Versão em português

DNS and SSL Checklist Before Pointing a Domain

Updated July 3, 2026 · XploreNetHub editorial guide

Before calling a domain production-ready, validate DNS records (A, AAAA, CNAME, MX, NS), check WHOIS and expiry, test the TLS certificate on the real hostname, and optionally review security headers. Recommended order: DNS lookup → WHOIS → SSL checker → optional headers.

Whenever I configure a new domain — personal project, staging, or DNS migration — I run this checklist before go-live. Wrong CNAME targets, high TTL, and certificates issued for the wrong hostname are common and avoidable mistakes.

Checklist steps

1. DNS lookup (A, AAAA, CNAME, MX, NS)

Confirm records point to the expected destination:

• A / AAAA: correct server, CDN, or load balancer IP
• CNAME: right origin (e.g. www → apex or CDN)
• MX: present if the domain receives email
• NS: nameservers match your registrar settings
• TTL: note the value — TTL 86400 can delay fixes for up to 24 h

Example: DNS lookup for cloudflare.com

2. WHOIS (owner and expiry)

Useful for new or transferred domains:

• Domain active with no imminent expiry
• Registrar and dates match expectations
• For country TLDs, status looks correct at the registry

Example: WHOIS for github.com

3. SSL / TLS certificate

After DNS stabilizes, verify:

• Certificate valid and within validity period
• CN/SAN covers the hostname users access (www vs apex)
• Full certificate chain (intermediates present)

Example: SSL checker for vercel.app

4. Security headers (optional, recommended for production)

For public APIs and sites, review Strict-Transport-Security, X-Content-Type-Options, and Content-Security-Policy. Not blocking for an MVP, but catches forgotten config early.

Tool: Security Headers Validator

Quick verification table

Check	What to verify	Tool
A / AAAA records	IP matches expected server or CDN	DNS Lookup
CNAME / www	Subdomains point to the right target	DNS Lookup
MX and email	MX exists; SPF/DKIM if sending mail	DNS Lookup
Nameservers	NS match registrar or DNS host panel	DNS Lookup
Owner / expiry	Domain active, no near-term expiration	WHOIS
TLS certificate	Valid, correct hostname, full chain	SSL Checker
Security headers	HSTS, CSP, and basic headers present	Security Headers

Recommended order

1. DNS lookup
2. WHOIS (new or transferred domain)
3. SSL checker
4. Security headers (production)

Frequently asked questions

How long does DNS propagation take?

Depends on old TTL and resolver caches. TTL 300 usually means minutes; TTL 86400 can mean up to 24 hours.

What TTL before a migration?

Lower to 300–600 seconds 24–48 h before the change. Raise again after propagation is confirmed.

Do I need MX without email?

Not for HTTP/HTTPS-only sites. Configure MX, SPF, and DKIM if you send or receive mail.

Does SSL cover www and apex?

Only if both are in the CN or SAN. Run the SSL checker on the exact hostname users type.

CNAME or A record?

CNAME for hostname targets (CDN, SaaS). A/AAAA for fixed IPs. Apex (@) often needs A or ALIAS/ANAME.

How do I know DNS propagated?

Compare lookups across resolvers. Consistent A, NS, and CNAME values mean you're good.

External references

• Cloudflare DNS documentation
• Let's Encrypt — how it works

More guides: How to Read WHOIS · DNS Glossary · Security Headers Checklist