Operations / 06
The packet is one observation.
The application is another.
After a change to your own DNS or resolver, check the workflows people actually use.
Reviewed October 15, 2026
Keep an observation sheet
For a resolver policy, DNSSEC or hosting change, record the time, affected name, change reference and resolver used. Save the DNS result before moving to an application check. If the application succeeds through a cached path, it does not prove the new delegation or transport path is working everywhere.
| Observation | Save | Keep the conclusion narrow |
|---|---|---|
| DNS query | Question, resolver, flags, transport and size | What this query returned on this path |
| Website | URL, timestamp, redirect destination and visible outcome | What this browser session could reach |
| Test email | Sender, non-sensitive test label, send and receipt times | Whether this test message arrived |
A separate website observation
Open the affected public site in another browser environment and compare its visible result with your usual browser. A disagreement may help narrow cache, network or browser-specific behavior. It is not enough by itself to identify a DNSSEC fault; retain the original query evidence.
WebTraceCheck is an optional independent browser environment for this check. It does not use the same network path as your machine and is not an ML-DSA validator. Record that difference rather than presenting a successful page load as proof that a particular DNS signature was validated.
A non-sensitive email observation
If the affected application sends registration or test mail, send one harmless test message from your own system to a temporary recipient. Use a unique test label and compare the sender’s log with observed receipt. Keep real user information and account-recovery links out of the test.
CleanTempMail supplies a temporary receiving inbox for that limited check. Arrival demonstrates one delivery observation. It does not prove that your domain can receive mail, that every recipient provider accepts it, that SPF/DKIM/DMARC are correct, or that the transport was post-quantum protected. For inbound changes on your own domain, also test a mailbox you control on that domain.
Close the loop
When an application fails, save the exact symptom and compare it with the DNS result at the same time. Avoid changing several unrelated settings at once: you lose the ability to tell which change mattered. Neither referral receives packet input from WireBudget. The outgoing links carry only site and placement tags, and both services are operated alongside this project.