Cloudflare redirect ruleset auth error: the permission I couldn't find
I hit a Cloudflare authorisation error while creating a redirect ruleset in Terraform. The error was correct: the token did not have enough rights.
Simon Painter Blog
Simon Painter Blog
Latest posts
Protective DNS: An Essential Security Control for Hybrid Cloud Networks
DNS sits at the heart of every internet transaction, translating human-readable domain names into the IP addresses that actually route traffic. It's so fundamental that most organisations barely think about it until something goes wrong. But DNS is also foundational in a different way for attackers: it's the layer where malware reaches out for instructions, where phishing links resolve, and where…
Azure Virtual Network Routing Appliance goes GA
Azure Virtual Network Routing Appliance has moved from awkward public preview to general availability. That matters because the preview post left a few open questions: how it would be priced, whether metrics would exist, how much capacity it could really take, and whether it was even remotely ready for production use.
Route Maps for Azure Route Server are now in Public Preview
Route Maps for Azure Route Server is now in public preview. If you've been waiting for the feature to land before building it into your hybrid networking designs, now's the time to kick the tyres.
The certificate mismatch that stops you using privatelink FQDNs, and why it's deliberate
If you create a private endpoint for an Azure storage account and then poke at the DNS, you'll notice something that looks like a loose end. The public name myexampleblob.blob.core.windows.net becomes a CNAME to myexampleblob.privatelink.blob.core.windows.net, and inside your VNet both names resolve to the same private IP. They are, for all resolution purposes, the same endpoint. But if you try to…
Two rulesets, one outbound endpoint: scoping DNS forwarding rules per VNet in Azure
Azure DNS Private Resolver has a documented limit that reads like a feature: two DNS forwarding rulesets per outbound endpoint. The portal, however, behaves as though the limit is one. I had to try proving the documentation right, the portal wrong, and why you might actually want two rulesets on the same endpoint in the first place.
How DHCP really updates DNS
When people say "dynamic DNS", they often mean two different things. One is the home broadband pattern where a firewall tells a public DNS provider that its internet address changed. The other is the enterprise pattern where a host gets a lease from DHCP and then its name shows up in internal DNS a few seconds later. This post is about the second one.
Random by design: how AWS made expander-graph data centre fabrics work
A like-minded colleague and I used to look at network topologies and ask one simple question. If there was a traffic-engineering choice to make, could we leave more of the hard work to the routing protocol and simplify everything else?
DNS AID: decentralized AI agent discovery via DNS
Most teams building agent integrations are still wiring point to point URLs, API docs, and trust assumptions by hand. It works until scale shows up. Then everything gets brittle: stale endpoints, duplicated metadata, and too many side channels for discovery.
Making simonpainter.com WCAG 2 AA compliant, and keeping it that way with CI
I had one of those mildly awkward moments that only bloggers and other people who publish opinions on the internet seem able to engineer for themselves.
S2S VPN certificate authentication is now generally available
Azure VPN Gateway has supported site-to-site connections with pre-shared keys for years. They work, but a shared secret passed between two parties is only as strong as the process you use to manage it. Certificate authentication gives you something more robust, and it's now generally available.
Hybrid Cloud Reference Architectures
I've spent some time helping organisations move their DNS infrastructure from legacy on-premises Active Directory (AD) DNS to modern hybrid cloud environments. They're all different, but they all share some common threads.
How to write inclusive language rules in Copilot instructions
I use the .github/copilot-instructions.md file to keep writing style steady across posts, docs, and code comments. It works well for voice, but it also shows why explicit inclusion rules matter. If you don't write them down, the assistant fills the gaps with its own defaults.
From chatbots to workflows: why the GitHub app is the next step
My journey with AI tools has followed a pattern I've seen before with Microsoft: someone builds something useful, then Microsoft makes it native to where you already work. That turns out to matter more than being technically superior. Today, the GitHub Copilot app launched into public preview, and it's the clearest expression of that pattern I've seen yet.
Meet uping: pronounced 'micro ping'
I use ping a lot, but milliseconds can hide the detail I care about. That's where uping comes in. It's a small C tool for macOS and Linux that measures ICMP round-trip time in microseconds, with colour-coded output you can read at a glance.
CNAME rules in DNS - what you need to know
The CNAME (Canonical Name) record is one of the most straightforward DNS record types in concept consistency, cache efficiency, and preventing resolver bugs. This post is about all the rules relating to CNAME usage, drawing directly from RFC 1034 (Domain Names - Concepts and Facilities) and RFC 1912 (Common DNS Operational and Configuration Errors). More importantly, it should explain some of the…
IPv8: a late and confused April Fool
There's a draft Internet-Draft floating around called "IPv8" by Jamie Thain. It was published in April 2026 and reads like a list of every networking buzzword bingo square you can imagine, stapled together with a straight face. I read it twice to make sure I wasn't missing the joke. I don't think I was. So either it's an April Fool that ran a couple of weeks late, or somebody is genuinely…
Ping is lying to you - try these instead
I saw a clever little tool on LinkedIn the other week. Someone had written a "ping" in Go that fired HTTP requests instead of ICMP echoes. I sent it over to Zain and we both agreed the idea was great. But writing it in Go felt like a lot of effort for what is, at heart, a loop around curl. So I wrote a Bash version in about ten minutes. Then I wrote one for DNS. Then one for NTP. They all live…
Vibe code project: Internet Map
I've always been more interested in the plumbing of the internet than the web pages sitting on top of it. Every time you load a page, your packets hop across a patchwork of independent networks called Autonomous Systems (ASes), each with its own ASN (Autonomous System Number). Who connects to whom, and how, is what I wanted to map. Now that it's so easy to vibe code with AI, any idea or interest…
Why there are exactly 13 DNS root servers
I'm enjoying reading "DNS: The Internet's Control Plane" by Enrique Somoza and one of the things it mentioned was that there are exactly 13 DNS root servers and this is a hangover from the early days of the internet. It also predates the anycast architecture that allows each root server IP to be served by multiple machines around the world. I thought it worth a little dig. Get it?