Migrations don't fail on the big stuff. They fail on SPF counts and expiring certs.
Disclosure up front: I built the tool in this post. It's free, there are no accounts, and the checklist below works fine with nothing but a terminal…
DevOps
⚑ Report a ProblemLatest DevOps news from Tech News
All topics
agents
ai
api
architecture
automation
aws
backend
beginners
cloud
database
devchallenge
devops
docker
javascript
kubernetes
llm
machinelearning
mcp
node
opensource
performance
productivity
programming
python
security
showdev
testing
tutorial
typescript
webdev
Туннели Tuna стали высокодоступными
Мы разделили Tuna на два слоя. Точки входа на Envoy принимают трафик, туннельные ноды держат подключения клиентов. И те и другие разнесены по дата-ц…
The internet's root key rotates in five days. Your resolver may not be ready.
On October 11 — five days from this post — the most trusted key on the internet changes hands. KSK-2017, the key-signing key that has authenticated…
9.8 Windows DNS RCE: 3 Triage Checks Before It Repeats SigRed
Microsoft's September Patch Tuesday landed a record-setting pile of roughly 970 new CVEs, and two of them are already being exploited. Buried in tha…
I Traced Unbound's DNSSEC Heap Overflow: 4 Checks to Run
[ attacker's zone ] ──► ┌────────────────────────────┐ │ Unbound (recursive, DNSSEC)│ │ CVE-2026-81642 CWE-122 │ │ DNSKEY -> digest buffer │ └───…
DDNS для российских DNS-хостингов: почему не подошли готовые клиенты и что я написал взамен
Я проверил популярные DDNS-клиенты и почти не нашёл в них поддержки российских DNS-хостингов. Поэтому запись для домашнего сервера обычно обновляют…
cert-manager-webhook-freens: сертификаты Let's Encrypt на все поддомены в Kubernetes через бесплатный российский DNS
Казалось бы, что там может быть интересного — A-запись прописал и забыл. Ан нет: стоило захотеть один сертификат сразу на все тестовые поддомены и п…
DoH JSON from the browser: 5 ways Cloudflare and Google differ
Two public resolvers answer DNS queries over HTTPS in JSON: Cloudflare at https://cloudflare-dns.com/dns-query and Google at https://dns.google/reso…
I sampled 330 IPs from 11 VPS providers. Reverse DNS ranged from 0% to 100%, and the blocklist number needs unpacking.
After my last post on cloud provider IP ranges, a few people asked the obvious follow-up: what about the VPS companies you actually buy from? Fair.…
Media Mail Cutovers: Wildcard DNS, Customer Verification, and Tenant Records
A media publisher cannot treat domain onboarding as complete when a page loads. Newsletters, alerts, and contributor mail also need SPF, DKIM, and D…
Logistics Hostname Broke After Adding an Alias (DNS Cutover Constraint)
Short answer: restore the hostname by removing the newly introduced CNAME or the other data at the same owner name, then wait for authoritative answ…
Catch Broken Email DNS Before Your Client Hears “Your Messages Are Bouncing”
A potential customer emails your client's sales address. Seconds later the message comes back: address not found , mailbox unavailable , or domain c…
Connecting a domain to your server (DNS basics)
So far you only reach your server via its IP address. For real services you need a domain – and not just for looks: without a publicly resolving dom…
Customer Domain Verification: Scheduled Polling and Triggered Rechecks for Tenant Onboarding
Give each fintech tenant a platform-owned subdomain first, and activate it from the platform's own DNS change. For a customer-owned hostname, run sc…
DNS Zone Erasure: Automated Pipeline Decisions from Deliverability Evidence
Put an evidence gate in front of every zone teardown, and make that gate bind the tenant, exact zone identifier, observed mail state, and approval t…
Go Reconciliation of Intended and Current DNS Configuration State
Short answer: treat DNS as a control loop, not a sequence of successful API calls. For a fintech platform that gives every tenant a subdomain, the i…
Game Tenant DNS Cutover — Pre-change TTL Scheduling and Auditable Restore
A tenant subdomain cannot move faster than the cached answer already held by resolvers. For a gaming platform that assigns one subdomain to every te…
Kubernetes просто, часть 3: зачем нужен Service и как трафик доходит до конкретного Pod
Pod'ы в Kubernetes появляются, исчезают и меняют IP. Разбираемся, как Service даёт приложению стабильную точку доступа, как работает ClusterIP, DNS,…
Detect Website and Email Failures Before Someone Tells Your Client
Imagine the message arriving in the middle of an ordinary working day: One of our customers just sent us this screenshot. Why does our website say i…
Domain Retirement Guard: Log Intent Before a Destructive Automation Operation
An e-commerce migration changes the answer when one automation account can see both customer-owned and platform-owned zones. Short answer: permit de…
Customer Support DNS: Migrate a Zone with 4-Gate Diff Before Nameservers
The page arrives after a customer changes nameservers: their support portal passes ownership checks, but mail for the same domain no longer behaves…
How to Reconcile Tenant Tables Against Live DNS Lists: Node.js Drift Detection 2026
Short answer: run a scheduled reconciliation that lists the live zones, joins them to tenant records by immutable zone identifier, and emits two met…
Node.js 2026 Runbook for Environment-Scoped DNS Zone Startup Assertions
Create the tenant zone record before the application starts, then refuse to boot when the configured environment, zone identifier, or parent domain…
Manage Internal DNS Hostnames from Infrastructure Code in 4 Deploy Steps
TL;DR: Keep stable internal DNS records in the infrastructure repository, upsert them during deployment, then read them back and fail the deployment…
One Credential DNS Plus Mail Setup vs Separate Vendors: 2026 Reconciliation
Short answer: Use one credential for DNS plus mail setup only when the platform owns the zone; with separate vendors, keep an explicit reconciliatio…
Ваш test — это prod
Просто вы его так не назвали. Открытый стандарт EnvSpec Naming 1.0 — о том, что имя ресурса это модель доверия, а не удобство админа. Стенд UAT с бо…
Node.js Sending Domain Onboarding: One Bundle Setup, Staged Mail Verification for Cutover
For an e-commerce sending domain, a one-step onboarding bundle can simplify setup, but it cannot make DNS and mail verification happen at one instan…
E-Commerce DNS Zones: Enumerate, Diff, Apply, and Verify in Node.js
Short answer: list the live DNS records, save that original snapshot, diff it against the intended set, upsert only the differences, and verify the…
Mail Going to Spam After Setup in 2026: Debug SPF, DKIM, DMARC Alignment
Short answer: inspect one received message and find which authenticated domain aligns with the visible From domain; DMARC passes when an aligned SPF…
Why DNS Had to Exist: The Directory Problem Explained From First Principles
The Directory Problem: Why DNS Was Inevitable Software Laws from First Principles — Investigation 009. This picks up directly from Identity ≠ Locati…