Learn

The three things that put a website on the internet.

We handle all of this for you. But at some point we will ask you to approve a change to your domain, and you deserve to understand what you are approving rather than clicking yes because someone technical said so. This is that explanation — no jargon left undefined.

1

A name you rent

Your domain. Nobody sells you a domain outright — you hold an exclusive right to it for as long as you keep renewing.

2

Answers about that name

DNS records. They tell the world where your site lives, where your mail goes, and who may vouch for you.

3

Proof it is really you

A TLS certificate. It is what turns the padlock on, and what stops anyone else impersonating your site.

Your domain

You are renting a name, not buying a thing.

There is no file or object that is “your domain.” What you have is an entry in a shared registry saying this name is yours, and the exclusive right to decide what it points at.

The registry

Keeps the master list for one ending — one organisation is responsible for every .com, another for every .org. You never deal with them directly.

The registrar

The company you actually buy from and log in to — GoDaddy, Namecheap, Cloudflare. They are a licensed reseller sitting between you and the registry. This is who your renewal fee goes to.

The nameservers

The machines that answer questions about your domain. They are usually your registrar’s by default, but they do not have to be — and pointing them elsewhere moves control of all your records at once.

The records

The individual answers those machines give. This is the layer we change to point your domain at your new site — and the only layer we ever need to touch.

This is exactly why we can say your domain stays yours. We never become your registrar and never take ownership. We ask for one record to be changed. You can change it back, from your own account, without our involvement.

The records

“Should this be a CNAME or a TXT?” is the wrong question.

It is the most common thing people ask, and it contains a hidden assumption — that these are two ways of doing the same job and you must pick one. They are not. Each record type answers a completely different question, which is why a domain usually has several kinds at once.

  • A / AAAA

    Where does this name live?

    Gives the numeric address of the machine serving the site. A is the older, shorter kind of address; AAAA is the newer, longer kind. Most names have both.

  • CNAME

    What is this name another name for?

    Not an address — a redirection. It says “to answer anything about this name, go ask that name instead.” It is how we point your domain at our hosting without you ever handing it over.

  • TXT

    What do I need to say about this name?

    Free-form text attached to a name. Used to prove you control a domain, and to publish the email rules further down this page. It carries statements, not destinations.

  • MX

    Where does mail for this name go?

    Points at your mail provider. Completely independent of where the website lives — which is why we can move your site without touching your email.

  • NS

    Who is allowed to answer for this name?

    Names the servers holding the real answers. Changing these hands the whole domain to a different DNS provider — the biggest lever on this list, and the one to be most careful with.

  • CAA

    Who may issue certificates for this name?

    A short list of the certificate authorities permitted to vouch for your domain. If it is set and your provider is not on it, no padlock is possible.

The one rule that explains most DNS errors

A CNAME cannot share a name with any other record. If shop.yourbusiness.com is a CNAME, it cannot also have a TXT record — the standard forbids it, because a CNAME means “everything about this name is answered elsewhere,” which leaves no room for a local answer to sit beside it.

That single rule is why you cannot point your bare domain — yourbusiness.com with no www — at a host using a CNAME. Your bare domain must carry other records, not least your MX records for email. A CNAME there would wipe out your mail. Providers work around it with something usually called ALIAS or ANAME, which behaves like a CNAME but resolves behind the scenes so the conflict never arises.

Waiting

Nothing propagates. Something expires.

“Wait 24–48 hours for propagation” is the most repeated sentence in this field and it describes something that does not happen. Understanding what is really going on tells you what to do instead of waiting.

DNS is asked, never told

Your change is live on your nameservers the moment you save it. It is not sent anywhere. No other computer is notified.

Everyone else keeps a copy

Each record carries a TTL — how long anyone may reuse the answer before asking again. Set a five-minute TTL the day before a change and the wait mostly disappears.

“No such record” gets cached too

Ask for a name that does not exist yet and that absence is remembered. Add the record a minute later and your own computer may insist it is missing while the rest of the world sees it.

So waiting is not always the answer

A record that saved wrong and a record still expiring from a cache look identical from the outside. Waiting only fixes one of them.

The padlock

A certificate is a signed statement, not a security product.

A TLS certificate — still widely called an SSL certificate, after the older technology it replaced — is a short document saying “this name belongs to whoever holds this key,” signed by an organisation your browser already trusts.

What it does prove

  • Nobody between you and the site can read or alter what passes — card numbers, form entries, passwords.
  • You reached the real holder of that domain name, not an impostor sitting in the middle.

What it does not prove

  • That the business is honest, or the site is safe to buy from.
  • Anything at all about the people running it. Certificates are free, so anyone can get one — including scammers.

Who issues them, and why they cost nothing

Certificate authorities issue them. Your browser and operating system ship with a built-in list of a few dozen authorities they trust; everything else follows from that list. An authority signs an intermediate, the intermediate signs yours, and your browser follows that chain back to a name it already knows.

They used to be sold for hundreds a year. Then Let’s Encrypt — a non-profit — began issuing them free and, more importantly, automatically: a protocol called ACME lets a server prove it controls a domain and collect a certificate in seconds, with no human involved. That automation is the real change. It is why the padlock became universal, and why we can renew yours indefinitely without ever sending you an invoice for it.

There are three grades, and two of them are marketing

Domain Validated proves you control the domain. Organisation and Extended Validation additionally verify the legal entity behind it — a real check, done by humans, which is what you are paying for.

The encryption is identical in all three. And the famous green bar with your company name in it no longer exists: Safari removed it in 2018, Chrome and Firefox in 2019. In 2026 a visitor sees exactly the same padlock whether you paid nothing or several hundred pounds.

Renewal

Certificates expire — and far faster than they used to.

Every certificate has an end date, and the industry maximum is being deliberately shortened on a published schedule. A shorter life limits the damage if a key is ever stolen, and forces everyone to automate renewal instead of relying on someone remembering.

  • Until March 2026 398 days Just over a year. Still what most articles on the internet say.
  • Now — since 15 March 2026 200 days A little over six months.
  • From 15 March 2027 100 days Roughly a quarter.
  • From 15 March 2029 47 days Six and a half weeks.

This is the practical reason managed hosting matters. At 47 days, a certificate someone renews by hand will eventually be forgotten, and the first sign is a browser telling your customers the site is unsafe. Ours renew automatically, and we watch them.

Email

Your email lives in DNS too — and it fails quietly.

This is the part worth caring about most, because when a website record is wrong the site stops loading and you find out immediately. When a mail record is wrong, messages simply stop arriving and nothing tells you. People assume you are ignoring them.

  • SPF

    Which servers may send mail as you.

    A TXT record listing the mail services allowed to send on your behalf. It has a hard limit of ten lookups — chain too many services together and it stops working entirely, silently.

  • DKIM

    A signature proving a message really came from you.

    Your provider signs outgoing mail with a private key and publishes the matching public key as a TXT record. A receiver checks the signature and knows the message was not forged or altered.

  • DMARC

    What receivers should do when the first two fail.

    Ties SPF and DKIM to your actual From: address and tells the world whether to ignore, quarantine, or reject mail that fails. It also sends you reports — which is how you find out someone is impersonating you.

Why three records and not one

Each covers a hole in the others. SPF checks a hidden address most people never see, so a forger can pass SPF while displaying your name to the reader. DKIM proves a message was not altered, but not that it came from the right place. DMARC ties both back to the From: address a human actually reads, and states what should happen when they disagree.

The practical upshot: if we ever ask you to be careful with an existing TXT record, this is why. Deleting one line you do not recognise can stop your business receiving mail, and the failure is silent for days.

Straight answers

Five things you have probably been told that are not true.

  • “DNS changes take 48 hours to propagate.”

    Nothing propagates. No change is pushed anywhere. Other computers simply cached the previous answer, and they will ask again when that cached copy expires — a duration you control, and can lower before making a change.

  • “The padlock means the site is safe.”

    It means the connection is private and you reached the name you typed. It says nothing about whether the people running the site are honest. Criminals can and do get certificates — they are free.

  • “I need an expensive certificate for a real business.”

    A paid certificate uses identical encryption to a free one. You are buying identity vetting and support, not stronger protection — and since 2019 browsers show no visible difference at all.

  • “SPF stops people spoofing my domain.”

    On its own it barely does. SPF checks a hidden envelope address, not the From: line a human reads. Only DMARC ties the check to the address your recipient actually sees.

  • “It’s not working, so DNS must still be updating.”

    Often it saved incorrectly, or never saved at all. Those look identical from the outside, and waiting fixes only one of them.

You will never have to do any of this.

We set it up, we monitor it, and we renew it. The reason we wrote it all down is that you should be able to check our work — and know what you are agreeing to on the one occasion we ask you to change something.

See pricing How the service works