Most network problems in a small office come down to a handful of facts: which public address the office has, whether that address is shared, whether the domain’s DNS records point where they should, and whether email and HTTPS are configured correctly. This checklist goes through them in order. Each step links to a tool on this site that answers it from public data.
1. Know your public IP address
Open the homepage from the office network. The address shown is the one the internet sees for your office. Write it down together with the network (AS number) it belongs to.
- If it is in 100.64.0.0/10, your connection is behind carrier-grade NAT: you share the address with other customers and cannot accept incoming connections. See What is CGNAT?
- If you need remote access, a VPN endpoint or a mail server on site, ask your provider for a static public IP address; it is usually a separate business service.
2. Check that it doesn’t change
Reload the homepage after a router restart. A changing address is normal for home and mobile plans and breaks firewall allow-lists at partners, payment providers and cloud services. A static address is the fix, not a dynamic DNS workaround, if partners must allow-list you.
3. Check your domain’s DNS
Run a DNS lookup for your domain and the www name. Confirm that:
- the A/AAAA records point to your website’s host;
- the NS records name the DNS provider you actually pay for;
- the MX records point to your email service.
After changing records, the DNS propagation check shows what several public resolvers return. Old answers disappear when their TTL runs out.
4. Check email authentication
Mail from a domain without SPF, DKIM and DMARC is increasingly sent to spam or rejected. The email DNS check reads all three, counts SPF’s DNS lookups against the limit of ten, and shows the DMARC policy. Start with p=none and a reporting address, read the reports, then move to quarantine or reject.
5. Check HTTPS
The TLS certificate check shows who issued your certificate, which names it covers and when it expires. An expired certificate is the most common cause of a website suddenly showing a security warning. The security headers check shows whether HSTS and the other protective headers are set.
6. Check IPv6
Run the IPv6 test from the office. If your provider offers IPv6 and your router supports it, enabling it avoids some of the limitations of shared IPv4 addresses. If your website publishes an AAAA record, make sure it actually answers over IPv6 — a broken AAAA record is worse than none.
7. About .ae domains
.ae names are administered by the .ae Domain Administration, part of the TDRA, and registered through accredited registrars. Two practical points: the .ae zone is not signed with DNSSEC today, so DNSSEC cannot protect .ae names (see the UAE page); and registration details are available from the registry’s WHOIS service, which our WHOIS lookup queries.
When to call your provider
If your public address is not what your contract says, if it is in a CGNAT range although you pay for a public address, or if the latency test shows high and unstable values over a cable connection, collect the results from these tools and give them to your provider’s business support. Concrete measurements shorten the conversation.