Master the web's
infrastructure.
How DNS, email, SSL, and web infrastructure actually work — explained clearly.
✦ AI-powered — understands natural language
Why You Can't CNAME Your Root Domain (and What to Do)
Your Subdomains Aren't Protected: The DMARC sp= Tag
A domain at p=reject can still leave every subdomain wide open. The sp= tag decides, and an sp=none set during rollout is one of the most common lingering gaps.
Multiple DKIM Signatures: Which One Actually Counts?
A message can carry several DKIM signatures, and the one that validates isn't always the one DMARC needs. Here's how alignment decides which signature actually counts.
URI Blacklists: How One Link Gets Your Whole Email Blocked
Your sending IP can be spotless and your mail still gets filtered — because a domain in the message body is listed on SURBL or URIBL. Here's how link-based blocking works.
What BIMI Actually Costs: Trademarks, VMCs, and the Real ROI
BIMI's logo is free to configure but expensive to certify. Here's the full cost stack — trademark registration, VMC issuance, renewals — and who it's actually worth it for.
Your Lighthouse Score Is 95 and Your Users Still Complain the Site Is Slow — Lab Data, Field Data, and Why They Diverge
A Lighthouse score of 95 and a poor real-user experience aren't contradictory — Lighthouse simulates a clean browser state on standardised throttled conditions, while CrUX captures real users with extensions, background tabs, budget Android devices, and variable networks. Here's why INP (which replaced FID in March 2024) is now the most-failed Core Web Vital on JavaScript-heavy apps, how CDN geographic coverage creates lab vs field score divergence, and why the LCP image needs fetchpriority="high" to download as early as possible.
Reading Traceroute Like a Network Engineer — Internet Exchange Points, BGP Hot Potato, and Why CDNs Make 150ms Feel Like 15ms
Internet Exchange Points handle fractions of all internet traffic invisibly — a CDN connected at a Warsaw IXP can serve cached content with 5-15ms latency instead of 150-200ms to a San Francisco origin. Here's how to read IXP router hostnames in traceroute output (de-cix, linx, ams-ix), why BGP hot potato routing sometimes sends New York traffic through a New York IXP toward London rather than an American PoP, and why ECMP means a second traceroute to the same destination may show completely different routers.
Microsoft Lost hotmail.co.uk and DHS Lost a Federal Domain — What WHOIS Reveals About Domain Expiry Risk and How Squatters Catch Dropped Domains
Microsoft lost hotmail.co.uk in 2003, the UK Parliament's mobile site was squatted in 2011, and the US Department of Homeland Security briefly lost a domain in 2023 — not from hacking, but from failed renewal monitoring. Here's the EPP domain status code sequence from expiry to pendingDelete, how drop-catching services time registrations to the second, what WHOIS still reveals after GDPR contact redaction (expiry dates, nameservers, DNSSEC status), and why registrar reminder emails go to departed employees' inboxes.
IPv4 Ran Out in 2011 — How Carrier-Grade NAT Has Kept the Internet Running Since, and What IPv6 Changes
IPv4 exhaustion at the IANA level happened in February 2011 — since then, Carrier-Grade NAT (ISPs placing thousands of customers behind a single public IP) has kept the internet running while breaking peer-to-peer connectivity, port forwarding, and IP-based geolocation accuracy. Here's the full exhaustion timeline by regional registry, why IPv6's /64 minimum subnet size is set by SLAAC autoconfiguration, and how NAT64/DNS64 enables completely IPv6-only networks while still reaching IPv4 servers.
Every TLS Certificate Is Now a Public Record — What Certificate Transparency Logs Reveal and Why That Changed Security
Certificate Transparency logs record every TLS certificate ever issued and became mandatory for Chrome in 2018 — meaning fraudulent certificate issuance is now a publicly auditable event rather than an undetectable attack. Here's how Merkle tree audit proofs make CT logs tamper-evident, what domain owners find when searching their own CT history (unexpected subdomains, unauthorised CAs), and how real-time CT monitoring via Certstream gives organisations a window to act on phishing infrastructure before it launches.
Why DMARC Fails Even When SPF and DKIM Both Pass — Alignment Rules and Multi-Platform Sending Configuration
DMARC requires alignment, not just SPF and DKIM passing individually — SendGrid's default DKIM signature (d=sendgrid.net) fails alignment with your From header even though the signature itself validates correctly. Here's the precise difference between relaxed and strict alignment, how custom DKIM signing via CNAME delegation fixes multi-platform sending, the sp= subdomain policy tag for staged rollout, and why third-party SPF/DKIM authorisation creates a trust relationship worth periodically auditing.
Why Reverse DNS Alone Never Confirms or Denies a Threat — Residential Proxies, Reliability Decay, and SOC Triage
No serious threat intelligence platform relies on reverse DNS alone — residential proxy networks now produce PTR records indistinguishable from genuine residential ISP connections, defeating the simple "datacenter IP = higher risk" heuristic. Here's how reverse DNS combines with other signals in IP reputation scoring, why reverse DNS data decays in forensic reliability over weeks and months, and why FCrDNS doesn't protect against attackers who legitimately own a deceptively-named domain.
Why 1.1.1.1 Reaches Different Servers Worldwide — Anycast, DNS Propagation, and the 13 Root Nameservers That Are Really 1,500
Anycast routing means Cloudflare's 1.1.1.1 reaches different physical servers in different locations — which is why DNS changes propagate to some locations before others, and why checking propagation from multiple places gives different results. Here's how anycast works, why the "13 root nameservers" are actually 1,500+ nodes, the TTL change timing strategy for planned migrations, and why single-provider DNS isn't genuine redundancy.
