MyAIDevelopment · Product · Operations notes

Domain · DNS · TLS · CDN: The Path Users Take

From the moment a user types a domain into the address bar until the first byte arrives, several layers take part in turn. If any one of them is wrong, users cannot connect even though the service itself is fine.

The Path of a Request

flowchart LR
    U[Browser / App] --> D[DNS lookup]
    D --> C[CDN Edge]
    C --> T[TLS Handshake]
    T --> K{Cache hit?}
    K -->|Yes| R[Respond from edge]
    K -->|No| O[Origin: App / Storage]
    O --> R

Domain and DNS Basics

Record Purpose Example
A / AAAA Name → IPv4 / IPv6 address api.example.com → 203.0.113.10
CNAME Name → another name www → mysite.hosting-provider.net
TXT Ownership checks, SPF, etc. Verification string from the hosting provider
MX Designates mail servers Mail service provider
CAA Specifies which CAs may issue certificates for this domain 0 issue "letsencrypt.org"

TLS Certificates: Lifetimes Are Shrinking

In 2025-04 the CA/Browser Forum passed Ballot SC-081v3, reducing the maximum validity of public TLS certificates in steps.

Issued Maximum validity
On or after 2026-03-15 200 days
On or after 2027-03-15 100 days
On or after 2029-03-15 47 days

Let's Encrypt's announced schedule (checked 2026-09-28):

The conclusion is simple: certificate renewal is not a human task; it must be automated (ACME).

Bad:  Issue a one-year certificate by hand and renew it from a calendar reminder.
Good: Use automatic issuance in your hosting / CDN / ingress, or renew with an ACME client,
      and receive monitoring alerts when expiry approaches.

How to automate it

Let's Encrypt's shortlived (6-day) and tlsserver profiles are opt-in. The ACME client must request a profile explicitly; without a request, certificates come from the default classic profile. Some clients do not support profile selection.

Forcing HTTPS: HSTS

HSTS (RFC 6797) uses the Strict-Transport-Security header to tell browsers "connect to this site only over HTTPS."

Strict-Transport-Security: max-age=31536000; includeSubDomains

CDN and Caching

A CDN answers from an edge close to the user, reducing latency and origin load. Caching is controlled with the Cache-Control header from the HTTP Caching standard (RFC 9111).

Target Example header Why
Hashed static files (app.3f9a.js) public, max-age=31536000, immutable The file name changes when content changes
HTML no-cache or a short max-age New deploys must show up immediately
Personalized API responses private, no-store Caching them for other users is an incident 
Bad:  Keep file names unchanged with a long cache, so users still get old JS after a deploy.
Good: Put a content hash in file names at build time and cache only HTML briefly.

What to Block at the Edge

A CDN or edge is not only a cache; it is where bad requests are filtered before they reach the origin.

Cutover Procedure

  1. Lower the DNS TTL a few days before the cutover.
  2. Confirm certificate issuance and HTTPS responses on the new environment first.
  3. Change the DNS record and check lookups from several regions.
  4. Keep the old environment until the TTL has fully passed.
  5. Once stable, restore the TTL to its original value.

References