Guides
Guides to the
Guides to the
next question.
Each of these answers the thing you want to know right after one of the tools has shown you something: what SERVFAIL means, why SPF stopped working, which redirect code to use. Written from running these systems, not from summarising other articles. 30 so far.
DNS
- NXDOMAIN vs SERVFAIL: what each DNS error means and how to fix it The two DNS response codes you will actually meet in production, what causes each, how to tell them apart in dig and a resolver comparison, and what to change. 5 min read · 2026-09-15
- How long does DNS propagation take? TTLs, caches and how to check DNS does not propagate, caches expire. What actually decides how quickly a record change is seen, how to plan a cutover, and how to check individual resolvers. 6 min read · 2026-09-15
- CNAME vs A record, and why a CNAME at the apex fails When to point a name at an address and when to alias it, what a CNAME drags along, why the zone apex cannot be one, and what ALIAS and flattening do. 5 min read · 2026-09-16
- CAA records: how they block the wrong CA and how they break renewals What a CAA record tells a certificate authority, the issue, issuewild and iodef tags, and the renewal failure that appears months after someone adds one. 5 min read · 2026-09-16
- The SPF 10 DNS lookup limit: why it breaks and how to fix it What counts towards the SPF lookup limit, why one more SaaS provider silently turns SPF off, and the options for getting back under ten lookups. 8 min read · 2026-09-15
- DMARC p=none vs quarantine vs reject: which policy to use and when to move What each DMARC policy tells receivers, why nearly everyone should start at none, how to read the reports and when to move to quarantine, then reject. 6 min read · 2026-09-15
- SPF PermError: what causes it and how to fix it Too many DNS lookups, two records, a syntax slip or a dead include. What SPF PermError means to receivers, how to find your cause, and the fix for each. 6 min read · 2026-09-16
- SPF vs DKIM vs DMARC: what each one proves and why you need all three SPF checks the sending server, DKIM the message, DMARC what happens when they disagree with the From address. The gaps in each and how they fit together. 7 min read · 2026-09-16
- MTA-STS explained: forcing TLS on inbound mail without breaking delivery Why STARTTLS alone can be stripped, what an MTA-STS policy tells senders, the record and policy file, testing versus enforce, and TLS-RPT reports. 7 min read · 2026-09-16
- MTA-STS max_age and the policy cache: why mail bounced a week after you changed MX Senders cache your MTA-STS policy for max_age seconds, so an MX migration can bounce mail a week later. The safe order of changes and what max_age to pick. 6 min read · 2026-09-24
- DKIM body hash did not verify: what changed the message and how to find it Body hash did not verify means the message changed after signing: a list footer, a gateway disclaimer or re-encoding. How to find what touched it. 6 min read · 2026-09-30
- 550 5.7.26 unauthenticated email: how to pass the Gmail and Yahoo sender rules Gmail's 5.7.26 bounce means SPF, DKIM or DMARC alignment failed. The two variants, what Gmail and Yahoo require of senders, and how to find the cause. 7 min read · 2026-09-30
TLS
- SSL certificate chains explained: leaf, intermediate, root and the missing intermediate problem What a certificate chain is, why the server sends the intermediates and the client supplies the root, and the chain faults that break real deployments. 6 min read · 2026-09-15
- TLS 1.2 vs TLS 1.3: what changed and what to switch off The round trip saved, the cipher suites that went away, why forward secrecy is no longer optional, what still needs 1.2, and how to check a server. 6 min read · 2026-09-16
- Why your SSL certificate works in Chrome but fails in curl, Java, Python and Android Browsers fetch the intermediate your server forgot to send; curl, Python, Java and Android do not. Why it hides in testing, each client's error, and the fix. 7 min read · 2026-09-23
- unable to get local issuer certificate: what it means and how to fix it OpenSSL error 20 has two causes: the server did not send its intermediate, or your trust store lacks the root. How to tell them apart and fix each. 7 min read · 2026-09-23
- How to build a correct fullchain.pem for nginx, Apache, HAProxy and load balancers Leaf first, then intermediates, no root. Build fullchain.pem from certbot or a CA's zip, verify it, and see where nginx, Apache, HAProxy and clouds want it. 6 min read · 2026-09-23
- SSL_ERROR_BAD_CERT_DOMAIN and ERR_CERT_COMMON_NAME_INVALID: the certificate is for another name Firefox and Chrome refuse a certificate that does not list the name you asked for. How to tell a wrong default certificate from a missing SAN, and fix each. 7 min read · 2026-09-30
- certificate has expired and ERR_CERT_DATE_INVALID: which certificate, and why The leaf, an intermediate or the client's clock: how to tell which one expired, why renewals fail silently, and how to monitor certificate expiry from CI. 6 min read · 2026-09-30
- self-signed certificate in certificate chain: what it means for npm, pip, git and curl Why npm, pip, git and curl fail while the browser works: a corporate proxy or a private CA. How to tell which, and how to add the root without disabling checks. 6 min read · 2026-09-30
- 47-day SSL certificates: the timeline, what breaks and how to get ready Certificate lifetimes drop to 100 days in March 2027 and 47 in 2029. What the dates mean, which setups break first, and how to check yours is automated. 8 min read · 2026-10-20
- ACME Renewal Information (ARI): how your CA tells you when to renew ARI (RFC 9773) lets a CA set each certificate's renewal window and pull it forward before a revocation. How it works, which clients use it, how to query it. 6 min read · 2026-10-20
HTTP
- 301 vs 302 vs 307 vs 308: choosing the right HTTP redirect The four redirect codes, permanent versus temporary, why 307 and 308 exist, what browsers cache and search engines do, and which to use for HTTPS. 5 min read · 2026-09-15
- HTTP security headers: what each one does and a sensible default set HSTS, Content-Security-Policy, X-Frame-Options, Referrer-Policy, Permissions-Policy and the rest, one at a time, with a sensible starting configuration. 9 min read · 2026-09-15
- HSTS preload: the checklist, and the ways it locks you out What Strict-Transport-Security does, what preloading adds, the exact header the list requires, the subdomain trap, and a staged rollout you can back out of. 6 min read · 2026-09-16
- 502 vs 503 vs 504: which layer failed and how to tell Three gateway errors that look the same to a visitor but point at different failures: a bad upstream reply, a refusal, or no answer. How to tell which. 6 min read · 2026-09-16
- ERR_TOO_MANY_REDIRECTS: how to find and fix a redirect loop A redirect loop is two layers that disagree: a proxy and the app, apex and www, slash rules or cookies. How to see the hops, find the pair and fix it. 6 min read · 2026-09-30