Writing

A 522 means Cloudflare couldn't even open a TCP connection to your origin — here's how to tell that apart from a slow origin, and where to actually look first.

NXDOMAIN and SERVFAIL are not the same failure. Conflating them sends troubleshooting toward record content when the real problem is somewhere else entirely.

IBM CIS quietly serving an ECDSA-only Let's Encrypt certificate broke handshakes for a legacy IBM Sterling client — here's why re-trusting the new CA wasn't enough, and what actually fixed it.

A legitimate request blocked by a managed WAF rule isn't a reason to disable the ruleset — it's a reason to scope one narrow exception.