diff --git a/src/cloudron.js b/src/cloudron.js
index 1448d2f2c..e8ad6b574 100644
--- a/src/cloudron.js
+++ b/src/cloudron.js
@@ -312,7 +312,7 @@ function getSpfRecord(callback) {
     subdomains.get('', 'TXT', function (error, txtRecords) {
         if (error) return callback(error);
 
-        var i, validSpf, spfRecord =  { subdomain: '', type: 'TXT', value: null };
+        var i, validSpf, spfRecord =  { subdomain: '', type: 'TXT', values: null };
 
         for (i = 0; i < txtRecords.length; i++) {
             var value = txtRecords[i][0];
@@ -325,12 +325,12 @@ function getSpfRecord(callback) {
         if (validSpf) return callback(null, null);
 
         if (i == txtRecords.length) {
-            spfRecord.value = '"v=spf1 a:' + config.fqdn() + ' ~all"';
+            txtRecords[i] = '"v=spf1 a:' + config.fqdn() + ' ~all"';
         } else {
-            spfRecord.value = '"v=spf1 a:' + config.fqdn() + txtRecords[i][0].slice('"v=spf1"'.length);
+            txtRecords[i] = '"v=spf1 a:' + config.fqdn() + txtRecords[i][0].slice('"v=spf1"'.length);
         }
 
-        return callback(null, spfRecord);
+        return callback(null, txtRecords);
     });
 }
 
@@ -351,12 +351,12 @@ function addDnsRecords(callback) {
     var dkimKey = readDkimPublicKeySync();
     if (!dkimKey) return callback(new CloudronError(CloudronError.INTERNAL_ERROR, new Error('internal error failed to read dkim public key')));
 
-    var nakedDomainRecord = { subdomain: '', type: 'A', value: sysinfo.getIp() };
-    var webadminRecord = { subdomain: 'my', type: 'A', value: sysinfo.getIp() };
+    var nakedDomainRecord = { subdomain: '', type: 'A', values: [ sysinfo.getIp() ] };
+    var webadminRecord = { subdomain: 'my', type: 'A', values: [ sysinfo.getIp() ] };
     // t=s limits the domainkey to this domain and not it's subdomains
-    var dkimRecord = { subdomain: DKIM_SELECTOR + '._domainkey', type: 'TXT', value: '"v=DKIM1; t=s; p=' + dkimKey + '"' };
+    var dkimRecord = { subdomain: DKIM_SELECTOR + '._domainkey', type: 'TXT', values: [ '"v=DKIM1; t=s; p=' + dkimKey + '"' ] };
     // DMARC requires special setup if report email id is in different domain
-    var dmarcRecord = { subdomain: '_dmarc', type: 'TXT', value: '"v=DMARC1; p=none; pct=100; rua=mailto:' + DMARC_REPORT_EMAIL + '; ruf=' + DMARC_REPORT_EMAIL + '"' };
+    var dmarcRecord = { subdomain: '_dmarc', type: 'TXT', values: [ '"v=DMARC1; p=none; pct=100; rua=mailto:' + DMARC_REPORT_EMAIL + '; ruf=' + DMARC_REPORT_EMAIL + '"' ] };
 
     var records = [ ];
     if (config.isCustomDomain()) {
@@ -378,7 +378,9 @@ function addDnsRecords(callback) {
 
         //     async.eachSeries(records, subdomains.update, retryCallback);
         // });
-        async.eachSeries(records, subdomains.update, retryCallback);
+        async.eachSeries(records, function (record, iteratorCallback) {
+            subdomains.update(record.subdomain, record.type, record.values, iteratorCallback);
+        }, retryCallback);
     }, function (error) {
         gUpdatingDns = false;
         callback(error);
diff --git a/src/dns/caas.js b/src/dns/caas.js
index 77dc40d81..f3f5179a1 100644
--- a/src/dns/caas.js
+++ b/src/dns/caas.js
@@ -5,7 +5,7 @@
 exports = module.exports = {
     add: add,
     del: del,
-    updateSubdomain: updateSubdomain,
+    update: update,
     getChangeStatus: getChangeStatus,
     get: get
 };
@@ -15,7 +15,8 @@ var assert = require('assert'),
     debug = require('debug')('box:dns/caas'),
     SubdomainError = require('../subdomainerror.js'),
     superagent = require('superagent'),
-    util = require('util');
+    util = require('util'),
+    _ = require('underscore');
 
 function add(zoneName, subdomain, type, values, callback) {
     assert.strictEqual(typeof zoneName, 'string');
@@ -67,19 +68,19 @@ function get(zoneName, subdomain, type, callback) {
         });
 }
 
-function updateSubdomain(zoneName, subdomain, type, value, callback) {
+function update(zoneName, subdomain, type, values, callback) {
     assert.strictEqual(typeof zoneName, 'string');
     assert.strictEqual(typeof subdomain, 'string');
     assert.strictEqual(typeof type, 'string');
-    assert.strictEqual(typeof value, 'string');
+    assert(util.isArray(values));
     assert.strictEqual(typeof callback, 'function');
 
-    get(zoneName, subdomain, type, function (error, values) {
+    get(zoneName, subdomain, type, function (error, result) {
         if (error) return callback(error);
 
-        if (values[0] === value) return callback();
+        if (_.isEqual(values, result)) return callback();
 
-        add(zoneName, subdomain, type, value, callback);
+        add(zoneName, subdomain, type, values, callback);
     });
 }
 
diff --git a/src/dns/route53.js b/src/dns/route53.js
index 3707ac816..6c1035f5d 100644
--- a/src/dns/route53.js
+++ b/src/dns/route53.js
@@ -6,7 +6,7 @@ exports = module.exports = {
     add: add,
     get: get,
     del: del,
-    updateSubdomain: updateSubdomain,
+    update: update,
     getChangeStatus: getChangeStatus
 };
 
@@ -16,7 +16,8 @@ var assert = require('assert'),
     debug = require('debug')('box:dns/route53'),
     settings = require('../settings.js'),
     SubdomainError = require('../subdomainerror.js'),
-    util = require('util');
+    util = require('util'),
+    _ = require('underscore');
 
 function getDnsCredentials(callback) {
     assert.strictEqual(typeof callback, 'function');
@@ -113,14 +114,20 @@ function add(zoneName, subdomain, type, values, callback) {
     });
 }
 
-function updateSubdomain(zoneName, subdomain, type, value, callback) {
+function update(zoneName, subdomain, type, values, callback) {
     assert.strictEqual(typeof zoneName, 'string');
     assert.strictEqual(typeof subdomain, 'string');
     assert.strictEqual(typeof type, 'string');
-    assert.strictEqual(typeof value, 'string');
+    assert(util.isArray(values));
     assert.strictEqual(typeof callback, 'function');
 
-    add(zoneName, subdomain, type, value, callback);
+    get(zoneName, subdomain, type, function (error, result) {
+        if (error) return callback(error);
+
+        if (_.isEqual(values, result)) return callback();
+
+        add(zoneName, subdomain, type, values, callback);
+    });
 }
 
 function get(zoneName, subdomain, type, callback) {
diff --git a/src/subdomains.js b/src/subdomains.js
index b82df9ba8..a8d84cb35 100644
--- a/src/subdomains.js
+++ b/src/subdomains.js
@@ -5,7 +5,6 @@
 var assert = require('assert'),
     caas = require('./dns/caas.js'),
     config = require('./config.js'),
-    debug = require('debug')('box:subdomains'),
     route53 = require('./dns/route53.js'),
     SubdomainError = require('./subdomainerror.js'),
     util = require('util');
@@ -47,17 +46,15 @@ function get(subdomain, type, callback) {
     });
 }
 
-function update(record, callback) {
-    assert.strictEqual(typeof record, 'object');
+function update(subdomain, type, values, callback) {
+    assert.strictEqual(typeof subdomain, 'string');
+    assert.strictEqual(typeof type, 'string');
+    assert(util.isArray(values));
     assert.strictEqual(typeof callback, 'function');
 
-    debug('update: ', record);
-
-    api().updateSubdomain(config.zoneName(), record.subdomain, record.type, record.value, function (error) {
+    api().update(config.zoneName(), subdomain, type, values, function (error) {
         if (error) return callback(error);
 
-        debug('updateSubdomain: successfully updated subdomain %j', record);
-
         callback(null);
     });
 }
@@ -66,6 +63,7 @@ function remove(subdomain, type, values, callback) {
     assert.strictEqual(typeof subdomain, 'string');
     assert.strictEqual(typeof type, 'string');
     assert(util.isArray(values));
+    assert.strictEqual(typeof callback, 'function');
 
     api().del(config.zoneName(), subdomain, type, values, function (error) {
         if (error && error.reason !== SubdomainError.NOT_FOUND) return callback(error);