Practical writing for engineers who debug production. No "in today's digital landscape", no listicles — just the technical detail you needed at 2am.
HSTS is a one-line response header that locks browsers into HTTPS for your domain. The preload list takes that commitment further — and the only way out is a year-long opt-out process.
OCSP lets clients check whether a cert has been revoked. Stapling moves that check from the client to the server. Why this matters, how it works, and what breaks when it fails.
A catalogue of the SSL errors browsers actually show users, the most likely cause for each, and the openssl one-liner that confirms or rejects each hypothesis.
A leaf, one or more intermediates, and a root in your trust store. Where the chain comes from, how the validator walks it, and the three common ways it breaks.
TLS 1.3 is shorter, faster, safer and incompatible with a lot of things. A pragmatic cheat sheet for engineers deciding what to support, what to drop, and what to log.
The MX preference field is one number that everyone gets wrong at least once. Lower wins, ties round-robin, and there is no "fallback after timeout" guarantee.
A wrong or missing CAA record will silently break certificate issuance, even though browsers never look at it. Here is what CAA does, and how to debug a failed Let's Encrypt challenge.
Three TXT records do all the work of preventing mail spoofing. Here is what each one asserts, how receivers combine them, and the policy you actually want.
dig +trace is the closest thing DNS has to a debugger. Here is how to read every section of its output, with a worked example against a popular domain.
The A record is the simplest DNS record, but the moment you start mixing in CNAMEs, AAAAs and the vendor-specific ANAME/ALIAS, things get subtle. Here is the difference.