Internet Tools

A DKIM key generated five years ago might still be using RSA-1024 — a length that was acceptable then but has since been "softly" deprecated by major providers, even though signatures using it still technically validate. Here's how to identify your key's algorithm and length from its DNS record, why Ed25519 is the emerging alternative (and why dual-key signing addresses its adoption gap), and why this migration follows the same process as any DKIM key rotation.

Adding third-party email services pushes SPF past the 10-lookup limit, causing PermError and DMARC failures. Here's how to count SPF lookups, why the limit is hit so easily, and the three solutions: IP replacement, flattening, and consolidation.

Content-hashed filenames with max-age=31536000 can eliminate network requests for returning users. Here's the complete HTTP caching strategy: Cache-Control directives in depth, ETags and conditional requests, the Vary header pitfall, CDN cache busting, and a practical caching strategy by resource type.

A misconfigured open port on an IPv4 server gets found by automated scanners within hours, because the entire IPv4 address space is small enough to scan exhaustively. The same misconfiguration on an IPv6 server might never be found this way — not because it's more secure, but because 2^128 addresses is too large to scan at any practical rate. Here's how IPv6 hosts actually get discovered instead (DNS records, certificate transparency logs, predictable address patterns), and why "too big to scan" is security through obscurity, not security.

Switching email providers is one of the most common causes of lost email. Here's the correct migration sequence (never update MX first), how Google Workspace, Microsoft 365, and Zoho Mail configure their MX records, and how to verify after migration.

Learn what NS records are, how DNS delegation works, why NS records are the first thing to check when DNS fails, and how to use a free NS lookup tool to verify nameserver configuration.

"SPF passes" and "DKIM passes" don't mean DMARC passes — DMARC additionally requires alignment between the visible From domain and the domain that actually passed SPF or DKIM. Here's the distinction between envelope sender and visible From, relaxed vs strict alignment, and why DMARC passes if EITHER SPF or DKIM is aligned — the key to debugging most DMARC failures with third-party senders.

High speed test numbers don't guarantee fast internet. Latency, bufferbloat, WiFi overhead, and ISP congestion all affect real-world performance in ways throughput tests don't capture. Here's how to read speed test results and diagnose actual slowness.

A single traceroute that "looks fine" doesn't rule out intermittent problems — and the path it shows is only the outbound direction, while routing is frequently asymmetric. Here's how MTR's continuous measurement reveals intermittent loss that single snapshots miss, why a hop showing loss often isn't "the problem" (ICMP rate-limiting), and how to localize issues to your network, the path, or the destination.

A certificate can fail after issuance without any change on your part — revocation invalidates correctly-issued certificates when private keys are compromised, CT log disqualification can affect certificates whose SCTs came from that log, and intermediate CA incidents can distrust entire chains. Here's how certificate revocation works (CRL vs OCSP vs OCSP Stapling), the soft-fail problem that makes revocation unreliable, and the five-component monitoring stack for active certificate health.