Every association website depends on three pieces of invisible infrastructure: a domain name, DNS records, and an SSL certificate. These are not the kind of things your staff thinks about on a daily basis. They sit quietly in the background, doing their work, until something goes wrong. And when something goes wrong with any of them, the consequences are immediate and severe. Your website goes down. Your email stops working. Your members see security warnings that erode their trust in your organization.
The challenge is that these foundational elements are often managed by whoever set them up years ago, under an account that nobody remembers the password to, with a credit card that has long since expired. When that fragile arrangement breaks, the scramble to fix it is stressful, expensive, and entirely preventable.
This guide explains what DNS, domains, and SSL certificates actually do, why they matter, and how your association should manage them. It is written for non-technical staff who make decisions about these services, not for system administrators who already understand the plumbing. If you leave this post with a clear mental model of how these pieces fit together and a checklist of actions to protect your organization, it will have done its job.
What DNS Is and Why It Matters
DNS stands for Domain Name System, and the simplest way to understand it is as the phone book of the internet. When someone types your association URL into a browser, their computer does not actually know where your website lives. It knows a human-readable name like yourorg.org, but the internet runs on numerical addresses called IP addresses, something like 192.168.1.1. DNS is the system that translates the name your members type into the numerical address of the server where your website is hosted.
This translation happens every single time someone visits your site. Their browser asks a DNS server, "Where is yourorg.org?" and the DNS server responds with the IP address. The browser then connects to that IP address and loads your website. The entire process takes milliseconds, and your visitors never see it happening.
Here is why this matters for your association: if your DNS is misconfigured, your website is unreachable even if everything else works perfectly. Your web server could be running flawlessly. Your content could be freshly updated. Your hosting bill could be paid in full. None of it matters if DNS cannot point visitors to the right place. DNS is the first link in the chain, and if it breaks, nothing downstream works.
Think of it like the address on a building. Your office might be fully operational inside, but if the street signs pointing to it are wrong, nobody can find you. DNS is the set of street signs that directs internet traffic to your website, your email server, and your other online services.
Domain Name Management for Associations
Your domain name, the yourorg.org or yourorg.com that your members type into their browsers, is one of the most valuable digital assets your association owns. It is your online identity, your brand, and the address that every piece of marketing, every email signature, and every search engine result points to. Losing control of your domain name is the digital equivalent of losing your headquarters and every piece of mail addressed to it.
Registrar selection. Your domain is registered through a domain registrar, a company authorized to sell and manage domain names. Common registrars include GoDaddy, Namecheap, Cloudflare, and Google Domains (which has transitioned to Squarespace Domains). Where your domain is registered matters because it determines the management interface you use, the security features available to you, and the support you can access if something goes wrong. Not all registrars are equal. Some offer robust security features like two-factor authentication and domain locking. Others prioritize upselling you on services you do not need. Choose a reputable registrar with strong security features and reliable customer support.
Domain ownership is critical. This is one of the most common and most dangerous mistakes associations make: the domain is registered to an individual staff member, a board member, or the web agency that built the site, rather than to the association itself. When that person leaves the organization, retires from the board, or when your agency relationship ends, they take control of your domain with them. The domain must be registered to the association as the organization. The registration contact should use an organizational email address, not a personal one. And more than one person at the association should have access to the registrar account.
Renewal management. Domains expire. They are not permanent. You are renting the right to use a domain name, typically on an annual basis, and if you do not renew it, you lose it. Auto-renewal should be enabled on every domain your association owns, and the credit card or payment method on file must be current. An expired domain can be purchased by a domain squatter within hours of expiration. These squatters monitor expiring domains specifically to grab valuable ones and resell them at inflated prices, sometimes thousands of dollars. Losing your domain to a squatter is not a hypothetical risk. It happens to organizations regularly.
Domain lock. Most registrars offer a transfer lock feature, sometimes called registrar lock or domain lock. When enabled, this prevents anyone from transferring your domain to a different registrar without first unlocking it and completing a verification process. This is a basic security measure that protects against unauthorized transfers, whether from a disgruntled former employee or from social engineering attacks targeting your registrar account. Transfer lock should be enabled on every domain you own.
WHOIS privacy. When you register a domain, your contact information is entered into a public database called WHOIS. Without privacy protection, anyone can look up who registered a domain and see the name, address, phone number, and email on file. WHOIS privacy, sometimes called domain privacy or privacy protection, replaces your real contact information with proxy information provided by the registrar. This shields your staff from spam, phishing attempts, and unwanted solicitations. Most registrars offer this for free or for a small annual fee.
Subdomain Strategy
A subdomain is a prefix added before your main domain name. For example, if your domain is yourorg.org, then events.yourorg.org, learn.yourorg.org, and members.yourorg.org are all subdomains. Associations frequently use subdomains, but the decision of when to use one versus a subdirectory deserves careful thought.
Subdomains versus subdirectories. The choice between events.yourorg.org (a subdomain) and yourorg.org/events (a subdirectory) is not merely cosmetic. It has real implications for how search engines treat your content and how your technical infrastructure is organized. A subdirectory is part of your main website. It shares the same server, the same codebase, and the same domain authority in the eyes of search engines. A subdomain is treated by Google as a separate website. It can be hosted on a different server, run on a different platform, and it builds its own domain authority independently.
SEO implications. For search engine optimization, subdirectories are generally the better choice. When your content lives at yourorg.org/events, it benefits from and contributes to the domain authority your main website has built over years. Links to your event pages strengthen your entire domain. When your content lives at events.yourorg.org, it starts with zero domain authority and must build its own search presence from scratch. Google treats subdomains as separate sites, which means you are effectively splitting your online presence.
When subdomains make sense. Despite the SEO disadvantage, subdomains are the right choice in certain situations. If your learning management system runs on an entirely different platform than your main website, a subdomain like learn.yourorg.org lets you host it on separate infrastructure without interfering with your primary site. The same applies to community platforms, career boards, or any application that runs on its own codebase and has its own hosting requirements. The key question is whether the content is part of your main website or a separate application that happens to be associated with your organization.
Common association subdomains. Associations commonly use subdomains for community portals, learning platforms, event registration systems, member portals, and career centers. If you are using a subdomain, make sure your SSL certificate covers it, your DNS records are properly configured for it, and you have a clear linking strategy between the subdomain and your main site to help visitors and search engines navigate between them.
DNS Record Types Associations Need to Understand
DNS is not a single setting. It is a collection of records, each serving a different purpose. You do not need to be able to configure these yourself, but you do need to understand what they do so you can have informed conversations with your IT team, your hosting provider, or your web agency when changes are needed.
A records. An A record (Address record) is the most fundamental DNS record. It points your domain name to the IP address of the server where your website is hosted. When someone types yourorg.org into their browser, the A record is what tells the internet which server to connect to. If you change hosting providers, your A record needs to be updated to point to the new server.
CNAME records. A CNAME (Canonical Name) record points a subdomain to another domain name rather than directly to an IP address. This is commonly used when you are hosting a service through a SaaS platform or a content delivery network. For example, your community.yourorg.org subdomain might have a CNAME record pointing to yourorg.hosted-community-platform.com. The platform provider handles the IP address; your DNS just needs to know to send traffic their way.
MX records. MX (Mail Exchanger) records tell the internet where to deliver email for your domain. When someone sends an email to staff@yourorg.org, MX records determine which mail server receives it. If your association uses Microsoft 365 or Google Workspace for email, your MX records point to Microsoft or Google mail servers. Misconfigured MX records mean your association stops receiving email. This is not a minor inconvenience. For many associations, email is a primary communication channel with members, sponsors, and partners. A disruption in email delivery can have immediate operational consequences.
TXT records. TXT records are general-purpose records used for a variety of verification and authentication purposes. When you set up Google Workspace or Microsoft 365, you verify domain ownership by adding a TXT record. When you configure email authentication to prevent spoofing, you add TXT records. They do not point anywhere or route any traffic. They simply store text information that other services read and validate.
Email Authentication: SPF, DKIM, and DMARC
Email authentication is a topic that deserves special attention because it directly affects whether your association emails reach your members or end up in their spam folders. Three DNS records work together to authenticate your email and prevent bad actors from sending emails that appear to come from your domain.
SPF (Sender Policy Framework). An SPF record is a TXT record that lists which mail servers are authorized to send email on behalf of your domain. When a receiving mail server gets an email claiming to be from yourorg.org, it checks the SPF record to see if the sending server is on the authorized list. If it is not, the email is flagged as suspicious. Without an SPF record, anyone can send email that appears to come from your domain, and receiving servers have no way to verify the claim.
DKIM (DomainKeys Identified Mail). DKIM adds a digital signature to your outgoing emails. The receiving server checks this signature against a public key stored in your DNS records to verify that the email was actually sent by your organization and has not been tampered with in transit. Think of it as a wax seal on a letter. It proves the letter came from who it claims to come from and that nobody opened and altered it along the way.
DMARC (Domain-based Message Authentication, Reporting, and Conformance). DMARC ties SPF and DKIM together and tells receiving servers what to do when an email fails authentication. Should they reject it? Quarantine it? Let it through but flag it? DMARC also generates reports that tell you who is sending email using your domain, which helps you identify unauthorized use. Without DMARC, even if you have SPF and DKIM configured, receiving servers are left to make their own decisions about failed authentication.
Many associations have incomplete email authentication. They might have an SPF record but no DKIM. Or they have both but no DMARC policy. This means their emails are more likely to land in spam folders, particularly when sending to large providers like Gmail, Yahoo, and Microsoft Outlook. In 2024, Google and Yahoo began enforcing stricter authentication requirements for bulk senders, which means associations that send newsletters, event invitations, or membership communications need proper email authentication more than ever.
DNS Propagation: Why Changes Are Not Instant
When you change a DNS setting, whether updating an A record to point to a new server or adding a TXT record for email verification, the change does not take effect everywhere at the same time. DNS records are cached (temporarily stored) by internet service providers, browsers, and other systems around the world. When you make a change, those cached copies need to expire before the systems request fresh information.
This process is called DNS propagation, and it typically takes anywhere from 15 minutes to 48 hours. During this window, some visitors will see your old site while others see the new one. Some email may route to the old server while other email reaches the new one. This is normal behavior, not a sign that something went wrong.
Why this matters for migrations. If your association is moving to a new hosting provider or launching a redesigned website, DNS propagation needs to be part of the plan. You cannot flip a switch and have every visitor see the new site instantly. Best practice is to keep both the old and new servers running during the propagation window, to lower the TTL (Time to Live) on your DNS records before making the change so caches expire faster, and to schedule the cutover during a low-traffic period. Your web agency or hosting provider should have a migration plan that accounts for propagation. DNS is only one piece of a clean cutover, as we covered in our guide to migrating your association website without losing SEO rankings.
SSL Certificates Explained
If DNS is the phone book that helps visitors find your website, an SSL certificate is the lock on the front door that keeps the conversation between your visitor and your server private. SSL (Secure Sockets Layer) and its modern successor TLS (Transport Layer Security) encrypt the connection between a visitor's browser and your web server. Without encryption, every piece of data that travels between them, including login credentials, personal information, form submissions, and payment details, is transmitted in plain text and can be intercepted by anyone positioned between the two points.
HTTPS versus HTTP. You can tell whether a site uses SSL by looking at the URL. HTTPS (the "S" stands for Secure) means an SSL certificate is active and the connection is encrypted. HTTP means there is no encryption. The difference is not academic. Google has penalized HTTP sites in search rankings since 2014, and Chrome displays a prominent "Not Secure" warning next to the URL for any site that does not use HTTPS. For your members, that warning is a red flag that erodes trust. For your search rankings, the penalty is measurable. There is no legitimate reason for an association website to be running on HTTP in 2026.
Types of SSL Certificates
Not all SSL certificates are the same. They differ in the level of verification the issuing authority performs before granting the certificate. Understanding the differences will help you choose the right one for your association.
Domain Validation (DV). A DV certificate verifies only that you control the domain. The issuing authority confirms that you can respond to an email at the domain or add a DNS record to prove ownership. The process is fast and often fully automated. DV certificates are available for free through Let's Encrypt and are included with most modern hosting platforms. For the vast majority of association websites, a DV certificate provides the encryption you need.
Organization Validation (OV). An OV certificate goes a step further, verifying that the organization behind the domain is a legitimate, registered entity. This involves checking business registration documents and confirming the organization's identity. OV certificates typically cost between $50 and $200 per year. They provide an additional layer of trust for sites that handle sensitive transactions, though the visual difference in the browser is minimal compared to a DV certificate.
Extended Validation (EV). An EV certificate involves a rigorous verification process including legal, physical, and operational checks of the organization. They cost between $150 and $500 per year. EV certificates previously displayed the organization name in a green bar in the browser address bar, which was a visible trust signal. However, most major browsers have removed this visual indicator, significantly reducing the practical benefit of EV certificates for the higher cost. For most associations, the additional expense is no longer justified.
Let's Encrypt and Automated SSL
Let's Encrypt has fundamentally changed the SSL certificate landscape. It is a free, automated certificate authority that issues DV certificates at no cost. Since its launch in 2016, Let's Encrypt has issued billions of certificates and is supported by virtually every modern hosting platform. For most associations, Let's Encrypt is the right choice.
How it works. Let's Encrypt certificates are issued for 90 days at a time, much shorter than the one-year term of traditional paid certificates. This shorter lifespan is a security feature, not a limitation. If a certificate is compromised, the window of exposure is smaller. The trade-off is that renewal must happen more frequently, but this is handled automatically by your hosting platform. You do not need to manually renew a Let's Encrypt certificate. Your hosting provider's automated systems handle the renewal process every 60 to 90 days without any action on your part.
When to consider a paid certificate. Paid OV or EV certificates may be worth considering if your association processes payments directly on your website (rather than through a third-party payment processor like Stripe or PayPal), if you need to meet specific compliance requirements that mandate OV or EV certification, or if your organization has a policy requiring organizational validation. For the majority of associations, a free Let's Encrypt DV certificate provides the same level of encryption and the same browser trust indicators as a paid DV certificate.
SSL Certificate Renewal and Expiration
SSL certificates expire. Whether yours is a 90-day Let's Encrypt certificate or an annual paid certificate, it has an expiration date. When that date passes without renewal, your website does not simply lose a green padlock icon. It displays a full-page browser security warning that says "Your connection is not private" or "This site is not secure." This warning is designed to be alarming, and it is effective. Virtually every visitor who sees it will leave immediately.
An expired SSL certificate effectively takes your website offline for all practical purposes. Your server is still running. Your content is still there. But no one can reach it without clicking through a scary warning that their browser actively discourages them from bypassing.
Auto-renewal is not optional. Whether you use Let's Encrypt or a paid certificate, auto-renewal should be enabled and verified. For Let's Encrypt, your hosting platform handles this automatically. For paid certificates, make sure the payment method on file is current and that renewal notifications go to an email address that is actively monitored. Do not rely on a single person to receive and act on renewal notices. Use a shared mailbox or distribution list so that certificate expiration alerts are never missed because someone is on vacation, has changed roles, or has left the organization.
Mixed Content: The Hidden SSL Problem
Having an SSL certificate installed does not automatically mean your entire site is secure. A common issue called mixed content occurs when your pages are served over HTTPS but some of the resources on those pages, such as images, scripts, or stylesheets, are loaded over plain HTTP.
When a browser detects mixed content, it may display a warning, block the insecure resources from loading, or show your site as "partially secure." This undermines the trust that your SSL certificate is supposed to establish. The cause is usually historical: images uploaded years ago with http:// URLs in the database, embedded content from third-party sources that have not been updated to HTTPS, or hardcoded HTTP links in older templates.
How to fix it. Run your site through a mixed content checker or use your browser's developer tools to identify resources being loaded over HTTP. In most cases, the fix is straightforward: update the URLs in your content database from http:// to https://, replace hardcoded links in templates, and ensure that any third-party embeds use HTTPS. Your web developer or agency can typically resolve mixed content issues in a few hours if the site is otherwise well-maintained.
What Happens When Things Go Wrong
Understanding the consequences of failure helps explain why proactive management of these systems is so important. Here are the most common failure scenarios associations face.
Expired domain. When your domain expires, your website goes down immediately. But that is only the beginning. Domain squatters actively monitor expiring domains and can register yours within hours of expiration. Once a squatter owns your domain, they can demand thousands of dollars to sell it back. During the recovery process, which can take weeks or months, your association has no website, no email, and no online presence at the address your members know. Every link to your site from search engines, social media, partner websites, and your own printed materials points to a dead end or, worse, to content the squatter has placed on your former domain.
Expired SSL certificate. An expired certificate triggers a full-page browser warning that says "Your connection is not private." Visitors are told the site may be trying to steal their information. Most browsers require users to click through multiple warnings to proceed, and the vast majority will not. Your site is effectively offline. If the expiration happens on a Friday evening and nobody notices until Monday morning, that is an entire weekend of lost traffic, missed event registrations, and member frustration. For associations that process online payments or handle member data, an expired certificate also raises compliance concerns.
DNS misconfiguration during migration. Website migrations are the most common time for DNS errors. An incorrect A record sends traffic to the wrong server. A missing MX record stops email delivery. A malformed CNAME record makes a subdomain unreachable. Because of DNS propagation, the effects may not be fully visible for 24 to 48 hours, which means problems can go undetected until they are widespread. During this window, some members can reach your site and some cannot, making the issue difficult to diagnose from a single location.
Domain registered to a former employee. This scenario is more common than most associations realize. A staff member registered the domain years ago using their personal email and credit card. They have since left the organization. The domain is technically their property because it is registered in their name. Legal recovery is possible but slow, expensive, and uncertain. Meanwhile, the former employee controls your organization's online identity, your email, and your website. Even if they are cooperative, the process of transferring ownership can take weeks and requires their active participation. Prevention is vastly easier than remediation.
Best Practices Checklist
Use this checklist to audit your association's domain and DNS infrastructure. Each item represents a specific action that reduces risk and strengthens your organization's control over its online presence.
- Domain registered to the association. The domain registration should list the association as the organization, with an organizational email address as the contact. Not a personal email. Not an agency email. The organization itself.
- Two people have registrar account access. At least two authorized staff members should have login credentials for the domain registrar. If one person is unavailable, the other can manage the domain. Store these credentials in an organizational password manager, not in a personal browser.
- Auto-renewal enabled with current payment method. Verify that auto-renewal is turned on and that the payment method on file is valid and will not expire before the next renewal date. Set a calendar reminder to check this annually.
- Transfer lock enabled. Log in to your registrar and confirm that domain transfer lock (also called registrar lock) is active. This prevents unauthorized domain transfers.
- SSL certificate with auto-renewal. Confirm that your SSL certificate is current and that auto-renewal is configured. If you are using Let's Encrypt, verify that your hosting platform is handling automated renewals successfully.
- Email authentication records configured. Verify that SPF, DKIM, and DMARC records are all present and correctly configured in your DNS. Use a free tool like MXToolbox to check your domain's email authentication status.
- DNS managed by a reliable provider. Your DNS should be managed by your hosting provider or a managed DNS service like Cloudflare or AWS Route 53, not by the cheapest registrar you could find. Managed DNS services offer better uptime, faster propagation, and more robust security features.
- Annual audit of all domain and DNS settings. Put a recurring annual task on your operations calendar to review domain registration details, DNS records, SSL certificate status, and email authentication. Treat this like any other compliance or governance audit.
Securing Your Foundation
DNS, domains, and SSL certificates are the foundation your association website sits on. They are not glamorous. They do not appear in design mockups or feature lists. But if that foundation is misconfigured, nothing built on top of it works reliably. A beautifully designed website means nothing if visitors cannot reach it because the domain expired. A member portal is useless if the browser displays a security warning because the SSL certificate lapsed. An email campaign is wasted if your messages land in spam because your authentication records are incomplete.
The good news is that securing this foundation is not complicated or expensive. It requires attention, documentation, and a commitment to treating these assets as the critical infrastructure they are. An annual audit, proper ownership documentation, and automated renewal processes will prevent the vast majority of incidents that catch associations off guard.
83 Creative helps associations audit and secure their domain infrastructure so you never have to deal with an expired certificate, a lost domain, or a failed email delivery. If you are unsure about the state of your domain, DNS, or SSL configuration, we can review it and recommend specific steps to protect your organization. Get in touch at 83creative.com/contact.
Link: Understanding Website Hosting for Associations and Nonprofits