience. See the DNS Security Guide.
Practical implication: Design failover so that DNS remains authoritative and reachable even when a provider, region or path fails.
Why DNSSEC adoption remains low despite security value
DNSSEC adds cryptographic validation to DNS responses so resolvers can detect tampering or spoofed records. It strengthens integrity, but deployment is operationally sensitive because key management, signing workflows and delegation chains must remain consistent across zones and registrars. That helps explain why organisations often under-adopt it: the control is valuable, but the lifecycle overhead is real. The report shows that resilience and advanced DNS security are not the same thing, and many environments still optimise for stability over cryptographic assurance.
Practical implication: Use DNSSEC where the organisation can manage signing and rollover cleanly, and do not treat adoption as a checkbox.
NHI Mgmt Group analysis
DNS health is now an identity trust issue, not just an infrastructure issue. Email authentication protocols inherit whatever quality the DNS layer provides, so poor record hygiene directly weakens domain trust. That makes DNS governance relevant to IAM, email security and business continuity at the same time. Practitioners should treat DNS accuracy as part of identity assurance, not as a back-office admin concern.
Managed operating discipline outperforms ad hoc configuration. The strongest signal in EasyDMARC's research is not a single protocol result but the difference between managed and unmanaged operating models. More frequent validation, fewer structural errors and better resilience show that process maturity is a control, not just a cost centre. The practical conclusion is that ownership matters as much as tooling.
DNSSEC and operational resilience are complementary, not interchangeable. DNSSEC helps defend integrity, while redundancy helps preserve availability, and the report shows both can be unevenly adopted. Organisations that optimise for one without governing the other create a lopsided trust stack. A mature programme needs both secure publication and dependable resolution.
Continuous DNS governance is the missing concept. Static setup thinking leaves organisations exposed to drift, stale records and silent failure. DNS changes often look small, but their effect on email trust is cumulative and outsized. The right model is continuous oversight of the records, signers and failover paths that uphold domain identity.
What this signals
Domain trust now depends on record hygiene. As mail, services and verification workflows lean more heavily on DNS, small misconfigurations create disproportionate risk for identity assurance and deliverability. The governance lesson is simple: when DNS is treated as a static asset, authentication controls inherit silent failure modes.
Continuous control beats periodic clean-up. The report points to a broader operating shift in which domain resilience has to be monitored and validated continuously, not audited only after incidents. That model aligns with modern control thinking across email security and identity-adjacent infrastructure.
For practitioners
- Implement continuous DNS configuration audits Review zone files, delegations, TXT records and resolver paths on a fixed cadence, and compare current state to approved baselines so small drift is caught before it affects authentication or availability.
- Validate SPF, DKIM and DMARC dependencies together Check that each authentication control resolves against current DNS data, because a valid policy on paper still fails if the underlying records are malformed, duplicated or stale.
- Build true DNS redundancy and failover Use multiple authoritative servers, test regional failover and confirm that query handling remains stable during provider or path loss, not just during normal operation.
- Adopt DNSSEC where key management is mature Enable signing only where the organisation can manage rollover, delegation and recovery without creating service instability, then monitor validation outcomes continuously.
Key takeaways
- DNS configuration quality is a security control in its own right because email authentication inherits the reliability of the records it queries.
- The managed versus unmanaged gap shows that operating discipline materially improves both validation accuracy and resilience.
- Organisations should pair continuous monitoring with redundancy and, where appropriate, DNSSEC so domain trust does not depend on one-off setup.
Related NHI Mgmt Group resources: Email Security Guide · DNS Security Guide · Group Managed Service Accounts (gMSA) Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-1 — Inventory and Control of Enterprise Assets | Domain inventory and authoritative record ownership underpin the DNS hygiene issues in the report. |
| Recommendation — Maintain an authoritative inventory of domains, zones and name servers so DNS drift is visible before it becomes risk. | ||
| NIST CSF 2.0 | PR.DS-02 — Data-in-Transit is Protected | DNSSEC and authenticated mail flows depend on protecting the integrity of data in transit and name resolution. |
| PR.AA-05 — Access Permissions, Entitlements and Authorizations | DNS governance depends on limiting who can alter records, delegations and zone content. | |
| Recommendation — Protect DNS and mail-authentication data in transit so tampering cannot silently alter trust decisions. Restrict DNS change rights to approved operators and validate every high-risk record update. | ||
| NIST SP 800-53 Rev 5 | AU-2 — Event Logging | The report's monitoring message maps to logging and review of DNS changes and failures. |
| Recommendation — Log DNS changes and validation failures so configuration drift and suspicious updates can be investigated. | ||
| OWASP API Security Top 10 | API8 — Security Misconfiguration | Malformed or inconsistent DNS records are a misconfiguration class that directly affects trust and availability. |
| Recommendation — Treat recurring DNS syntax and structural errors as misconfiguration defects and remove them from production zones. | ||
Key terms
- DNSSEC: DNS Security Extensions are a set of DNS protocols that add cryptographic signatures to DNS data. They let resolvers verify that a response came from the signed zone and was not altered in transit. DNSSEC improves trust in DNS answers, but it does not encrypt traffic or replace broader monitoring.
- DNS Redundancy: DNS redundancy is the use of multiple DNS servers or zones so name resolution can continue if one server, network path or location fails. It usually means publishing the same authoritative data from more than one nameserver, often across separate infrastructure, to reduce single points of failure in DNS lookups.
- SPF: SPF is a DNS-based policy that lists which systems are permitted to send email on behalf of a domain. It helps mail receivers validate whether the sender matches the domain’s declared sources, reducing the chance of forged or impersonated messages.
- DKIM: DKIM is an email signing method that relies on a public key published in DNS to let receivers validate message integrity. In practice, the DNS record becomes part of the trust chain, so key management and DNS governance must stay aligned if organisations want reliable authentication.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It is a practical fit for practitioners who need to connect identity governance with the broader control environment.
Published by the NHIMG editorial team on November 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org