Small business operations

Operational Verification Checklist for Small Businesses

A small business doesn't need a security team to run a real verification programme. This checklist covers the eight checks that catch most operational risk — domain, DNS, SSL, blacklist, and reputation — with a schedule a non-specialist can maintain.

Quick summary

  • Eight checks cover most small-business operational risk.
  • Save the sequence as a workflow once, resume monthly.
  • Tighten cadence for sending domains and checkout flows.
  • Pair with light monitoring for change alerts.

The eight-check verification list

  1. Domain ownership and renewal date (WHOIS).
  2. DNS A / AAAA / CNAME match expected hosts.
  3. MX, SPF, DKIM, DMARC for the sending domain.
  4. SSL certificate is valid and not within 30 days of expiry.
  5. Sending IP isn't on a major blacklist.
  6. Domain reputation is clean.
  7. HTTP headers expose nothing sensitive.
  8. Customer-facing URL is reachable from outside your network.

Making it a habit

The hardest part isn't running the checks — it's remembering to. Save the sequence as a named workflow on the dashboard and put a recurring calendar reminder against it. The next monthly run is a single click.

Troubleshooting workflow

Run through these steps in order. Each step links to the right diagnostic tool.

  1. 1

    Confirm domain ownership

    WHOIS / RDAP shows registrant and renewal date.

    Open WHOIS
  2. 2

    Validate DNS and email auth

    MX, SPF, DKIM, DMARC in one pass.

    Open DNS Lookup
  3. 3

    Check the certificate

    Catch expiry well before the 30-day mark.

    Open SSL Checker
  4. 4

    Sweep blacklists

    Both sending IP and domain.

    Open Blacklist Check
  5. 5

    Save the workflow

    Resume monthly from the dashboard.

    Open Operational dashboard

Frequently asked questions

How long does this checklist take?

About 15 minutes the first time, under 5 once saved as a workflow you can resume.

How often should a small business run it?

Monthly for the full sequence; weekly for sending domains and customer-facing assets.

Do I need a dedicated tool?

Not strictly — but a saved workflow turns a sporadic chore into a recurring habit, and that's where the operational value lives.

What if a check fails?

Treat it like an incident: fix the underlying issue, then re-run the workflow to confirm the fix and update your records.

Run the rest of the checks

DNS, SSL, headers, blacklists and WHOIS all run free in the browser — no account, nothing stored.

Browse the tools