Find the fault
at the right layer.

Four compact diagnostic playbooks for the infrastructure dependencies behind many enterprise incidents.

DNSDNS ResolutionQuery → authoritative answer → recursion → cache → client configuration.

Check: resolver configuration, A/AAAA/CNAME records, TTL, split DNS and authoritative responses.

Evidence: query result, resolver, timestamp and affected scope.

TLSTLS HandshakeTCP → ClientHello → certificate → validation → key exchange → application.

Check: destination name, certificate chain, expiry, SNI, protocol/cipher compatibility and interception.

Evidence: certificate details, handshake error and endpoint time.

SMTPSMTP DeliverySender → submission → relay/proxy → egress → destination MX.

Check: MX resolution, connection, SMTP response, authentication, egress identity and reputation.

Evidence: message ID, UTC timestamp, response code and observed public IP.

LINUXLinux Service FailureProcess → service manager → port → dependency → logs → resource health.

Check: service state, recent logs, listening socket, disk/memory, permissions and dependencies.

Evidence: exact error, service status, log timestamp and configuration change.

DIAGNOSTIC RULE

One layer at a time.

01Reproduce

02Scope

03Capture

04Isolate

05Verify

Operational discipline

Capture evidence before remediation. Make one controlled change at a time, then repeat the original test. This preserves causality and makes escalation materially easier.

Open Security Toolkit →RCA Library Articles

Find the faultat the right layer.

One layer at a time.

Find the fault
at the right layer.