CertaDNS
Skip to lesson

The Plan · lesson 3 of 3

Owners and criteria

After this lesson you can

Assign every item to a party and give each step a condition for proceeding.

Assumes you have read Ninety days, and a year.

A plan without owners is a list of suggestions, and a policy step without a criterion is a date somebody will meet by changing a record regardless of the evidence.

Owners

WorkOwnerNot the owner
Registrar account controlsWhoever administers IT accountsSecurity, who cannot change them
DNS record changesThe DNS ownerThe person who wrote the report
Aligning a sending platformThe business owner of that platformSecurity, who has no account on it
Reading aggregate reports weeklyA named individual in securityA team, which means nobody
The registrar recovery trackLegal or procurement, with security supportingWhoever found the problem
Deciding to move policySecurity, on stated criteriaA steering group, which cannot meet weekly

The last two rows are where plans usually fail. Work assigned to whoever discovered it stalls when that person is busy, and a decision that requires a committee happens at committee cadence rather than at evidence cadence.

Criteria

BEFORE p=quarantine on calderandvoss.com
   Every source above 0.5% of volume identified and
     attributed to a system
   Aligned pass rate above 95% for four consecutive weeks
   No unexplained source above 0.5%
   Forwarding residual understood and accepted
   TTL lowered to 300 at least 48h beforehand
   Rollback rehearsed at p=none

BEFORE p=reject
   Four weeks at quarantine, no attributable incident
   Aligned pass rate above 98%
   Every remaining failure explained, not merely small
   The events platform exception in place on its
     own subdomain

Written in advance, these answer “is it safe to proceed” without a meeting. The numbers are defensible defaults; what matters is that they existed before anybody wanted the answer to be yes.

Every step has a way back

  • TTL lowered a full current-TTL period before the change, not at the change.
  • Triggers for reverting agreed in advance, including which signals do not justify it.
  • Partial revert preferred: one step back, or an exemption at a subdomain.
  • The rollback rehearsed once while it did not matter.

Put the criteria in the plan, not in the appendix

They are the part that makes the dates meaningful. A plan showing “quarantine, week 12” is a commitment to a date; one showing “quarantine when these four conditions hold, expected week 12” is a commitment to a method, and it survives the conditions not holding on schedule.

Last reviewed