Combine DNS and TLS inspection for a hostname

check domain ssl and dns means proving the name resolves to the right edge, then confirming the certificate presented on that path is valid, trusted, and not expired.

Ops teams often debug TLS while ignoring DNS, or flush DNS while the certificate on the load balancer is months past notAfter. A hostname can resolve correctly yet terminate TLS on a default certificate, or point at a healthy origin while a CDN serves stale material. Combining resolver checks with a live handshake closes that gap.

This walkthrough is for engineers triaging customer reports, validating cutovers, or auditing a portfolio before renewal season. You will not rely on registrar dashboards alone; you will see what the public Internet does.

You need dig (or drill) and OpenSSL on a machine that uses ordinary recursive DNS—not only your corporate split-horizon resolver. Save outputs in the ticket so the next responder can diff after changes.

Incidents that mention both DNS and SSL often start after a migration: new A records, a fresh CDN CNAME, or a registrar glue change. The TLS certificate might still live on the old IP until someone updates the listener binding. Running the combined check at the start of a bridge call prevents arguing about browser cache when delegation is still wrong.

Document which resolver you used. Cloudflare 1.1.1.1, Google 8.8.8.8, and your ISP resolver can disagree for minutes after a low-TTL change. Capturing three resolver answers alongside OpenSSL output makes post-mortems factual instead of anecdotal.

What to check

Treat three clocks as separate: DNS answers (A, AAAA, CNAME, and whether they match your runbook), TLS material (notBefore, notAfter, issuer, SANs, chain depth), and domain registration (registrar expiration via RDAP when published). SSL expiry does not extend a lapsed domain, and a renewed domain does not fix an expired listener certificate.

For check domain ssl and dns, always note whether the URL users type differs from the name on the certificate. Marketing may link to www while apex CNAMEs to a CDN; SNI must match the name you connect with. If HTTP redirects exist, follow them mentally: the final hostname may present a different cert than the first.

Also record TTL on changed records. Low TTL speeds rollback but increases the chance different resolvers see different answers during propagation—symptoms that look like “random” TLS failures often trace to split DNS caches plus one stale cert node.

When check domain ssl and dns for subdomains behind wildcard certs, the TLS name still must match what users type. A wildcard *.example.com does not cover nested names like a.b.example.com unless the SAN explicitly allows them. DNS can point pay.example.com at the same load balancer as the apex while marketing uses a different hostname on the certificate.

If your stack uses CAA records, DNS can block issuance even when an old cert still serves. That is not expiry in the usual sense, but customers still see trust failures. Optional dig CAA example.com helps explain why ACME suddenly fails while HTTPS still limps along on an aging leaf.

Step-by-step

Pick the customer-facing hostname (www.example.com, not an internal alias). Run DNS from outside your VPN when possible.

Resolve the name

dig +short A www.example.com
dig +short AAAA www.example.com
dig +short CNAME www.example.com
dig +trace www.example.com A

On Windows, Resolve-DnsName www.example.com -Type A in PowerShell answers the same question without installing bind-tools.

Map DNS to TLS endpoints

Write down the resolution path before you connect. If www is a CNAME to cdn.vendor.net, customers still negotiate TLS with SNI www.example.com. The vendor terminates with a certificate issued for your brand, not a generic name on the vendor’s edge. When that CNAME flips during a migration, TLS can break even though the IP address stayed reachable on port 443.

If the name is a CNAME to a CDN or SaaS edge, your OpenSSL check must use the original hostname with SNI, not only the CNAME target’s generic cert.

HOST=www.example.com
echo | openssl s_client -connect "${HOST}:443" -servername "${HOST}" -showcerts 2>/dev/null \
  | openssl x509 -noout -dates -subject -issuer -ext subjectAltName

For non-standard ports (mail, APIs, alternate ingress), repeat with :PORT.

Optional HTTP sanity

curl -sI --connect-timeout 10 "https://${HOST}/" | head -n 5

Verbose TLS errors belong in curl -vI; use them when OpenSSL and browser disagree.

Repeat the TLS probe from a second network path when possible. Home broadband and a cloud VM in another region catch geo-DNS and anycast quirks that a single office laptop will miss. If answers differ, paste both dig outputs in the ticket before touching certificate files.

When the hostname is behind a redirect, resolve and check TLS for each hop. Marketing might shorten a link to an apex that redirects to www, and only the final name carries the production certificate. A valid cert on hop one does not help if hop two is expired.

Cross-check registration

curl -s "https://rdap.org/domain/$(echo "${HOST#www.}" | awk -F. '{print $(NF-1)"."$NF}')" | jq '.events[] | select(.eventAction=="expiration")'

Adjust the registrable domain extraction for multi-part TLDs; when RDAP omits dates, note that gap instead of guessing from WHOIS scrapers.

How to read the output

Treat the combined output as a small incident packet. Paste DNS answers at the top, TLS dates in the middle, and registrar context at the bottom. Reviewers who were asleep during the bridge call should reconstruct what the public Internet did without opening your VPN.

DNS: +short should match the infrastructure diagram. Unexpected A records after a migration mean traffic still hits the old terminator—where an expired certificate may linger. SERVFAIL or NXDOMAIN blocks TLS entirely; do not blame the CA until resolution is stable.

TLS dates: notAfter= is authoritative for browser trust. Compare to today in UTC. notBefore= in the future causes errors that feel like expiry. Read every certificate in -showcerts, not only the leaf: an expired intermediate breaks trust even when the leaf looks fresh.

Names: subject and X509v3 Subject Alternative Name must include the hostname you typed (or a wildcard that covers it). Issuer changes after renewal imply you may need a new intermediate bundle on the server.

RDAP: expiration events describe registrar billing, not the TLS cert. Pair both in monitoring so OV revalidation is not blocked by a forgotten domain renewal.

Serial numbers deserve a line in your notes even when dates look healthy. After renewal, the serial must change on the wire. If DNS just moved to a new vendor but the serial is years old, you are still talking to the previous infrastructure footprint.

If dig +short returns multiple A records, test TLS against each address with SNI when debugging a flaky pool. One backend member with an expired default certificate produces intermittent browser errors that look like client-side noise until you align IP-level checks with DNS round-robin.

Common mistakes

Checking TLS only from the server loopback while DNS still points customers elsewhere produces false confidence. Likewise, dig against an internal resolver can hide public delegation errors that break ACME HTTP-01.

Connecting to the CDN edge IP without SNI shows a shared certificate unrelated to your site—always pass -servername. Confusing CNAME target expiry with your hostname’s cert leads to useless panic; stapled OCSP and CT logs will reference the correct CN.

Teams sometimes inspect PEM files in /etc/letsencrypt and close the ticket without reloading nginx or updating the load balancer listener. Disk contents are not what strangers see until the data plane loads them.

Skipping IPv6 when AAAA exists means half your users (or Googlebot) hit a different VIP with a forgotten cert. Always run both record types when published.

Relying on hosting panel DNS previews that do not match public delegation. Panels may show intended records while the parent zone at the registrar still points at deprecated nameservers.

Running check domain ssl and dns only during business hours on an internal resolver that caches NXDOMAIN for the whole company. Flush or test with dig @1.1.1.1 before declaring the name broken globally.

When to use automation

Manual dig plus openssl s_client does not scale across dozens of hostnames, redirect chains, and regional anycast nodes. Automate live TLS checks on the exact URL users request, including the certificate after redirects and behind CDNs. Pair that with RDAP domain expiration where registries publish it.

Schedule alerts at 30, 14, 7, and 1 day before certificate notAfter, and separately for registrar expiry. Services such as ssldays run external checks without replacing your CA workflow—useful after DNS cutovers when you need confirmation strangers see the same chain your laptop does.

DNS drift detection pairs well with TLS monitoring. When A records change without a matching ticket, alert the platform team even if the certificate dates still look fine. Attackers and misconfigurations both move names; your automation should notice delegation shifts on customer-facing zones.

Keep a lightweight runbook entry that lists the three commands your on-call runs first: dig +short, openssl s_client with -servername, and a registrar or RDAP expiration lookup for the registrable domain. The habit prevents skipping half the picture during stressful calls.

Scenario walkthrough

Picture a retail brand that moved DNS to a new anycast provider over lunch. Support reports HTTPS errors on mobile only. Combining check domain ssl and dns from a cloud VM and from a handheld on cellular often reveals that the old A record still lives on one resolver cache, taking phones to an abandoned POP where a long-expired default certificate waits. Desktop staff on the office resolver already see the new path, which makes the incident look like a device bug until you paste both dig outputs side by side.

Another recurring pattern is apex versus www divergence. Marketing emails link to the apex, which CNAMEs into a marketing SaaS, while the product lives on www behind your own termination. Customers complain about mixed signals: one hostname valid, another expired. Resolve both names, check TLS for each with correct SNI, and list the answers in status pages instead of claiming a single global fix.

API clients sometimes pin IPs during disaster recovery. DNS returns updated records, but a partner still connects to yesterday’s address for forty-eight hours. Your external monitor on the hostname may look green while their integration fails. When tickets include a specific IP, run TLS against that IP with the customer’s hostname as SNI to reproduce their worldview.

Delegated subzones create surprises when only the parent was renewed. A dedicated RDAP check on the registrable domain does not expose nameserver glue for status.example.com if that label is a separate zone. Include dig NS for both the apex and the complaining label when the hostname is not obviously at the apex.

Finally, document propagation expectations in the ticket. If TTL was seventy-two hours yesterday, do not declare rollback complete two hours after reverting. Set a timed follow-up task that re-runs the combined check for all listed resolvers so on-call is not surprised by a second wave overnight.

Handoff template for tickets

Paste a heading block teammates can reuse. Include resolver used, time in UTC, dig +short answers, serial from OpenSSL, notAfter, RDAP expiration or explicit null, and whether IPv6 was tested. Future you will bless present you during callbacks when memory blurs.

Escalations to registrars go faster with proof the name resolves publicly as expected while TLS still fails. Registrars cannot fix your certificate, but they can confirm delegation if you accidentally repointed nameservers at an empty zone.

When check domain ssl and dns implicates a third-party SaaS, open side conversations early. Waiting until Friday evening to notify the vendor about their CNAME target guarantees a painful weekend even if your own renewal queue is empty.

Geopolitical routing changes occasionally shift which anycast POP answers first. Combined checks from multiple countries belong in runbooks for global brands even when domestic offices see green dashboards.

IPv6-only clients may never attempt IPv4 while dual-stack misconfigurations leave broken AAAA records. Test both stacks whenever your authoritative DNS publishes AAAA.

After acquisitions, inherited zones sometimes still reference former registrar glue. RDAP on the apex plus dig NS on delegated apps catches structural debt before TLS renewals fail ACME challenges.

Inventory automated jobs that rewrite DNS for blue/green deploys. Ephemeral records can point at canary clusters with self-signed material not tracked in central monitoring.

Educate customer support to collect exact URLs and screenshots of certificate viewers. Engineers reproduce faster when they know whether the browser showed date errors versus name mismatch.

If you operate private TLDs on internal DNS, still document how public customers reach you. check domain ssl and dns on public paths remains the default escalation recipe.

Coaching support and product teams

Write a one-page crib sheet linking to this guide for customer support. First-line agents who gather resolver screenshots and exact URLs shorten mean time to repair dramatically.

Product managers launching vanity domains should submit DNS and TLS check results before campaigns go live. Marketing schedules slip less when evidence precedes billboards.

Slack bots that accept a hostname and return dig +short plus notAfter reduce platform interrupts during business hours, provided bots use public resolvers by default.

Documentation portals should show combined check output for official endpoints. Public trust rises when status pages include verifiable certificate dates, not only green bubbles.

Threat intelligence feeds occasionally flag domains that changed DNS suddenly. Pair intel alerts with immediate combined checks to separate benign migrations from hijacks.

When charities rely on volunteers for DNS, schedule quarterly office hours to run these commands together. Skill transfer prevents single-bus-factor expiry surprises.

Legal holds on domain transfers should not pause external monitoring. Certificates continue aging while counsel debates paperwork.

Engineering interns can own monthly combined checks for low-risk microsites, freeing senior staff for complex terminator paths.

Celebrate teams who attach OpenSSL and dig output in every closure comment. Positive reinforcement beats policy PDFs alone.

Plain-language summary

DNS tells the internet where to connect. TLS tells clients whether to trust what answered. Combined inspection prevents one-sided debugging that wastes customer patience.

Name changes during rebrands are high-risk weeks. Schedule combined checks before billboards launch, not after support queues overflow.

Third-party dependencies mean your TLS health is partially outsourced. Detect when their CNAME targets drift before contracts renew.

Training customer support on collecting URLs without credentials improves first-call data quality dramatically.

IPv6 adoption rewards patience; dual-stack verification avoids silent partial outages.

Acquisition integrations should import DNS and TLS baselines together, not sequentially months apart.

Documentation culture matters: paste commands and outputs into tickets so knowledge survives shift changes.

Executive communications should mention both registration and certificate timelines when discussing digital risk.

Ultimately, check domain ssl and dns is a habit of curious verification, not a single tool purchase.