Guides

DNS lookup

Add IPv6 to your website: AAAA records, testing and pitfalls

Make a website reachable over IPv6: check host and CDN support, add AAAA records, test both protocols and fix problems only IPv6 visitors see.

DNS lookup

CAA records: control which CAs can issue your certificates

Write CAA records that allow only your certificate authorities, handle wildcards and CDNs, add iodef reporting, and avoid breaking renewals.

RPKI / ROA validator

Create RPKI ROAs at RIPE NCC, ARIN and APNIC

Publish Route Origin Authorisations for your prefixes, choose max-length safely, and check routes are RPKI valid before and after the change.

DNSSEC check

Enable DNSSEC on your domain (Cloudflare, 20i and others)

Sign your zone, add the DS record at your registrar, check the chain of trust, and avoid the outages DNSSEC causes when you move DNS.

DNS lookup

Get an email when your domain's DNS, email security or expiry changes

How domain watch keeps an eye on a domain's DNS records, SPF, DMARC and MTA-STS, registration expiry and spam blocklists, and emails you only when something really changed.

HTTP headers & security check

HSTS and the preload list: roll it out without locking yourself out

Add Strict-Transport-Security safely: ramp up max-age, test includeSubDomains, meet the preload list requirements and know how removal works.

Email security check

Set up BIMI: show your logo in Gmail, Apple Mail and Yahoo

What BIMI needs: DMARC at enforcement, an SVG Tiny PS logo, a VMC or CMC certificate and the DNS record, and which mailbox providers show it.

Email security check

Set up MTA-STS and TLS-RPT for your domain

Make sending servers insist on TLS when they deliver to you: host the MTA-STS policy, publish the DNS records, test, then switch to enforce.

Email security check

Why is my email going to spam? A step-by-step checklist

Check authentication, reputation, blocklists, list hygiene and content, plus the Gmail, Yahoo and Outlook bulk sender rules, to get back to the inbox.

SSL/TLS certificate check

Check an SSL certificate: expiry, chain, hostname

Check a site's TLS certificate for expiry, missing intermediates and hostname mismatches, fix each error, and keep Let's Encrypt renewals working.

DN42 free resource finder

DN42 getting started: registry to first peering

Join DN42 step by step: pick a free AS number and prefixes, write your registry objects, get them merged and bring up a first BGP peering.

DNS propagation check

DNS changes not showing? Propagation and TTL

Why a DNS change takes time to appear, how TTL and negative caching set the delay, and how to flush caches on Windows, macOS, Linux and browsers.

Email security check

Fix "SPF too many DNS lookups" (PermError)

Why SPF fails with a PermError above 10 DNS lookups, how to count them, and five ways to get back under the limit without breaking mail.

MCP server tester

How to test a remote MCP server before you ship it

Check a remote MCP server's handshake, protocol version, tool list, context cost and OAuth discovery before Claude, ChatGPT or Cursor users find the bugs.

Email security check

Move DMARC from p=none to p=reject safely

A staged plan to take DMARC from monitoring to p=quarantine and p=reject without blocking your own mail: reports, fixes, records and rollback.

Email security check

Set up SPF, DKIM and DMARC for Google Workspace

Step-by-step DNS records for SPF, DKIM and DMARC on a Google Workspace domain, the admin console steps, and how to check that they work.

Email security check

Set up SPF, DKIM and DMARC for Microsoft 365

The exact SPF, DKIM CNAME and DMARC records for a custom domain on Microsoft 365 (Exchange Online), where to find them, and how to verify them.