DNS troubleshooting
Nearly every setup problem is one of five things. Check them in this order.
1. Apex CNAME refused
Many DNS providers won’t accept a CNAME on the bare domain. Fix: use their ALIAS/ANAME/flattening feature, or protect www and redirect the apex to it.
2. Proxy toggle left on
If your DNS provider offers a “proxied” toggle (an orange cloud at Cloudflare), the record must match what our dashboard expects. A record that resolves to the wrong place fails verification. Set the record exactly as shown; if in doubt, DNS-only.
3. DNSSEC / DS mismatch
If the domain has DNSSEC enabled at the registrar and you change nameservers, the old DS record makes every answer look forged. Fix: remove the DS record at the registrar (or add ours if offered) when changing nameservers. Symptom: the domain fails to resolve everywhere at once.
4. Stale cache / TTL
Resolvers cache old answers. A change can take minutes to hours to be visible everywhere. Our verifier checks multiple resolvers — if some still see the old record, wait and re-verify rather than changing the record again.
5. Registrar lock
Client-transfer locks can also block nameserver changes at some registrars. If a change silently reverts, check for a lock in the registrar panel.