Small business operations

Operational Verification Checklist for Small Businesses

A small business doesn't need a security team to run a real verification programme. This checklist covers the eight checks that catch most operational risk — domain, DNS, SSL, blacklist, and reputation — with a schedule a non-specialist can maintain.

Quick summary

  • Eight checks cover most small-business operational risk.
  • Save the sequence as a workflow once, resume monthly.
  • Tighten cadence for sending domains and checkout flows.
  • Pair with light monitoring for change alerts.

The eight-check verification list

  1. Domain ownership and renewal date (WHOIS).
  2. DNS A / AAAA / CNAME match expected hosts.
  3. MX, SPF, DKIM, DMARC for the sending domain.
  4. SSL certificate is valid and not within 30 days of expiry.
  5. Sending IP isn't on a major blacklist.
  6. Domain reputation is clean.
  7. HTTP headers expose nothing sensitive.
  8. Customer-facing URL is reachable from outside your network.

Making it a habit

The hardest part isn't running the checks — it's remembering to. Save the sequence as a named workflow on the dashboard and put a recurring calendar reminder against it. The next monthly run is a single click.

Troubleshooting workflow

Run through these steps in order. Each step links to the right diagnostic tool.

  1. 1

    Confirm domain ownership

    WHOIS / RDAP shows registrant and renewal date.

    Open WHOIS
  2. 2

    Validate DNS and email auth

    MX, SPF, DKIM, DMARC in one pass.

    Open DNS Lookup
  3. 3

    Check the certificate

    Catch expiry well before the 30-day mark.

    Open SSL Checker
  4. 4

    Sweep blacklists

    Both sending IP and domain.

    Open Blacklist Check
  5. 5

    Save the workflow

    Resume monthly from the dashboard.

    Open Operational dashboard

Frequently asked questions

How long does this checklist take?

About 15 minutes the first time, under 5 once saved as a workflow you can resume.

How often should a small business run it?

Monthly for the full sequence; weekly for sending domains and customer-facing assets.

Do I need a dedicated tool?

Not strictly — but a saved workflow turns a sporadic chore into a recurring habit, and that's where the operational value lives.

What if a check fails?

Treat it like an incident: fix the underlying issue, then re-run the workflow to confirm the fix and update your records.

Monitor it continuously

Save this check, get alerts on changes, and track multiple domains in one dashboard.

Learn about monitoring