Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Armario de comunicaciones abierto en una pared, con paneles de parcheo, un conmutador de red y manojos de cables de colores
9 min read

Your secondary DNS only covers silence

On 11 October 2026 a paid DNS provider stopped answering at every location at once for about 54 minutes: its API was storing a setting as an integer where the software expected a string. We look at the other half of the problem, the half no post-mortem covers: what your own network does during those minutes. Microsoft's documentation says the client only switches servers if the previous one is unreachable — an incorrect answer does not trigger failover — that it stays pinned to the alternate for up to 15 minutes, and that on Linux the default cost of a silent resolver is 5 seconds per attempt. With the fifteen-minute check to measure it at home.

Multifunción de oficina junto a una mesa con bandejas de correo entrante y formularios de fax
9 min read

Your SPF passes, your DKIM passes, and DMARC still fails

The header says spf=pass and dkim=pass, and two lines below it says dmarc=fail. That is not a bug: it is alignment, and it is what breaks the mail your applications send. Inside: what DMARC actually compares, the row in Microsoft's own table where onmicrosoft.com fails even in relaxed mode, why your aggregate reports never arrive if you have a gateway in front of the tenant, and the sender inventory to write down before touching DNS.

Armario de comunicaciones con cortafuegos y panel de parcheo en una sala técnica
10 min read

The certificate ACME doesn't renew is the one that kills your VPN

Do the arithmetic: 15 March 2026, the day the 200-day ceiling for public TLS certificates came into force, plus 200 days. That lands on 1 October. Today. The first certificates issued under the new rule start expiring this week, and this stops being a 2029 problem. The CA/Browser Forum schedule (ballot SC-081v3, 25 issuers in favour and none against) drops to 100 days on 15 March 2027 and to 47 in 2029, with domain validation down to 10 days: about 37 validations a year per name. The 47 is neither arbitrary nor round: it is 31 + 15 + 1, sized so a monthly renewal fits with room for one retry. But the web server has renewed itself for years; the problem is the firewall portal, the VPN gateway and the RADIUS box doing EAP-TLS. And here is the uncomfortable conclusion: ACME validates from the outside, and those devices are not published on the Internet precisely because you segmented properly. The better your network, the worse your position. What path is left, what new risk comes from giving a script write access to your DNS, why half the list should not be in the public chain at all, and the four columns that decide by themselves what to do with each row.

Rack de comunicaciones con paneles de parcheo, latiguillos de red y una bandeja de fibra en la parte baja
5 min read

The DDoS that takes you down is not in the headlines

In the first half of 2026, 96.62% of the network-layer attacks Cloudflare mitigated stayed under 500 Mbps and 90.60% ended in under ten minutes. The attack that makes the press is measured in tens of terabits; the one that will take a mid-sized company offline fits inside an ordinary fibre link and is over before anyone picks up the phone. Why the metric that matters is time to activation and not terabits of capacity, what changes now that DNS floods have gone from 25.7% to 40% in a single quarter, and the five questions we ask before buying any mitigation.

Armario de comunicaciones de pared con switch y cables de red
10 min read

Windows DNS, an unauthenticated 9.8: what turns a bug into a worm is not the bug, it's your network

On 8 September Microsoft shipped the largest batch of patches in its history. Dustin Childs, of the Zero Day Initiative, counts twenty that could be classified as wormable, spread across thirteen components. Those thirteen are not one list: they are two. Seven of those CVEs sit in services your domain requires every machine to reach — DNS, Netlogon, Active Directory, DHCP — and eleven sit in roles Windows does not install on its own. The first half is managed with patching order; the second, by uninstalling. And hardly anyone knows which of the two they have switched on.

Una tormenta de verano avanzando sobre el desierto, origen del fallo de refrigeración que apagó 5.000 servidores
5 min read

Your servers can be switched off by someone you never signed anything with

On 13 August more than 5,000 servers were powered off in a building in Phoenix, taking down the websites, email and DNS of thousands of companies. The decision to shut down was the right one; what is interesting is the chain the order came down, because the end customer sits at the bottom of it with no contract with whoever decides. What to ask about the building your hardware lives in, and why DNS took down people who were not even there.

Muro de ladrillo con la publicidad pintada de un comercio que ya no existe: el nombre sigue ahí mucho después de que el negocio cerrara
5 min read

An expired .es is released in ten days. A .com can give you eighty

Infoblox published on 13 August that around 65,000 expired domains were re-registered every day during the first half of 2026: nearly 20% of all the registrations they observe. A .com calendar gives you room —up to 45 days of auto-renew grace and 30 of redemption. A .es one does not: ten days after expiry it is cancelled and available again, with no redemption, and only the administrative or billing contact can request the renewal. What the catcher is buying, what still points at that name once it is no longer yours, and when there is nothing to renew.

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
everyWAN
everyWAN