We added authoritative DNS hosting with DNSSEC to our email forwarding platform. Here's why.

Every email forwarding service makes you go somewhere else to manage DNS. Add your domain here, then go to Cloudflare or your registrar, copy these 5 records, paste them in, wait for propagation, come back and click verify. If you get one record wrong, your mail breaks and you're debugging across two dashboards.

We got tired of that workflow, so we built DNS hosting directly into RacterMX.

What you get

When you add a domain and choose "Host DNS with RacterMX," we become the authoritative nameserver for that domain. You point your registrar's NS records to us and we handle everything else.

• Full zone editor with support for A, AAAA, CNAME, MX, TXT, SRV, NS, CAA, and more
• DNSSEC signing out of the box (no configuration needed)
• Conflict detection that warns you before you create records that would break something
• Propagation checks so you can verify your records are live worldwide
• Zone history with diff view between any two snapshots
• One-click rollback if a change goes wrong
• Drift detection that alerts you if records change outside our editor

Auto-provisioned mail records

This is the part that saves the most time. When you enable DNS hosting for a domain, we automatically create:

• MX records pointing to our mail servers
• SPF record authorizing our IPs
• DKIM public key record (we generate and manage the key pair)
• DMARC record with a sensible default policy
• MTA-STS policy, certificate, and DNS record (prevents TLS downgrade attacks)

You go from "I just bought a domain" to "fully configured email forwarding with authentication and encryption" in about 30 seconds. No copy-pasting, no typos, no waiting.

Why bundle DNS with email?

Because email authentication is entirely DNS-based. SPF, DKIM, DMARC, MTA-STS, DANE, CAA... all of it lives in DNS records. When we control the zone, we can auto-provision records, auto-fix security findings, and guarantee consistency between your mail configuration and your DNS state. When DNS is managed elsewhere, we're always one step removed and dependent on the user getting the records right.

It also means our security scanner can do one-click auto-fix. If it finds a missing DMARC record or a weak SPF policy, it can write the fix directly to the zone instead of just telling you what to change.

Powered by PowerDNS

Under the hood we run PowerDNS with the MySQL backend. Zones are signed with DNSSEC automatically. The API handles record CRUD, and our zone editor is a frontend for that API. Same infrastructure that large DNS providers use, just scoped to your domains.

DNS Scanner

Since we have built in Domain Posture Scanning, and its vital to use that all the proper records be in place to support safe, consistant mail delivery, For us it was a no-brainer. If you host your own DNS, you can use our domain scanner to tell you where you missed a record, if your using our DNS hosting, we scan your domain daily to ensure all records are in place to support email and keep your domains safe. This includes things like looking for dangling cname records, etc.

Is DNS hosting something you want bundled with email forwarding, or do you prefer keeping them separate? We're curious how people think about this.