Deployment validation checklist

Management validation

• Web UI is reachable only from approved networks.
• HTTPS certificate is trusted and matches the Management URL.
• Local administrator login succeeds.
• Directory login succeeds if enabled, and an unauthorized user is rejected.
• License edition, expiry, and limits are correct.
• SMB and DNS nodes report current heartbeats.
• Policy save shows delivery progress and node acknowledgement.
• Support diagnostics can be exported without exposing secrets to an untrusted location.

SMB validation

• TCP 445 listener is bound to the intended interface and IP.
• Direct client access to the backend file server is denied.
• A benign text file uploads and downloads correctly.
• A multi-GB benign transfer completes and byte counters are plausible.
• File transfer ledger records client IP, path, direction, and size.
• A harmless signature fixture triggers the configured Monitor or Block action.
• A harmless known_bad SHA-256 fixture is blocked when the action is Block.
• The blocked file is absent from the backend share.
• Disconnect and reconnect behavior is acceptable to Windows clients.

DNS validation

• UDP and TCP queries succeed.
• Repeated queries create cache hits.
• Local A/AAAA records return the configured answer.
• Explicit allow and block test domains behave as configured.
• False-positive override procedure is documented.
• Upstream failure is visible and does not silently return unrelated data.
• AD join, login, Group Policy, Kerberos, LDAP, and service discovery work where applicable.

Evidence to retain

Record the release identifier, node IDs, policy generation, timestamps, test fixture hashes, client IPs, expected results, actual results, and exported diagnostic bundle. Remove test reputation entries and domains when validation is complete.