REFERENCE

Names, certificates, and small checks.

DNS changes and caches

A DNS record has a time to live, or TTL. Recursive resolvers can reuse a cached answer until that lifetime expires, so a recent change may not appear everywhere at once. A missing record can also be cached. Comparing the authoritative answer with a recursive resolver helps distinguish an unpublished change from an older cached answer.

Certificate reminders

A certificate must match the requested hostname, chain to a trusted authority, and be within its validity period. A correct device clock matters for that last check. Record the expiry date and check that an automatic renewal actually updates the certificate served by the web server; a renewed file alone does not prove that every running process has loaded it.

Reading an HTTP health check

An HTTP 200 response shows that a particular request succeeded. It does not, by itself, test a database, background job, or every other part of a website. A useful check has a narrow purpose and states what it measures.

Before a maintenance window

• Keep a copy of the working configuration.
• Validate syntax before reloading a process.
• Check the response after the change, including TLS when relevant.
• Keep a practical way to restore the previous state.