Checklist · Email and domains

TLS certificates and DNS hygiene

Keeps certificates from expiring in production and keeps old DNS records from becoming a takeover route.

Owner: Infrastructure engineerTime: 1 hour, each quarter

0 of 19

Certificates

Every public certificate is in one inventory with an owner, an expiry date and where it is installed.
Renewal is automated (ACME or the platform's managed certificates); a manual renewal has a ticket created 30 days ahead.
Expiry monitoring alerts at 30, 14 and 7 days, to a team and not to one person.
Only TLS 1.2 and 1.3 are enabled, with modern cipher suites; an external scanner confirms it.
Private keys are generated on the server that uses them, are not emailed or committed, and are not reused across environments.
Wildcard certificates are limited, and their keys are held only by hosts that need them.
HSTS is on for domains that are fully on HTTPS.

Every record in the zone is matched against a live service; records for decommissioned services are deleted.
CNAMEs pointing to third-party services (cloud storage, SaaS, CDNs) still resolve to a resource you own, to prevent subdomain takeover.
CAA records restrict which authorities may issue certificates for the domain.
Zone transfers are limited to named secondary servers.
DNSSEC is enabled where the registrar and provider support it.

The registrar and DNS provider accounts use MFA, named users and a monitored contact address.
Registrar lock is on for every domain, and auto-renew has a working payment method.
Domain expiry dates are tracked next to certificate dates.
Changes to DNS go through review, and the provider's audit log is checked.

Certificate Transparency monitoring alerts when a certificate is issued for your names by someone unexpected.
A scheduled scan checks for exposed development, staging and admin hostnames.
Retired certificates are revoked or removed, and keys destroyed.

Adjust it to your environment before relying on it. A finished list shows a routine was followed; it does not guarantee nothing was missed.

14-day free trial. No credit card. Cloud or on-premises.