Build It Like You Mean It
- Patrick Duggan
- Aug 29, 2025
- 3 min read
Updated: Apr 25
There’s a quiet trap in modern enterprise development: the illusion of “good enough.” You spin up an email domain through Microsoft 365, maybe let Wix handle your DNS, and before long you’re deploying production workloads on top of assumptions. It feels fast. It feels frictionless. But it’s not secure—and it’s certainly not scalable.
I’ve spent the past few months rebuilding something from the ground up. Not just the app layer, but the trust layer. That means starting with DNS ownership, not delegation. It means treating PKI as a first-class citizen, not a post-launch patch. It means using a real Key Vault—not a spreadsheet of secrets—and designing certificate workflows that are reproducible, auditable, and automated.
The strategy leans heavily on the ACME framework—not just for issuing certificates, but for enforcing discipline. Every cert is issued with intent, rotated on schedule, and stored where it belongs. No more “set it and forget it” TLS. No more dangling OAuth registrations with expired secrets and forgotten scopes. Automation isn’t a convenience—it’s a control surface.
When you own your DNS, you control the blast radius. When you architect your PKI, you define the trust boundaries. And when you build with intention, you don’t just ship—you secure.
This isn’t about perfection. It’s about posture. The difference between “it works” and “it holds up under pressure” is the difference between a demo and a deployment. And if you’re serious about building something that lasts, you don’t start with what’s convenient. You start with what’s correct.
So whether you're building from a whiteboard sketch or a funded roadmap, if you're serious about launching something secure and scalable, this post is for you.
🧾 Trusted Domain & Application Launch Checklist
🔐 DNS & Domain Strategy
Microsoft pulls this feed daily. AT&T pulls this feed daily. Starlink pulls this feed daily. Get the DugganUSA STIX feed — $9/mo →
[ ] Register domain with a provider that supports full DNS control and API-based automation (e.g., Azure DNS, Cloudflare)
[ ] Avoid bundled DNS from website builders (e.g., Wix) if planning secure app development
[ ] Create dedicated subdomains for app, auth, and infrastructure (e.g., forms.domain.com, api.domain.com)
[ ] Enable DNSSEC if supported by registrar
[ ] Centralize DNS management for auditability and automation
🧱 Website & App Development Foundations
[ ] Choose a hosting model that supports TLS, reverse proxy, and identity integration (e.g., Azure App Service, containerized VM)
[ ] Use infrastructure-as-code (Bicep, Terraform) to define and deploy resources
[ ] Integrate CI/CD pipelines with linting, secrets scanning, and deployment gates
[ ] Secure public endpoints with App Gateway, WAF, or private endpoints where appropriate
[ ] Implement logging and monitoring from day one (e.g., Azure Monitor, Log Analytics)
🔑 PKI & Certificate Strategy
[ ] Use Let’s Encrypt with ACME for automated TLS issuance and renewal
[ ] Store certificates in Azure Key Vault with lifecycle policies
[ ] Convert and import .pfx for services that require it (e.g., App Gateway, Function Apps)
[ ] Rotate certificates regularly and monitor expiry
[ ] Avoid manual cert management—automate wherever possible
🔐 Identity & OAuth Hygiene
[ ] Register apps in Microsoft Entra ID with scoped permissions
[ ] Store client secrets in Key Vault, not config files
[ ] Monitor and clean up stale app registrations and unused secrets
[ ] Use Managed Identity for internal Azure service access
[ ] Audit OAuth flows for over-permissioned scopes and expired tokens
🧪 Trust & Posture Validation
[ ] Validate DNS propagation and TLS chain with external tools (e.g., dig, SSL Labs)
[ ] Test OAuth flows with token introspection and refresh logic
[ ] Run security scans on public endpoints (e.g., Qualys, Burp Suite)
[ ] Document trust boundaries and threat models
[ ] Treat every integration as a potential blast radius—contain and monitor accordingly
The cheapest, fastest, most accurate threat feed on the internet.
275+ enterprises pulling daily. 1M+ IOCs. 17.4M indexed documents. We beat Zscaler by 43 days on NrodeCodeRAT. Starter tier $9/mo — less than any competitor’s sales demo.
Comments