Glossary

A CAA record is a DNS entry naming which certificate authorities are allowed to issue certificates for your domain.

Every publicly trusted certificate is written to a public append-only log. Reading yours shows certificates no SSL check can see.

Alignment is the DMARC requirement that the domain which passed SPF or DKIM matches the From address a human actually sees.

After a domain expires you get roughly a month to renew cheaply, then a much shorter and far more expensive window, then it is gone.

OCSP stapling lets a server prove its certificate has not been revoked without the visitor's browser contacting the certificate authority.

A status flag that stops a domain being transferred away. Its removal is often the first visible step of a domain hijack.

The SAN field lists every hostname a certificate is valid for. Browsers read it; the Common Name they have ignored for years.

An SPF record may trigger at most ten DNS lookups. Exceed it and the record is permanently invalid — usually without anyone noticing.

A wildcard covers one level of subdomain and no more — *.example.com does not cover a.b.example.com, and never covers the apex by itself.