Article image

DNS Mapping for Agencies: Untangling Registrars, Nameservers, and Hosts

One of the most common organizational nightmares for a growing digital agency occurs on a Friday afternoon when a client calls in a panic: "The website is down, and emails are bouncing."

The agency team rushes to troubleshoot, only to hit an immediate wall of administrative confusion. The client's domain was registered five years ago by an ex-employee. At some point, the nameservers were pointed to Cloudflare. The website codebase is hosted on Vercel, but the WordPress headless CMS lives on WP Engine. To make matters worse, their email is handled by Microsoft 365.

When infrastructure is splintered across four or five different platforms, diagnosing a simple routing error becomes an archaeological expedition. Who has the Cloudflare login? Which platform is actually controlling the A records? If the domain expires, who gets the billing notification?

This isn't a hypothetical risk. Some of the biggest outages of the past year — including the November 18, 2025 Cloudflare incident that briefly took down access to X, ChatGPT, Canva, Zoom, and Slack, and the October 20, 2025 AWS outage that was triggered by a DNS resolution failure in the US-EAST-1 region and rippled out to over 1,000 downstream services — were rooted in DNS-layer failures. When the infrastructure you don't control breaks, the only thing standing between you and hours of guesswork is knowing exactly how your stack is wired together.

For web agencies, establishing a strict framework for agency DNS management is not just about technical routing; it is about operational survival. If you cannot reliably track client nameservers and clearly map out where a client's digital assets live, you cannot offer reliable website care plans or guarantee uptime.

This guide breaks down how agencies can untangle the web of registrars, nameservers, and hosts, implement a rock-solid Cloudflare agency setup, and build a system to permanently document client DNS records.

1. The Three-Headed Monster: Understanding Web Infrastructure Layers

To properly map a client's infrastructure, an agency team must first conceptually separate the three foundational layers of web hosting. A common mistake made by junior developers and clients alike is assuming that the company you pay for your domain name is also the company that hosts your website. While this is sometimes true (e.g., buying everything through a single unified host), modern performance setups actively split these duties.

Layer 1: The Domain Registrar (The Deed to the Property)

The domain registrar is the retail company (like GoDaddy, Namecheap, or Squarespace Domains) where the client purchased the legal right to use their domain name (e.g., clientcompany.com).

Worth noting for anyone auditing an older client account: Google Domains no longer exists as an independent registrar. Google sold the business to Squarespace in 2023, and by mid-2024 every remaining Google Domains account had been migrated over. If you inherit a client whose old documentation says "Google Domains," the account — and the login — now lives at Squarespace, not Google.

What it controls: The domain's WHOIS data, the annual renewal billing, and the foundational NS (Nameserver) records.

Agency Rule: The agency should rarely own this account. The client must retain legal ownership. The registrar's only active technical job should be pointing its nameservers (Layer 2) to the correct DNS manager.

Layer 2: The DNS Manager / Nameservers (The Switchboard)

The Domain Name System (DNS) is the directory that translates human-readable domains into machine-readable IP addresses. The nameservers hold the "zone file" for the domain, which dictates where different types of traffic should go.

What it controls: When a user types in the domain, the DNS manager routes web traffic to the web host, and when someone sends an email, it routes email traffic to the email provider.

Agency Rule: This is the layer agencies must control to manage migrations, launch new sites, and verify email deliverability.

Layer 3: The Host (The Physical Destination)

This is the physical or cloud server where the actual application files, codebases, databases, or email inboxes live.

What it controls: The frontend and backend of the website (e.g., Kinsta, Vercel, AWS) and the email service (e.g., Google Workspace, Microsoft 365).

2. Best Practices for Agency DNS Management

Historically, agencies managed DNS records directly inside the client's registrar (like GoDaddy). This meant that every time an agency needed to verify a new Google Search Console property or change an email routing rule, they had to ask the client for a 2FA code to log into the registrar.

Today, the industry standard for agency DNS management is to decouple the DNS manager from the registrar entirely. Centralizing DNS management empowers agencies to update records immediately without waiting on client approvals, removing DNS as a roadblock during site migrations.

The Standard: The Cloudflare Agency Setup

Cloudflare has become the default DNS provider for web agencies. Its free plan includes unmetered DDoS mitigation, a global CDN spanning 330+ data centers, free Universal SSL, and DNS resolution that averages well under 15ms globally — with no bandwidth charges regardless of traffic volume. One caveat worth documenting internally: as of September 2024, Cloudflare capped free-plan zones created after that date at 200 DNS records per zone (older zones are grandfathered in at 1,000), so very large or subdomain-heavy clients may need to plan around that limit.

When configuring a Cloudflare agency setup, you generally have a few structural options:

Option A: The Single Agency Account (The "All-in-One" Method)

In this model, the agency creates one master Cloudflare account and adds every client domain into this single dashboard.

  • Pros: It provides a simple overview of all domains from one login, making it easy to manage configurations at scale. It's practical for agencies managing many client sites because the free plan easily accommodates multiple domains without recurring costs.
  • Cons: The client does not own their Cloudflare configuration. If the client leaves the agency, transferring the DNS zone out requires exporting and importing records, causing friction.

Option B: Account Per Client with RBAC (The Enterprise Method)

In this model, the client creates their own Cloudflare account (or the agency creates it for them using the client's credentials) and utilizes Role-Based Access Control (RBAC). The client then invites the agency team as an "Administrator" to the account. Note that on non-Enterprise plans, an account can only have one Super Administrator — the role with billing and membership control — so agencies typically operate as Administrators rather than owners under this model.

  • Pros: The client retains 100% ownership of their domain infrastructure. It provides better isolation for security issues and makes it easy to sever ties if the collaboration ends without causing downtime.
  • Cons: You must navigate multiple account silos.

Option C: Cloudflare Organizations (The Newer Middle Ground)

Cloudflare has been rolling out an "Organizations" feature that lets a Super Administrator group multiple separate Cloudflare accounts — including client-owned ones — under a single pane of glass, without needing to be individually invited to each one. For agencies running Option B at scale, this is worth evaluating: it aims to solve the "account silo" problem of per-client accounts while still letting each client keep independent ownership and billing of their own zone.

Essential Cloudflare Configuration Rules:

  • Proxy Status Matters: Cloudflare's "Orange Cloud" means traffic is being proxied through their CDN, hiding the origin IP address and applying security rules. The "Grey Cloud" means it's DNS-only. Crucial rule: proxy web traffic (A and CNAME records pointing to the site), but disable the proxy (Grey Cloud) for mail servers and specific FTP routes to prevent broken connections.
  • Strict SSL: Set your SSL/TLS encryption mode to "Full (Strict)" to ensure the connection is encrypted securely from the user to Cloudflare, and from Cloudflare to your origin server. Flexible SSL often results in dangerous redirect loops.

3. The SOP: How to Document Client DNS Records

When onboarding a new web design client, you must audit their existing infrastructure before touching a single line of code. Failing to document client DNS records accurately will result in dropped emails and broken subdomains when the new site launches.

Follow this strict DNS Mapping Standard Operating Procedure (SOP):

Step 1: The Initial Lookup and Discovery

Before asking the client any questions, investigate their public footprint. Use a terminal command (like dig ns yourdomain.com +short on macOS/Linux or nslookup -type=ns yourdomain.com on Windows) or web tools (like MxToolbox or dnschecker.org) to query the domain.

Run an NS lookup to see which nameservers hold authoritative data; this tells you exactly where the DNS is currently managed. If the nameservers are ns1.bluehost.com, you know the DNS is at Bluehost. If they are lola.ns.cloudflare.com, the DNS is at Cloudflare.

Step 2: Export and Audit Existing Records

Once you gain access to the active DNS manager, you must identify what every record does. The internet runs on specific record types:

  • A Record (Address): Maps the domain to an IPv4 address. This is the main pointer to the web server.
  • AAAA Record: Maps the domain to an IPv6 address.
  • CNAME (Canonical Name): An alias that points a subdomain (like www.) to another domain name instead of an IP.
  • MX Record (Mail Exchange): Dictates which mail servers receive emails for the domain (e.g., pointing to Google Workspace or Microsoft 365).
  • TXT Record (Text): Contains arbitrary text used heavily for domain verification and email security protocols like SPF, DKIM, and DMARC.
  • SRV Record (Service Locator): Indicates specific services available on the domain, detailing host, port, priority, and weight.
  • CAA Record (Certification Authority Authorization): Specifies which Certificate Authorities are permitted to issue SSL/TLS certificates for the domain. Public CAs have been required to check for a CAA record before issuing a certificate since 2017, and its presence (or absence) is one of the easiest things to overlook during an audit. A domain with no CAA record is implicitly telling every CA on earth it's fair game, which widens the door for certificate mis-issuance.

Don't skip the email authentication audit. Documenting MX and TXT records is no longer optional busywork — since February 2024, Google and Yahoo have required any domain sending 5,000+ emails a day to Gmail or Yahoo addresses to have SPF and DKIM configured, plus a published DMARC record, and Google tightened enforcement further in November 2025, moving from delayed delivery to outright rejection of non-compliant mail. Microsoft followed with its own SPF/DKIM/DMARC alignment requirement for bulk senders on Outlook.com, enforced starting May 5, 2025. If a client's marketing platform (Mailchimp, HubSpot, Klaviyo, etc.) sends on their behalf, your DNS map needs to capture every SPF include and DKIM selector tied to that domain, or a routine DNS cleanup can silently break their email deliverability.

Step 3: Verify TTL (Time to Live)

If you are planning to launch a new website or migrate a host, look at the TTL settings on the existing A records. If the TTL is set to 24 hours, any changes you make will take a full day to propagate globally. Standardize your SOP by dropping the TTL to 5 minutes (300 seconds) at least 48 hours before a planned migration to ensure a swift, seamless cutover.

4. The Systemization Solution: Tracking Infrastructure at Scale

The largest vulnerability in agency DNS management is not technical capability; it is institutional memory. When your agency scales to managing 50, 100, or 200 client websites, keeping track of where the registrar is, where the DNS is routed, and where the site is hosted becomes impossible to hold in your head.

Many agencies attempt to use static spreadsheets to track client nameservers and document logins. Spreadsheets are notoriously brittle. They require manual updating, break easily, and offer zero automated oversight. When an employee forgets to update the spreadsheet after moving a client from GoDaddy to Cloudflare, the agency loses track of the asset footprint.

This is precisely why modern digital agencies integrate InstaRenewal into their operational stack. As the backend organizational engine for productized services and asset management, it fundamentally replaces the brittle spreadsheet.

How to use InstaRenewal for DNS Mapping:

Instead of scattered notes, you utilize a centralized tracker to build an explicit "Infrastructure Map" for every client:

  • The Registry Node: Log the domain registrar, the legal owner (the client), and the exact expiration date. The system automatically monitors this date independent of the registrar to prevent catastrophic expiration.
  • The Routing Node: Explicitly log the active nameservers. By documenting that the domain points to Cloudflare, any technician on your team knows instantly where to go to update an MX or TXT record.
  • The Hosting Node: Map the A records to the exact hosting container (e.g., "Kinsta Server #4") and tie it directly to the client's recurring care plan billing.

By centralizing this map, you achieve complete operational clarity. If a client emails the support desk saying their email is down, your technician doesn't need to guess. They check the map, see the DNS is at Cloudflare and the MX records point to Microsoft 365, and can begin targeted troubleshooting in seconds.

5. Conclusion

Mastering agency DNS management is a hallmark of a mature, professional digital agency. By understanding the strict separation between the registrar, the nameservers, and the host, you protect both your agency and your clients from critical infrastructure failures — the kind that made headlines in 2025 when DNS-layer issues at providers like AWS and Cloudflare took down household-name apps for hours at a time.

Moving away from decentralized, client-managed DNS in favor of a robust Cloudflare agency setup streamlines your operations, speeds up site deployments, and reduces client friction. However, the technical setup is only half the battle. You must rigorously document client DNS records — including the newly non-negotiable SPF/DKIM/DMARC and CAA records — and utilize automated asset trackers like InstaRenewal to track client nameservers continuously.

When you untangle the web infrastructure and document it systematically, you eliminate the "Friday afternoon panic" and replace it with predictable, scalable, and highly professional agency operations.