Guides
Domain security guides
Plain answers to the problems that quietly break domains, certificates and email.
Certificates
- 100-day SSL certificates from March 2027: what to do before then From 15 March 2027 public SSL certificates last at most 100 days, so manual renewals happen five or six times a year. What changes and a checklist. Read the guide →
- 47-day SSL certificates: the timeline and what to do now TLS certificate lifetimes drop to 200 days in 2026, 100 in 2027 and 47 in 2029. What changes, what breaks, and how to prepare. Read the guide →
- An SSL certificate was issued for my domain that I didn't request Found a certificate for your domain in CT logs that nobody asked for? How to tell a CDN or SaaS certificate from a real problem, and how to get it revoked. Read the guide →
- CAA records: choose which CAs can issue certificates for your domain A CAA DNS record lists the certificate authorities allowed to issue for your domain. Syntax, values for each CA, Cloudflare's hidden records, how to check. Read the guide →
- Certificate and domain renewal email templates for clients Copy-ready emails for MSPs and IT teams: an upcoming certificate renewal, a renewal with downtime, a domain about to expire, and the all-done note. Read the guide →
- Certificate renewed but not installed: why it still expires and how to fix it The CA issued a new certificate, but your server still serves the old one, so it expires on schedule. How to spot the gap and close it for good. Read the guide →
- Free Let's Encrypt certificates on Windows and IIS with win-acme Get a free Let's Encrypt certificate for an IIS site with win-acme, let it renew and rebind itself, and check the scheduled task that keeps it working. Read the guide →
- Get a free SSL certificate from Let's Encrypt with Certbot Install a free Let's Encrypt certificate on nginx or Apache with Certbot, make sure it renews on its own, and prepare for shorter certificates from 2027. Read the guide →
- Let's Encrypt stopped sending expiry emails: how to get warned now Let's Encrypt ended its expiration emails on 4 June 2025. Free ways to get warned before a certificate expires, and how to check renewals yourself. Read the guide →
- NET::ERR_CERT_DATE_INVALID on your own site: how to fix it Visitors see NET::ERR_CERT_DATE_INVALID on your site. How to tell an expired or uninstalled certificate from a visitor's wrong clock, and fix it. Read the guide →
- Public SSL certificates no longer include client authentication Public TLS certificates are losing the client authentication EKU, breaking mutual TLS that reuses a server certificate. Dates per CA, what breaks, fixes. Read the guide →
- Renew the Exchange Server certificate in a hybrid setup without breaking mail flow Import the renewed certificate on every Exchange server, enable it for IIS and SMTP, update the hybrid connectors, then remove the old one. Read the guide →
- Replace an expiring SSL certificate on a FortiGate (VPN and admin GUI) Import a renewed certificate on FortiOS 7.4 and 7.6, assign it to the VPN portal and admin GUI, fix the chain, or let the FortiGate renew it via ACME. Read the guide →
- Replace an expiring SSL certificate on a SonicWall (SSL VPN and management) Import a renewed certificate on SonicOS 7, select it for SSL VPN and HTTPS management, import the chain, and use the new ACME support in SonicOS 7.3.4. Read the guide →
- Replace an expiring certificate on IIS and Remote Desktop Services Import a renewed certificate on Windows Server, update IIS bindings, RD Gateway, RD Web and the RDS deployment roles, and check what's actually served. Read the guide →
- Replace an expiring certificate on Sophos Firewall (VPN, portals and WAF) Upload a renewed certificate on Sophos Firewall (SFOS 21/22), assign it to the admin console, VPN portal, SSL VPN and WAF, or use built-in Let's Encrypt. Read the guide →
- SSL certificate monitoring for MSPs: every client, every host How MSPs find every certificate across their clients, catch renewals that never got installed, and handle appliances before 100-day and 47-day lifetimes. Read the guide →
- Wildcard SSL certificates: what they cover, and when not to use one *.example.com covers one level of subdomains, not example.com or deeper names. What it covers, how to get one free, and the risk of one shared key. Read the guide →
Email and DMARC
- 550 5.7.236: Microsoft 365's onmicrosoft.com sending limit, and the fix Microsoft 365 now limits mail sent from onmicrosoft.com addresses to 100 external recipients a day. What the 550 5.7.236 bounce means and how to fix it. Read the guide →
- 550 5.7.509 "does not pass DMARC verification": how to fix it Outlook.com bounced your email with 550 5.7.509 because it failed DMARC and your domain's policy is reject. Why legitimate mail fails, and the fix. Read the guide →
- BIMI: VMC vs CMC, and which mailboxes show your logo BIMI shows your logo next to your emails. What VMC and CMC certificates require, which of Gmail, Apple Mail and Yahoo accept each, and what they cost. Read the guide →
- DMARC for cyber insurance: what insurers ask and how to answer Cyber insurance applications ask about SPF, DKIM and DMARC. What the forms ask, what insurers can see from outside, and how to answer yes honestly. Read the guide →
- DMARC p=none to p=reject: a safe step-by-step path p=none only watches; it doesn't stop anyone sending as your domain. How to move to quarantine and reject without blocking your own email. Read the guide →
- DMARC permerror: what it means and how to fix it A DMARC or SPF permerror means receivers couldn't evaluate your records. The usual causes: a broken DMARC record, two records, or SPF over 10 lookups. Read the guide →
- Gmail 421 4.7.x "rate limited": what each code means and how to fix it Gmail is deferring your email with 421 4.7.26, 4.7.27, 4.7.28, 4.7.30, 4.7.32 or 4.7.40. What each code means and which record to fix. Read the guide →
- Gmail 550 5.7.26 "sender is unauthenticated": how to fix it Gmail bounced your email with 550 5.7.26. What each version of the message means, how to find the failing check in the headers, and how to fix it. Read the guide →
- MTA-STS and TLS-RPT: what they do and how to set them up MTA-STS makes other mail servers use encrypted, verified connections to yours; TLS-RPT reports when that fails. Records, policy file and rollout. Read the guide →
- Microsoft 365 DKIM won't enable: "No DKIM keys saved" and CnameMissing DKIM for a custom domain won't turn on in Microsoft 365? What "No DKIM keys saved for this domain" and CnameMissing mean, and the fix step by step. Read the guide →
- Outlook 550 5.7.515 "access denied": fix SPF, DKIM and DMARC Outlook.com and Hotmail reject mail with 550 5.7.515 when a high-volume domain fails SPF, DKIM or DMARC. What Microsoft requires and how to pass. Read the guide →
- SPF "too many DNS lookups": why it happens and how to fix it SPF allows 10 DNS lookups. Go over and SPF fails with PermError, so your email can land in spam. How to count lookups and get back under. Read the guide →
- SPF ~all vs -all: softfail or hard fail, and which to use SPF ends with ~all (softfail) or -all (fail). What each tells receivers, why Google and Microsoft recommend different ones, and how to choose. Read the guide →
- Set up DKIM for Google Workspace, Microsoft 365 and other senders DKIM signs your email so receivers know it's really from you. How it works, how to set it up in Google Workspace and Microsoft 365, and how to check it. Read the guide →
Impersonation and lookalike domains
- How to check a supplier's email before paying an invoice A supplier emails new bank details. Is it really them? Spot lookalike domains and hacked mailboxes, and the one call that stops invoice fraud. Read the guide →
- How to report a lookalike domain and get it taken down Someone registered a domain that looks like yours. How to collect evidence, find the right abuse contacts, and when a UDRP complaint makes sense. Read the guide →
- Phishing warning email templates for staff and customers Someone registered a lookalike of your domain. Copy-ready emails to warn staff and customers, what to put in them, and what to leave out. Read the guide →
- Punycode and xn-- domains: how homograph lookalikes work A domain starting with xn-- is punycode for non-Latin letters, and a way to fake your domain. How homographs work, when browsers show them, how to check. Read the guide →
- Report a phishing domain registered at GoDaddy A lookalike of your domain is registered at GoDaddy. Which form to use, what to put in it, what GoDaddy will and won't tell you, and how to escalate. Read the guide →
- Report a phishing domain registered at Namecheap A lookalike of your domain is registered at Namecheap. Which address to email, what evidence Namecheap asks for, what to expect, and how to escalate. Read the guide →
- Report a phishing site behind Cloudflare A phishing site imitating you shows Cloudflare IP addresses. What Cloudflare's abuse form does, what to send, and when to go to the registrar instead. Read the guide →
- Someone is sending emails pretending to be my company: what to do Scammers spoof your exact domain or register a lookalike to send fake invoices. How to tell which, what to do in the first hour, and how to stop it. Read the guide →
- dnstwist alternatives: lookalike domain tools compared dnstwist finds lookalikes of your domain once. How it compares with URLCrazy, urlinsane, openSquat and paid monitors, and which to use when. Read the guide →
Domain registration
- DNSSEC explained: what it protects, and how not to break your domain DNSSEC signs your DNS so forged answers are caught. What it protects, how to turn it on, and the DS record mistake that takes domains offline. Read the guide →
- MSP client onboarding checklist: domains, DNS, email and certificates The domain, DNS, email and certificate checks to run when you take on a new client, in the order that finds the most problems in the first week. Read the guide →
- My domain expired: what happens and how to get it back An expired domain isn't gone yet. The grace and redemption periods, when your website and email stop, what restoring costs, and how to avoid it. Read the guide →
- My domain's nameservers were changed without permission Someone changed your domain's nameservers and your site or email is gone. What to do in the first hour, how to get the domain back, and how to lock it. Read the guide →
- Registry lock: protect your domain from hijacking A transfer lock stops casual transfers. A registry lock stops a hijacker who has your registrar password. What each does, who offers it, and who needs it. Read the guide →
- Subdomain takeover: how dangling DNS records get hijacked A DNS record pointing at a deleted cloud resource lets anyone who recreates it serve pages on your subdomain. How takeovers happen and how to fix them. Read the guide →
- Transfer a domain to another registrar without downtime Moving a domain to a new registrar can take your site and email offline if DNS or DNSSEC goes with it. The safe order of steps, the 60-day locks, timings. Read the guide →
- clientTransferProhibited and other domain status codes, explained WHOIS shows clientTransferProhibited, clientHold or redemptionPeriod? What each domain status code means, which ones are a problem, and what to do. Read the guide →
Registrar reviews
- Cloudflare Registrar review: at-cost domains, if you use Cloudflare DNS Cloudflare Registrar sells domains at cost with free privacy, DNSSEC and security keys. The catch: you must use Cloudflare's nameservers. Who it suits. Read the guide →
- Gandi review: strong security and country domains, expensive renewals Gandi supports security keys, includes DNSSEC and privacy, and covers hundreds of country domains. Since 2023 renewals cost far more. Who should use it. Read the guide →
- Namecheap review: solid, with registry lock, but watch the renewals Namecheap offers free WHOIS privacy, security keys and one of the few registry locks for small businesses. Renewals cost more than year one. Our view. Read the guide →
- Porkbun review: a registrar that's cheap and safe to leave domains at Porkbun charges the same to renew as to register, includes WHOIS privacy and email forwarding, and supports security keys. Where it shines, what's missing. Read the guide →
- The best domain registrar for security: Porkbun, Cloudflare, Namecheap, Gandi Porkbun, Cloudflare Registrar, Namecheap and Gandi compared on what protects business domains: security keys, locks, DNSSEC, privacy, honest renewals. Read the guide →
Free scan
Check your own domain
Lookalikes, certificates, email setup and registration in about 20 seconds. No signup.