Master the web's
infrastructure.
How DNS, email, SSL, and web infrastructure actually work — explained clearly.
✦ AI-powered — understands natural language
Closed and Filtered Aren't the Same Finding
Average Ping Is the Least Useful Number in the Output
Two hosts averaging 40 ms can behave completely differently. The spread, the loss percentage and the behaviour under load matter far more than the mean.
Your MX Records Look Fine and Mail Still Bounces
An MX record points at a hostname — and if that hostname is a CNAME or doesn't resolve, mail fails while the MX lookup looks perfectly healthy. The full delivery chain.
Your NS Records Exist Twice — and They Might Disagree
NS records live in two places — the parent zone and your own. When they disagree, or when glue goes stale, the domain resolves for some people and not others.
The Vary Header: Why Your Cache Serves the Wrong Content
The Vary header decides what counts as the same request to a cache. Missing it serves wrong content; overusing it destroys your hit rate. Here's how to get it right.
Why You Can't CNAME Your Root Domain (and What to Do)
A CNAME excludes every other record at the same name, which makes it impossible at a zone apex. Here's why, what breaks when you force it, and how ALIAS records work.
Your Subdomains Aren't Protected: The DMARC sp= Tag
A domain at p=reject can still leave every subdomain wide open. The sp= tag decides, and an sp=none set during rollout is one of the most common lingering gaps.
Multiple DKIM Signatures: Which One Actually Counts?
A message can carry several DKIM signatures, and the one that validates isn't always the one DMARC needs. Here's how alignment decides which signature actually counts.
URI Blacklists: How One Link Gets Your Whole Email Blocked
Your sending IP can be spotless and your mail still gets filtered — because a domain in the message body is listed on SURBL or URIBL. Here's how link-based blocking works.
What BIMI Actually Costs: Trademarks, VMCs, and the Real ROI
BIMI's logo is free to configure but expensive to certify. Here's the full cost stack — trademark registration, VMC issuance, renewals — and who it's actually worth it for.
Your Lighthouse Score Is 95 and Your Users Still Complain the Site Is Slow — Lab Data, Field Data, and Why They Diverge
A Lighthouse score of 95 and a poor real-user experience aren't contradictory — Lighthouse simulates a clean browser state on standardised throttled conditions, while CrUX captures real users with extensions, background tabs, budget Android devices, and variable networks. Here's why INP (which replaced FID in March 2024) is now the most-failed Core Web Vital on JavaScript-heavy apps, how CDN geographic coverage creates lab vs field score divergence, and why the LCP image needs fetchpriority="high" to download as early as possible.
Reading Traceroute Like a Network Engineer — Internet Exchange Points, BGP Hot Potato, and Why CDNs Make 150ms Feel Like 15ms
Internet Exchange Points handle fractions of all internet traffic invisibly — a CDN connected at a Warsaw IXP can serve cached content with 5-15ms latency instead of 150-200ms to a San Francisco origin. Here's how to read IXP router hostnames in traceroute output (de-cix, linx, ams-ix), why BGP hot potato routing sometimes sends New York traffic through a New York IXP toward London rather than an American PoP, and why ECMP means a second traceroute to the same destination may show completely different routers.
Microsoft Lost hotmail.co.uk and DHS Lost a Federal Domain — What WHOIS Reveals About Domain Expiry Risk and How Squatters Catch Dropped Domains
Microsoft lost hotmail.co.uk in 2003, the UK Parliament's mobile site was squatted in 2011, and the US Department of Homeland Security briefly lost a domain in 2023 — not from hacking, but from failed renewal monitoring. Here's the EPP domain status code sequence from expiry to pendingDelete, how drop-catching services time registrations to the second, what WHOIS still reveals after GDPR contact redaction (expiry dates, nameservers, DNSSEC status), and why registrar reminder emails go to departed employees' inboxes.
