Three concise references for separating name resolution, session setup and content delivery.
DNS
Check the answer before the route
Start by recording the A and AAAA responses from the resolver you are actually using. A cached or stale address can make every later test misleading.
Useful sequence
Resolve the hostname twice and compare the answers.
Check the advertised time to live.
Test IPv4 and IPv6 independently when both are present.
Only then measure the connection to the returned address.
A DNS lookup shows where a client was directed. It does not prove that the application on that address is healthy.
TLS
Verify the complete handshake
A certificate being valid in a browser is only one part of the result. The requested hostname, certificate names, chain and negotiated protocol should agree.
Record these details
Server name sent by the client.
Certificate subject alternative names and expiry.
TLS version and negotiated application protocol.
Whether a fresh connection and a resumed connection behave differently.
Certificate renewal should be tested before the current certificate approaches expiry, including the challenge path used by the issuer.
HTTP
Keep latency and throughput separate
Time to first byte describes how long the first response data takes to arrive. Transfer rate describes what happens after the response starts. Combining them hides useful information.
A compact test
Make several small requests over fresh connections.
Record the median and the slowest result, not only the best.
Download a fixed-size object separately for throughput.
Repeat from a second network before blaming the origin.
One fast run does not establish a baseline. A short series reveals variation that an average can hide.
