MX
Directs where inbound domain email should be delivered.
Domain, DNS and SSL
THE ZONE & THE CERTIFICATE
The zone and the certificate
Engineering the Domain Services Your Business Depends On
Novatelia administers domains, DNS zones, and certificates for customer-controlled domains. The customer holds the domain.
Domain ownership sits with the registrant. The registrar handles registration. Authoritative DNS publishes the records that web and applications use. An HTTPS certificate covers the names in the design. DNSSEC signs the zone only where the registry and the DNS operator both support it. Email authentication records are MX, SPF, DKIM, and DMARC, and they are not the mailbox.
Registrar transfers depend on acceptance by the registrar. No registrar-partner status is published. No Cloudflare-partner status is published.
Explore How a Domain Connects to Web, Email and Trust Services
Conceptual internet infrastructure diagram — not a live domain lookup.
A
Domain and DNS resolution
The registrant, or the authorized account holder, controls the domain at the registrar. The registrar delegates the domain. The authoritative DNS operator publishes the records. A recursive resolver asks for those records and returns the website or application destination. The registrar is not assumed to operate the authoritative zone.
B
Web HTTPS and TLS
A browser resolves the domain name, connects to the web server or the TLS termination point, and checks that the certificate matches the requested name. A certificate is not domain ownership, not DNSSEC, and not the security of the whole website.
C
Email routing and authentication
MX directs inbound mail. SPF names authorized sending systems for the envelope domain. DKIM adds a cryptographic signature. DMARC checks alignment with the visible From domain and states a policy. They do not perform the same job, and DMARC is not a guarantee that spam will be stopped.
Seven Domain Infrastructure Services
01
Domain Administration
Registrar account relationships, domain contacts, and renewal information for a domain the customer holds. Novatelia does not become the domain owner. The registrar account holder remains in control.
02
DNS Record Administration
Authoritative zone records changed by whoever controls the zone. A, AAAA, CNAME, MX, and TXT are explained below as technical context, not as a live editor.
03
SSL/TLS Certificate Management
Certificate names, HTTPS use, issuance prerequisites, and renewal planning for the names the design lists. Automatic issuance and a certificate-provider authorization are not guaranteed.
04
DNSSEC Configuration
Signing, DNS-operator support, registry or registrar delegation, DS records, and rollover planning. DNSSEC is enabled only where those parties support it. It is not assumed, and it does not encrypt ordinary DNS queries.
05
Email Authentication DNS
MX, SPF, DKIM, and DMARC are different records. Mailbox design and email administration stay on the business-email page.
06
Existing Cloudflare Configuration
DNS and proxy settings when the customer’s zone is already on Cloudflare. An existing account is required. This is not a partner, reseller, or managed-WAF claim.
07
Domain, Zone or Certificate Migration
A current-state review, authorization, change planning, registrar or issuer requirements, and cutover checks. Zero downtime is not guaranteed. The registrar must accept a transfer.
Understand the DNS Records Behind Business Services
Every example uses example.test and is explicitly an example. None of these records is a live Novatelia production zone or a customer configuration.
A
A
Maps a name to an IPv4 address. Example only: www.example.test could point at an address the site operator publishes. It relates to web and application reachability. A change needs zone authority.
AAAA
AAAA
Maps a name to an IPv6 address. Example only: the same illustrative name could have an IPv6 destination. It is independent of the A record.
CNAME
CNAME
Aliases one name to another name. Example only: app.example.test could alias to a host the application provider names. A CNAME is not used at the zone apex in ordinary DNS.
MX
MX
Names the servers that accept mail for the domain. Example only: example.test could list a mail host. MX is routing, not a mailbox and not SPF.
TXT
TXT
Carries text, including SPF and DMARC policy in common deployments. Example only: a TXT value is illustrative and is not a live Novatelia record.
CAA
CAA
States which certificate authorities may issue for the name, where the operator chooses to publish that policy. Example only. It does not itself issue a certificate.
NS
NS
Delegates the zone to the authoritative name servers. Example only: the NS set is chosen by the party who controls delegation. It is not a website address.
DS
DS
Publishes the delegation signer used when DNSSEC is enabled. It links the parent to the signed child zone. Example only. DNSSEC is not turned on by default.
MX, SPF, DKIM and DMARC Serve Different Purposes
SPF
Defines which sending systems are authorized for the relevant envelope domain.
DKIM
Uses cryptographic signatures to support message authentication and integrity verification.
DMARC
Evaluates alignment of authenticated identifiers with the visible From domain and specifies handling and reporting policy. It does not guarantee delivery or spam prevention.
Mailbox design remains on Business Email.
From Certificate Requirements to Renewal Planning
An educational sequence. Renewals are not all automatic, and this page does not check a live certificate.
- 01Identify required hostnames.
- 02Confirm domain validation control.
- 03Select the appropriate certificate approach.
- 04Complete issuance requirements.
- 05Configure HTTPS termination.
- 06Validate certificate deployment.
- 07Plan renewal and expiration review.
DNSSEC Protects the Authenticity of DNS Answers
DNSSEC publishes cryptographic signatures and a chain of trust through DS records at the parent, when the registry and the authoritative operator both support it. Resolvers that validate can detect altered answers. An incorrect DS or a broken rollover can make a valid name fail validation.
- DNSSEC does not encrypt normal DNS queries.
- It does not replace TLS.
- It does not protect every website application.
- It does not prevent every kind of domain compromise.
Domain Control and Migration Require Authorization
Registrar transfer
Moving domain registration between registrars. It requires authorization and registrar acceptance.
DNS hosting migration
Changing the authoritative DNS operator or where the zone is hosted.
Website hosting migration
Changing the web infrastructure. It is not the same as a registrar transfer.
Certificate replacement
Updating the certificate at the TLS endpoint after issuance requirements are met.
These operations are not interchangeable. Not every transfer is available. No registrar-specific timeline is published.
Cloudflare Configuration for Existing Customer Accounts
Configuration context is an existing customer Cloudflare account: DNS records, proxy settings when applicable, and SSL/TLS settings when they are in the approved scope. The customer authorizes the change. Zones are not required to use Cloudflare. Cloudflare is not described as the registrar in every case. No partner badge is shown.
Related Domain, Email and Workspace Services
- Business Email
Mailbox design and administration.
- Transactional Email
Application mail, separate from DNS records.
- Microsoft 365
Tenant mail context. No partner title.
- Google Workspace
Workspace mail context. No reseller title.
Learn More About Email Authentication and Domain Infrastructure
Domain, DNS and SSL — Questions and Answers
01Who controls the domain?
The registrar account holder. Novatelia prepares the records and the change. The party who can edit the zone publishes them.
02What is DNSSEC?
DNSSEC signs the DNS answers so a resolver can check they were not altered. It is used when the registry and the DNS operator both support it. It is not turned on by default on this page.
03Is Cloudflare configuration a partnership?
No. Cloudflare is configured only when the customer already uses it. A partner title is not published.
04Who owns and controls a domain?
The customer holds the domain. Control of the registrar account sits with the account holder. Novatelia administers records when that party authorizes the change.
05What is authoritative DNS?
The operator that publishes the zone answers for the domain. A recursive resolver asks that operator. The registrar and the authoritative operator are not always the same party.
06What is the difference between a registrar and a DNS provider?
The registrar manages registration and delegation. The DNS provider, when different, operates the authoritative zone. Delegation via NS records connects them.
07What do A and AAAA records do?
An A record maps a name to IPv4. An AAAA record maps a name to IPv6. The examples on this page are illustrative.
08What is the purpose of CNAME and MX records?
A CNAME aliases one name to another. An MX record directs where inbound mail for the domain is delivered. Neither one is a mailbox.
09What is an SSL/TLS certificate?
A certificate lets a site present HTTPS for the names it covers. TLS is the protocol. The certificate is checked against the requested name.
10Does an HTTPS certificate guarantee a secure website?
No. It supports encrypted transport to the name on the certificate. It is not domain ownership, DNSSEC, or the security of the application.
11Does DNSSEC encrypt DNS traffic?
No. DNSSEC signs answers so they can be validated. It does not replace TLS and it does not encrypt ordinary DNS queries.
12What are SPF, DKIM and DMARC?
SPF authorizes sending systems for the envelope domain. DKIM signs messages. DMARC evaluates alignment with the visible From domain and states handling and reporting policy. They are not the same control, and they do not guarantee delivery.
13What is the difference between DNS configuration and mailbox administration?
DNS records tell other systems where mail goes and how authentication is published. Mailbox design and day-to-day mailbox administration are separate services.
14Can Novatelia configure an existing Cloudflare account?
DNS or proxy settings can be in scope when the customer’s zone is already on Cloudflare and the customer authorizes the change.
15Does Cloudflare configuration imply official partnership?
No. A partner title is not published, and Cloudflare is not assumed to be the registrar.
16What is required for a registrar transfer?
Authorization from the domain holder and acceptance by the gaining registrar. Not every transfer is available. No registrar-partner status is published.
17How does DNS migration differ from domain transfer?
A registrar transfer moves registration between registrars. A DNS migration changes the authoritative operator or zone hosting. Website hosting and certificate replacement are further, separate operations.
18Can a customer retain ownership of the domain?
Yes. The customer holds the domain. Administration does not transfer ownership.
19How can a business request domain, DNS or certificate assistance?
Open the RFQ draft. It saves a browser draft. It does not submit a request, publish a price, issue a quotation reference, transfer a domain, edit DNS, or issue a certificate.
Define Your Domain, DNS and Certificate Requirements
The RFQ currently saves a browser draft and does not submit a request or issue a quotation reference.