Separate symptoms from scope
Record the first observed time in UTC, affected hostname, resolver result, TCP and TLS behavior, HTTP status, and whether another network reproduces the issue. A browser error alone cannot distinguish DNS, certificate, origin, application, or local-network failure.
Use request identifiers and short sanitized log excerpts. Never send passwords, private keys, session cookies, database dumps, or full environment files in a ticket.
- UTC timestamp
- Exact hostname and route
- Expected and observed result
- Independent reproduction
Preserve the recovery record
Write down each provider action, configuration change, and observed effect. When service returns, confirm data integrity, queued work, mail, scheduled jobs, and certificate state before declaring resolution.
A post-incident note should identify the failed boundary and the detection gap, not merely record that support restarted something.
Hand the report to someone without prior context and confirm they can reproduce the symptom without requesting a secret.