Diagnosing SSL, DNS, and Email Issues by Layer

SSL, DNS, and email failures often appear together after a domain migration, but they are separate systems. A layered checklist avoids changing unrelated records while trying to fix one symptom.

For DNS, verify authoritative nameservers and query the relevant A, AAAA, CNAME, MX, and TXT records. For SSL, inspect the certificate actually served by the public endpoint, including hostname coverage and expiry. A certificate installed on one server does not prove that a proxy or load balancer is serving it.

For email, verify MX routing, SPF, DKIM, and DMARC, then inspect message headers and mail-server logs. A website's HTTPS certificate does not authenticate outbound email. Likewise, a successful DNS lookup does not prove that the mail service is accepting or delivering messages.

Record the exact hostname, timestamp, resolver, and test used. Check from both the server and an external network where possible. Once a change is made, verify the affected layer directly and allow for DNS caching where relevant. Avoid repeatedly changing nameservers or mail records without evidence.