Network Tools

There are two different answers to any DNS question: what the authoritative nameserver holds, and what a given resolver has cached. Querying the authoritative servers directly shows the current truth; querying a public resolver shows what most users are getting right now. When those disagree, you are simply waiting out a TTL. Nothing “propagates” — records are pulled on demand and held for the TTL you published, so lowering the TTL to 300 seconds a day before a migration is the only real preparation.

The apex of a domain cannot hold a CNAME, because the record type conflicts with the SOA and NS records that must exist there. Providers work around this with ALIAS or flattening records that resolve to an address at query time. Get this wrong and mail stops, because the conflicting CNAME suppresses the MX record.

When you compare two nameservers, check the SOA serial. If it differs between them, one has not picked up the latest zone transfer, and you are chasing an inconsistency rather than a configuration error.

Routers generate the ICMP time-exceeded messages traceroute depends on using their control plane, which is deliberately deprioritised compared to forwarding traffic. A middle hop showing 180 ms while the final destination answers in 30 ms is completely normal and means nothing is wrong. Only the last hop’s latency describes the actual round trip.

Rows of asterisks mean a hop did not reply, usually because ICMP is filtered there — not because packets are being dropped. Return paths are frequently asymmetric, so what you see is one direction of a two-way trip, and MPLS tunnels can hide several physical hops behind what looks like a single link. Use traceroute to find where a path changes provider or geography, not to measure performance.

Expiry is the obvious thing and the least interesting one. The failure that costs people real time is an incomplete chain: the server sends its leaf certificate but omits the intermediate. Browsers paper over this by fetching the missing certificate through the AIA extension, so the site looks fine to you while curl, Java clients, older Android devices and payment webhooks all reject it. A chain check catches it before your partners do.

Also confirm the hostname appears in the SAN list rather than only the deprecated common name, that TLS 1.2 and 1.3 are offered while 1.0 and 1.1 are not, and that the certificate covers every hostname you actually serve. Combined with a header check — HSTS, the redirect chain, cache directives, whether the server leaks its exact version — you get a fairly complete picture of how a host presents itself.

SPF lists the hosts allowed to send for your domain, and it has a hard limit of ten DNS lookups during evaluation. Chaining several vendor include statements blows past that limit and produces a permanent error, which many receivers treat as a failure. Count your lookups whenever you add a service.

DKIM signs the message with a private key while publishing the public key at a selector under the domain, so a receiver can prove nothing was altered in transit. DMARC ties the two together, adds alignment requirements between the visible From domain and the authenticated one, and tells receivers what to do when checks fail. Start at p=none with a reporting address, read the aggregate reports for a few weeks until you have found every legitimate sender, then move to quarantine and finally reject.