Migrations don't fail on the big stuff. They fail on SPF counts and expiring certs.
Disclosure up front: I built the tool in this post. It's free, there are no accounts, and the checklist below works fine with nothing but a terminal…
Последние новости Web от Tech News
Все темы
AI
agents
ai
api
architecture
automation
backend
beginners
career
database
devchallenge
devops
discuss
javascript
linux
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
security
showdev
testing
tutorial
typescript
webdev
Checking ccTLD availability without trusting one source (and what .si actually sells for)
Every "is this domain available" check you have ever run is a wrapper around someone else's cache. For .com that's usually fine — dozens of systems…
Туннели Tuna стали высокодоступными
Мы разделили Tuna на два слоя. Точки входа на Envoy принимают трафик, туннельные ноды держат подключения клиентов. И те и другие разнесены по дата-ц…
The internet's root key rotates in five days. Your resolver may not be ready.
On October 11 — five days from this post — the most trusted key on the internet changes hands. KSK-2017, the key-signing key that has authenticated…
DNS Tunneling and Egress Control: Closing the Channel That Almost Always Works
DNS Tunneling and Egress Control: Closing the Channel That Almost Always Works When an egress firewall blocks outbound traffic to the internet, ther…
9.8 Windows DNS RCE: 3 Triage Checks Before It Repeats SigRed
Microsoft's September Patch Tuesday landed a record-setting pile of roughly 970 new CVEs, and two of them are already being exploited. Buried in tha…
Mullvad Public DNS Shuts Down Nov 2: 5 Checks I Ran First
On September 3, Mullvad announced it is shutting down the public encrypted DNS servers it has run since 2022 and sponsoring Quad9 instead. If you ne…
I Traced Unbound's DNSSEC Heap Overflow: 4 Checks to Run
[ attacker's zone ] ──► ┌────────────────────────────┐ │ Unbound (recursive, DNSSEC)│ │ CVE-2026-81642 CWE-122 │ │ DNSKEY -> digest buffer │ └───…
DDNS для российских DNS-хостингов: почему не подошли готовые клиенты и что я написал взамен
Я проверил популярные DDNS-клиенты и почти не нашёл в них поддержки российских DNS-хостингов. Поэтому запись для домашнего сервера обычно обновляют…
cert-manager-webhook-freens: сертификаты Let's Encrypt на все поддомены в Kubernetes через бесплатный российский DNS
Казалось бы, что там может быть интересного — A-запись прописал и забыл. Ан нет: стоило захотеть один сертификат сразу на все тестовые поддомены и п…
DoH JSON from the browser: 5 ways Cloudflare and Google differ
Two public resolvers answer DNS queries over HTTPS in JSON: Cloudflare at https://cloudflare-dns.com/dns-query and Google at https://dns.google/reso…
I sampled 330 IPs from 11 VPS providers. Reverse DNS ranged from 0% to 100%, and the blocklist number needs unpacking.
After my last post on cloud provider IP ranges, a few people asked the obvious follow-up: what about the VPS companies you actually buy from? Fair.…
Media Mail Cutovers: Wildcard DNS, Customer Verification, and Tenant Records
A media publisher cannot treat domain onboarding as complete when a page loads. Newsletters, alerts, and contributor mail also need SPF, DKIM, and D…
Setting Up DNS for SaaS Emails
When you create a Software as a Service (SaaS) or a social web platform, one of the often-overlooked parts of it is the email DNS configuration. I l…
Logistics Hostname Broke After Adding an Alias (DNS Cutover Constraint)
Short answer: restore the hostname by removing the newly introduced CNAME or the other data at the same owner name, then wait for authoritative answ…
Catch Broken Email DNS Before Your Client Hears “Your Messages Are Bouncing”
A potential customer emails your client's sales address. Seconds later the message comes back: address not found , mailbox unavailable , or domain c…
Connecting a domain to your server (DNS basics)
So far you only reach your server via its IP address. For real services you need a domain – and not just for looks: without a publicly resolving dom…
Can a Developer Ship a Frontend With No DNS or Centralized Backend?
The short answer is yes, and it has been possible for years. The longer answer is that "no DNS, no backend" describes a spectrum rather than a binar…
Customer Domain Verification: Scheduled Polling and Triggered Rechecks for Tenant Onboarding
Give each fintech tenant a platform-owned subdomain first, and activate it from the platform's own DNS change. For a customer-owned hostname, run sc…
DNS Zone Erasure: Automated Pipeline Decisions from Deliverability Evidence
Put an evidence gate in front of every zone teardown, and make that gate bind the tenant, exact zone identifier, observed mail state, and approval t…
Go Reconciliation of Intended and Current DNS Configuration State
Short answer: treat DNS as a control loop, not a sequence of successful API calls. For a fintech platform that gives every tenant a subdomain, the i…
Game Tenant DNS Cutover — Pre-change TTL Scheduling and Auditable Restore
A tenant subdomain cannot move faster than the cached answer already held by resolvers. For a gaming platform that assigns one subdomain to every te…
Node.js Bounded Domain Verification Polling With Customer Visible Pending Reasons
For a marketplace that gives each tenant a subdomain, make domain proof a bounded state machine and show customers the last observation, not a guess…
Detect Website and Email Failures Before Someone Tells Your Client
Imagine the message arriving in the middle of an ordinary working day: One of our customers just sent us this screenshot. Why does our website say i…
Domain Retirement Guard: Log Intent Before a Destructive Automation Operation
An e-commerce migration changes the answer when one automation account can see both customer-owned and platform-owned zones. Short answer: permit de…
Customer Support DNS: Migrate a Zone with 4-Gate Diff Before Nameservers
The page arrives after a customer changes nameservers: their support portal passes ownership checks, but mail for the same domain no longer behaves…
How to Reconcile Tenant Tables Against Live DNS Lists: Node.js Drift Detection 2026
Short answer: run a scheduled reconciliation that lists the live zones, joins them to tenant records by immutable zone identifier, and emits two met…
DNS Record Write Rejected Because Zone ID Is Not Domain Name — Validation Debug
Short answer: when a DNS record write is rejected because a zone ID is not a domain name, resolve the opaque reference first, canonicalize the retur…
Node.js 2026 Runbook for Environment-Scoped DNS Zone Startup Assertions
Create the tenant zone record before the application starts, then refuse to boot when the configured environment, zone identifier, or parent domain…
Property Domain Offboarding — Delete Records Without Whole-Zone Risk
Short answer: retire only the records owned by the departing property, never the whole DNS zone, unless an ownership check proves that the zone itse…