Blog
Practical, vendor-neutral guides on domains, DNS, email authentication and hosting.
Afnic Approved as ICANN Registry Service Provider for New gTLDs
On 18 February 2026 Afnic, the .fr registry, announced its ICANN Registry Service Provider designation, needed to run TLDs from the 2026 round.
News2 min readDENIC: .de DNSSEC Signatures Failed Validation on 5 May 2026
A key rollover in DENIC's new signing system produced signatures validating resolvers rejected; .de names were unreachable for them for about 3 hours.
News2 min readICANN's 2026 New gTLD Round Closed With Over 1,600 Applications
The new gTLD application window closed on 12 August 2026 with more than 1,600 primary applications. What happens next and what it means for you.
News2 min readICANN Proposes Moving the Root KSK From RSA to ECDSA
ICANN took public comment from 3 February to 6 April 2026 on moving the DNS root's key signing key from RSA/SHA-256 to ECDSA: new key in 2027, RSA retired in 2029.
News2 min readRoot Zone KSK Rollover Completes on 11 October 2026
From 11 October 2026 the DNS root zone is signed only with KSK-2024 (key tag 38696). Validating resolvers without the new trust anchor will stop resolving. What to check.
News2 min read.com Wholesale Fee Rises to $10.97 on 1 November 2026
Verisign announced on 23 April 2026 that the registry-level wholesale fee for new and renewal .com registrations rises from $10.26 to $10.97 on 1 November 2026.
Guides7 min readBIMI Record Explained: Logo in Gmail, Requirements, Limits
What a BIMI record is, what it takes to show your logo next to email: DMARC enforcement, an SVG Tiny PS logo, a VMC or CMC certificate, and the limits.
Guides7 min readDNS over HTTPS vs DNSSEC: What Each One Actually Protects
DoH and DoT encrypt the hop between you and your resolver. DNSSEC proves the data is genuine. What each protects, what neither hides, and how to test both.
Guides7 min readWHOIS Privacy and REDACTED FOR PRIVACY: What They Mean
Why WHOIS shows REDACTED FOR PRIVACY, how redaction differs from privacy and proxy services, what stays visible, and how to contact or identify a hidden owner.
Guides7 min readWhy Email Forwarding Breaks SPF (and What SRS and ARC Do)
Forwarded mail fails SPF because the forwarder's IP is not in the sender's record. How SRS, DKIM and ARC change the result, and what DMARC makes of it.
News3 min readGmail and Yahoo Sender Rules Since February 2024: A Checklist
Since February 2024 Gmail and Yahoo require SPF, DKIM and DMARC from bulk senders, plus one-click unsubscribe and a spam rate under 0.3%. What to check.
Guides7 min readShould I Add an AAAA Record? IPv6 DNS Without Breaking Things
Add an AAAA record only if the service works over IPv6 end to end. Happy Eyeballs, a pre-flight checklist, broken-IPv6 symptoms, and mail and PTR on IPv6.
Guides7 min readMTA-STS Explained: What It Is, TLS-RPT and Do You Need It
MTA-STS makes senders require TLS with a valid certificate when delivering mail to your domain. Record, policy file, TLS-RPT reports and a safe rollout order.
News2 min readRDAP Replaced WHOIS for gTLDs on 28 January 2025
Since 28 January 2025 RDAP is the definitive source of gTLD registration data and WHOIS is no longer required. What changed and what to check in your tooling.
Guides7 min readRegistrar Lock vs Registry Lock: What Each One Protects
Registrar lock (clientTransferProhibited) vs registry lock (server* codes): who sets them, which attacks each stops, trade-offs, and an account checklist.
Guides7 min readSPF Too Many DNS Lookups: Fixing the 10-Lookup PermError
Why SPF returns permerror after 10 DNS lookups, which mechanisms count, how to count your own record by hand, and the fixes that last longer than flattening.
Guides7 min readSubdomain Takeover: How It Happens and How to Prevent It
A subdomain takeover starts with a DNS record that points at a resource you deleted. How dangling CNAME, NS, A and MX records are abused, found and prevented.
Guides7 min readSubdomain vs Subdirectory: What Actually Differs (SEO Included)
Subdomain or subdirectory for a blog, shop or docs? The real differences: DNS, certificates, cookies, same-origin rules, robots.txt, Search Console, migration.
News3 min readTLS Certificate Lifetimes Drop to 47 Days by 2029: The Schedule
The CA/Browser Forum voted on 11 April 2025 to cut TLS certificate validity to 200, 100 and then 47 days. The dates, and what site owners should do.
Guides7 min readWildcard DNS Records: How *.example.com Really Works
What a wildcard DNS record matches and what it does not (existing names, empty non-terminals, delegations), pitfalls with MX and TXT, and how to test it.
Guides7 min readWWW vs Non-WWW: Which Is Better and How to Make Both Work
Neither www nor the bare domain ranks better. What differs: CNAME at the apex, cookie scope, HSTS and certificates, plus why a site fails without www.
Guides6 min readCAA Records Explained: Control Who Can Issue Your Certificates
What a CAA record is, how CAs evaluate it (tree climbing, CNAMEs, issue vs issuewild), ready-to-use examples, and how to add one without breaking renewals.
Guides7 min readFinding the Origin IP Behind a CDN: Limits and Ethics
Why an IP lookup shows CDN edge addresses, why the origin IP behind a CDN usually cannot and should not be found, and how owners protect their own origin.
Guides6 min readDNS Record Types Explained: A, AAAA, CNAME, MX, TXT and More
What each DNS record type does, how it looks in a zone, the rules that trip people up (CNAME at apex, MX targets, TXT length) and how to query each with dig.
Guides7 min readWhat Is DNSSEC? How It Works and How to Enable It Safely
What DNSSEC is, how signatures, DNSKEY and DS records form a chain of trust, what it does not protect, how to enable it, and how to avoid an outage.
Guides7 min readWhat Happens When a Domain Expires? The Full Timeline
What happens after a domain expires: auto-renew grace, DNS being switched off, the redemption period, pending delete, and how to recover the name in time.
Guides6 min readclientTransferProhibited and Other Domain Status Codes
What clientTransferProhibited, clientHold, serverHold, redemptionPeriod and the other EPP status codes mean, who sets them, and what to do about each one.
Guides7 min readEmails Going to Spam? A DNS Checklist to Work Through
A practical DNS checklist for emails going to spam: read the headers, then verify SPF, DKIM, DMARC alignment, reverse DNS, MX and TLS with dig commands.
Guides6 min readHow to Transfer a Domain Name to Another Registrar
Step-by-step domain transfer: eligibility, unlocking, the auth code, the five-day window, what happens to DNS and email, and the mistakes that cause downtime.
Guides6 min readWhat Is Reverse DNS? PTR Records Explained
What reverse DNS and PTR records are, how in-addr.arpa works, who can set a PTR, why mail servers need matching forward and reverse DNS, and how to check.
Guides6 min readSSL Certificate Expired: What to Do and How to Prevent It
Your SSL certificate expired? How to confirm it with openssl, renew and install it correctly, fix the chain, reload the server, and automate renewals for good.
Guides7 min read.tr Domain Registration Rules: com.tr and TRABİS Explained
How .tr domain registration works since TRABİS: who runs the registry, which extensions need documents, how to register a .com.tr, transfers and disputes.
Guides6 min readWhat Is TTL in DNS? Values, Caching and When to Lower It
What TTL means in DNS, how resolvers count it down, sensible values for each record type, negative caching, and how to plan a change so nobody sees stale data.
Guides5 min readHow to Change Nameservers Without Downtime
A step-by-step plan for moving a domain to new nameservers: TTLs, copying the zone, DNSSEC, verifying from several resolvers, and rolling back safely.
Guides6 min readHow to Find Where a Website Is Hosted (and When You Can't)
Trace a website from domain to IP address to network owner, read reverse DNS, understand why CDNs hide the origin server, and know the limits of the method.
Guides7 min readMX, SPF, DKIM and DMARC Explained: How They Fit Together
How MX, SPF, DKIM and DMARC work together, the mistakes that break them, and a safe way to roll out DMARC without losing legitimate email.
Guides7 min readWHOIS vs RDAP: What Domain Registration Data Shows Today
What a WHOIS lookup still shows, why registrant details are redacted, how RDAP replaces WHOIS, and how to read domain status codes and expiry dates.