Replacing an SPF record can unintentionally remove legitimate services or create multiple SPF records. Checks to make Inventory all approved senders, inspect the single authoritative SPF record and lookup count, and confirm include requirements with providers. Test controlled messages from each sender and monitor authentication results before retiring...
Mail may leave the server without a valid DKIM signature because signing is disabled, selector records are missing, or a relay changes the message. Checks to make Inspect message headers and signing logs, confirm the sending service uses the intended selector, and verify the public DNS key at the authoritative zone. Check whether forwarding or relaying...
A new subdomain can inherit unexpected wildcard behavior or collide with an existing application, certificate, or email service. Checks to make Check current authoritative records and wildcard entries, identify the target host and TLS coverage, and confirm ownership and security controls. Test the exact hostname before publishing links and monitor the...
A zone may contain application, API, email, verification, and legacy records that different teams depend on. Checks to make Export the current zone, identify record owners and purposes, map each hostname to its target, and test changes in a controlled sequence. Keep unrelated mail and verification records intact and validate each hostname after...
A proxy move can affect origin exposure, DNS-only services, certificate validation, and email records. Checks to make Inventory all zone records and current proxy status, identify which hosts should remain direct, and confirm origin certificates and firewall rules. Validate web routes and mail authentication separately after the change. When to get...
A new mail provider can require records that interact with existing MX, SPF, DKIM, DMARC, and autodiscovery settings. Checks to make Confirm the new service’s documented requirements and current authoritative zone, inventory other senders, and plan record precedence. Test inbound and outbound mail with controlled accounts, then monitor authentication...
An old account may still serve subdomains, mail, verification files, or scheduled integrations after the main website moves. Checks to make Inventory authoritative records, traffic and mail logs, certificates, and application dependencies. Confirm each hostname has a target, lower TTL before planned changes, and keep the old service until monitoring...
An old mailbox may still receive aliases or forward messages used by staff, customers, or automated systems. Checks to make Inventory aliases, forwarding rules, and recent delivery; confirm owners and intended recipients; and migrate approved flows before deactivation. Preserve required records and validate delivery after removing the mailbox from...