By Mehdi HassanWhat does a domain, DNS and SSL setup involve?
A domain, DNS and SSL setup connects three things: the domain you register, the DNS records that tell the internet where your website and email live, and the SSL certificate that makes the site load over HTTPS. Get them right once and they run quietly for years. Get them wrong and the site, the email, or both go down.
Most guides cover only the website records. This one also covers the ownership traps we see when taking over sites, and the email records that founders forget until form notifications stop arriving. It's part of our website hosting guide for startups.
Who should own the domain account?
The company should own the domain, in a registrar account created with a company email address, billed to a company card, with at least two people who can sign in. That sounds obvious, and it's still the most common problem we find.
- The ex-employee trap. The domain sits in the personal account of someone who left, and getting it back means support tickets and proof of ownership.
- The contractor trap. A freelancer registered it while building the first site and still holds the login.
- The expired card trap. Auto-renew failed on an old card and nobody saw the reminder emails.
- The single admin trap. One founder holds the only login and the two-factor device.
Which DNS records does a website need?
A website needs records that point the root domain and the www subdomain to your host, plus the email records your email provider gives you. Your host tells you exactly which values to add; this table explains what each type does.
Record | What it does | Typical use |
|---|---|---|
A / AAAA | Points a name to an IP address | Root domain to your host, when the host gives IPs |
CNAME | Points a name to another name | www to your host's domain |
ALIAS / ANAME / flattened CNAME | CNAME-like behavior at the root | Root domain on hosts that give a hostname |
MX | Says which servers receive your email | Your email provider |
TXT | Holds text values for verification and policies | SPF, DMARC, domain verification |
CNAME or TXT for DKIM | Publishes your email signing key | Your email provider and any sending service |
CAA | Limits which authorities can issue certificates | Optional extra security |
Pick one primary address, usually either the root domain or www, and redirect the other to it so search engines see one version of the site. Your host can usually do this redirect for you once both names point to it.
How do you connect a domain to your website?
You connect a domain by adding it in your host's dashboard, copying the DNS records it shows into your DNS provider, and waiting for the host to detect them and issue a certificate. The process is the same on Webflow, Framer, Vercel, Netlify and Cloudflare, though the exact records differ.
Decide where DNS lives
Keep DNS at the registrar or move it to a dedicated DNS provider such as Cloudflare. Use one place only, and note it in your ownership doc.
Export the current zone
Before changing anything, save a copy of every existing record. If something breaks, you can restore it.
Lower the TTL ahead of a move
If you're moving an existing site, reduce the TTL on the records you'll change a day in advance so the switch spreads faster.
Add the domain at your host
Add both the root domain and www in the host's domain settings and note the records it asks for.
Add or update the records
Create the records exactly as shown. Delete old A or CNAME records for the same names that point elsewhere.
Wait for verification and SSL
The host checks the records, then issues a free certificate. This can be quick or take a while as DNS spreads.
Set the primary domain and redirect
Choose root or www as primary and redirect the other. Test both with and without https.
How do SPF, DKIM and DMARC work?
SPF, DKIM and DMARC are DNS records that prove email from your domain is genuine. SPF lists which services may send email as you, DKIM signs each message with a key published in DNS, and DMARC tells receiving servers what to do with mail that fails those checks and where to send reports.
They matter for your website because contact forms, booking tools and newsletter platforms send email on your domain's behalf. If those services aren't in your SPF record and set up with DKIM, their emails, including notifications of new leads, are more likely to land in spam or be rejected. Our guide to email deliverability for website forms goes deeper.
- One SPF record only. Add every sending service to the same TXT record; two SPF records break it.
- DKIM for each service. Your email provider and each sending tool give you their own DKIM records.
- Start DMARC in monitoring mode, read the reports, then tighten the policy once legitimate senders all pass.
Example: what a hypothetical startup's email records cover
For example, suppose a startup uses a workspace email provider, a form service that sends lead notifications, and a newsletter tool.
Its SPF record lists the email provider and the form service. Each of the three services has its own DKIM record. A DMARC record starts in monitoring mode and sends reports to a shared inbox. A month later, once reports show all three pass, the team tightens the DMARC policy. If they later add a CRM that sends email, they add it to SPF and DKIM before turning it on.
How do you get SSL working on a new site?
On modern hosts, SSL works automatically: once your DNS points to the host, it issues a free certificate and renews it before it expires. You shouldn't need to buy a certificate or upload one for a marketing site.
If HTTPS doesn't work after setup, the cause is almost always DNS. Check that old records pointing to a previous host are gone, that a CAA record, if you have one, allows your host's certificate authority, and that a proxy in front of the site, such as Cloudflare's, uses a full and strict encryption mode rather than a flexible one. Then make sure every page redirects from http to https and that your sitemap and canonical tags use https.
What should you check after DNS changes?
After any DNS change, check the website, the email and the forms, in that order, because a site that loads can still hide broken email for days. A quick check saves lost leads.
- Open the root domain and www, with http and https, and confirm each lands on the primary https address.
- Send an email to and from a company address and confirm both arrive.
- Submit the contact form and confirm the notification arrives in the inbox, not spam.
- Check that subdomains such as your app, docs or status page still work.
- Save the new zone file alongside the old one in your ownership doc.
If you're moving hosts at the same time, compare costs and features first in our Vercel vs Netlify vs Cloudflare comparison, and use preview deployments to check the new site before switching DNS.
