DNS and Domains field notes
Fix DNS records, email authentication, DNSSEC, and certificates with confidence
A working library of the DNS and domain problems that break real sites and email, across records, nameservers, email authentication, DNSSEC, certificates, and takeover risk, with the exact records and commands to fix each one. Every guide has a diagram of the problem, a diagram of the fix, the records and commands to apply and to verify, and links to the sources. Where a DNS provider API can do it, there is a small Python and Node.js script too.
Nameserver / Delegation
4 guidesRegistrar nameservers do not match hosted zone
Registrar NS glue differs from the authoritative zone NS set. Script compares WHOIS/RDAP NS against live NS query.
DiagnosticSubdomain delegation missing NS glue in parent zone
Parent zone lacks NS records delegating a subdomain. Script checks parent zone delegation against child zone SOA/NS.
DiagnosticPartial nameserver cutover serves split answers
Old and new nameservers both listed at registrar during migration. Script queries each NS directly and diffs responses.
ReconcilerHosted zone recreated with new NS values
Deleting and recreating a zone assigns new NS that no longer match registrar delegation. Script cross-checks zone NS against registrar NS.
ReconcilerCore Records
8 guidesMissing A or AAAA record causes NXDOMAIN
Hosted zone lacks an address record for the queried name. Script resolves the name and reports the missing record.
DiagnosticCNAME at zone apex conflicts with NS or SOA
A literal CNAME at the root breaks required apex records. Script detects apex CNAME and confirms flattening resolved correctly.
RepairCNAME coexists with another record type at same name
A CNAME shares a hostname with MX, TXT, or A records, which is invalid. Script scans the zone for coexistence violations.
DiagnosticDuplicate or conflicting records for the same name
Two A records or a CNAME plus another type exist at one name causing undefined resolution. Script fetches the record set and flags duplicates.
DiagnosticCNAME to A record type change fails on existing RRSet
Converting a CNAME to an A record fails unless the old record is deleted first. Script orders deletes before creates when reconciling.
Repairwww and apex configured inconsistently
Only www or only apex is set up, so the other variant fails to resolve or serves different content. Script resolves both and compares.
ReconcilerWildcard record creates unintended catch-all exposure
A broad wildcard resolves every undefined subdomain, masking typos or takeovers. Script enumerates wildcard scope and flags apex-level wildcards.
DiagnosticHosting provider DNS check fails custom domain setup
Apex A records or CNAME target do not match the host's required values (e.g. GitHub Pages). Script checks records against the provider's published values.
ReconcilerSecurity / Takeover Risk
6 guidesDangling CNAME enables subdomain takeover
CNAME target on a cloud provider is deprovisioned or unclaimed. Script resolves the CNAME chain and flags claimable targets.
DiagnosticDangling CNAME chain with claimable intermediate hop
A multi-level CNAME chain has a claimable target partway through, not just at the end. Script follows the full chain, not only the first hop.
DiagnosticOrphaned DNS records left after service teardown
A or CNAME records remain pointing at decommissioned infrastructure with no owner. Script diffs zone records against a live infrastructure inventory.
ReconcilerWildcard record points at a deprovisioned service
A wildcard CNAME targets a third-party service that is gone, exposing every unclaimed subdomain to takeover. Script flags wildcards pointing at takeover-prone services.
DiagnosticWHOIS or RDAP change signals possible domain hijack
Registrant, nameserver, or status fields change unexpectedly ahead of an unauthorized transfer. Script polls RDAP and diffs fields over time.
DiagnosticTransfer lock unexpectedly removed
The clientTransferProhibited EPP flag disappears, a common precursor to unauthorized transfer. Script checks RDAP status codes for a missing lock.
DiagnosticTLS Certificates / CAA
5 guidesCAA record blocks certificate issuance for the intended CA
CAA excludes the CA attempting issuance, causing an authorization error. Script queries CAA and cross-checks against the CA in use.
DiagnosticCAA blocks wildcard certificate issuance specifically
CAA fails wildcard cert issuance even though the base domain issues fine. Script evaluates CAA at both apex and wildcard label.
DiagnosticCAA lookup fails due to broken DNSSEC chain
A CA's CAA check hits SERVFAIL from a broken DNSSEC chain, blocking renewal. Script validates DS, DNSKEY, and RRSIG before issuance.
DiagnosticTLS certificate SAN or hostname mismatch
Served certificate's SAN list does not cover the requested hostname, causing handshake failures. Script opens a TLS connection and checks SAN against hostname.
DiagnosticTLS certificate nearing or past expiry
Renewal automation fails silently and the certificate lapses. Script opens a TLS connection, reads notAfter, and alerts before expiry.
DiagnosticDNSSEC
6 guidesDS record mismatch after KSK rollover
Registrar's published DS no longer matches the zone's current KSK, breaking validation. Script compares DS at parent against DNSKEY at the zone.
DiagnosticStale DS records left behind after key rollover
Old DS records were never removed, so validators cannot build a trust chain. Script lists all DS records and flags ones with no matching key.
DiagnosticDNSSEC stuck pending during domain transfer-in
The DS record never gets added automatically after a transfer, leaving DNSSEC perpetually pending. Script polls DS presence against expected state.
DiagnosticMissing DS record breaks DNSSEC validation
A zone signs its responses but the registrar never publishes a DS record, causing SERVFAIL for validating resolvers. Script confirms DS exists at the parent whenever DNSSEC is enabled.
DiagnosticOrphaned DS record left after disabling DNSSEC
DNSSEC is turned off at the zone but the registrar's DS record is not removed, breaking resolution. Script flags DS present with no matching DNSKEY or RRSIG.
DiagnosticExpired RRSIG signatures break validation
A signing job stalls and RRSIG validity windows lapse, causing bogus or SERVFAIL answers. Script checks RRSIG expiration timestamps against current time.
DiagnosticEmail Authentication
10 guidesSPF exceeds the 10 DNS lookup limit
Nested include mechanisms push SPF evaluation past 10 lookups, causing PermError. Script recursively counts lookups and flags overage.
DiagnosticDuplicate SPF TXT records on one domain
Two separate v=spf1 TXT records exist, which must be treated as PermError. Script queries TXT records and counts SPF-prefixed entries.
RepairSPF record has duplicate or misplaced all mechanism
Two all directives in one SPF record break evaluation order. Script parses the SPF record and flags duplicate or misordered mechanisms.
DiagnosticDKIM selector record missing or not propagated
The selector._domainkey record is absent or stale, so signatures cannot verify. Script queries expected selector names and flags absence.
DiagnosticRequired DKIM CNAME selectors not published
Some providers expect CNAME records for selectors and rotation stalls if missing. Script checks that both selectors resolve as CNAMEs to the provider's target.
ReconcilerDKIM TXT record malformed or wrapped in quotes
A copy-pasted or unsplit long key invalidates the public key value. Script fetches the TXT record and validates the key parses correctly.
DiagnosticDKIM public key stale after rotation
DNS still publishes the old public key after a private key rotation, so signatures fail. Script diffs the deployed key against the published TXT.
ReconcilerDMARC record missing or malformed
The _dmarc TXT record is absent or missing required tags. Script fetches the record and validates syntax against DMARC tag grammar.
DiagnosticDMARC stuck at policy none indefinitely
A domain never progresses past monitor-only policy, leaving it unprotected from spoofing. Script parses the DMARC record and flags p=none.
DiagnosticDMARC aggregate reports never arrive
The rua destination lacks the required third-party authorization record on a different domain. Script checks both the DMARC record and the external auth TXT record.
DiagnosticMail Routing
5 guidesLeftover MX records from a decommissioned provider
Old provider's MX entries remain after migration, splitting or losing mail. Script diffs the live MX set against the intended provider's documented hosts.
ReconcilerMX record points to an unreachable host
An MX target no longer accepts SMTP, silently dropping mail. Script resolves each MX host and probes port 25 connectivity.
RepairMX record has no A or AAAA record
The MX target hostname has no address record, so mail bounces. Script resolves each MX host and flags dangling targets.
DiagnosticMX record malformed with stray characters or missing FQDN
An MX target includes a stray @ or is a bare IP instead of a hostname, violating RFC. Script validates MX target syntax and resolvability.
RepairMissing reverse DNS for outbound mail IP
The sending IP lacks a PTR record or it does not forward-confirm, triggering rejections. Script performs a reverse lookup and checks the forward match.
DiagnosticTTL / Propagation
5 guidesTTL set too high delays urgent changes
A long TTL keeps stale answers cached well after a record change. Script reads live TTL values and flags ones above a safe threshold before cutovers.
DiagnosticTTL set too low overloads authoritative nameservers
A very short TTL multiplies query load on authoritative servers. Script estimates query volume from TTL and traffic to flag risky low values.
DiagnosticProxied record silently overrides configured TTL
Enabling proxy mode forces TTL to automatic regardless of the value sent via API. Script detects TTL and proxy-status mismatches against intended config.
ReconcilerAnswers differ across public resolvers
A record's value differs between resolvers from stale caches or partial rollout. Script queries multiple public resolvers in parallel and diffs answers.
DiagnosticStale negative cache keeps a fixed record unresolvable
Resolvers cache a prior NXDOMAIN per the SOA negative TTL even after the record is added. Script queries multiple resolvers to detect stale negative caching.
DiagnosticDomain Lifecycle
3 guidesDomain nearing expiration without renewal action
RDAP or WHOIS expiration date falls inside a warning threshold with no renewal triggered. Script checks expiry on a schedule and alerts.
DiagnosticAuto-renewal enabled but payment failed
Auto-renew is on but billing failed silently, leaving the domain stuck in a grace period. Script polls RDAP status and flags domains stuck past renewal.
DiagnosticTransfer blocked by registrar lock near expiry
RDAP shows an approaching expiry plus a clientTransferProhibited lock blocking renewal or transfer. Script parses RDAP status codes and expiration together.
DiagnosticProvider API / Reconciliation
6 guidesDNS-managed record overwritten without ownership check
An automated DNS tool overwrites or silently reassigns a record it does not own, causing unpredictable drift. Script diffs intended versus live records before writing and checks ownership markers.
ReconcilerDuplicate record write rejected by provider API
Creating a record where one already exists at that name and type errors out. Script lists existing records before writing and upserts instead of blindly creating.
ReconcilerStale ACME challenge TXT record blocks renewal
A leftover or already-deleted _acme-challenge TXT record leaves certificate renewal stuck in a retry loop. Script detects and clears stale challenge records past a timeout.
ReconcilerAPI token missing required scope blocks DNS automation
An API token lacks zone-read or zone-list permission, breaking automated record writes for certificate validation. Script pre-flight-checks token scopes before attempting writes.
DiagnosticZone lookup fails to resolve the correct managed zone
Automation cannot auto-detect which hosted zone owns a subdomain, aborting a DNS-01 challenge. Script walks up the label tree to find the correct zone before writing.
DiagnosticDuplicate record set falsely flagged as conflict
Dedup logic misflags legitimate multivalue or weighted record sets as duplicates, blocking valid changes. Script replicates correct dedup logic using name, type, and set identifier.
ReconcilerFighting a DNS or email deliverability problem right now?
If you have a DNS, email authentication, DNSSEC, or certificate problem you would rather hand off, this is the kind of work I do. Message me and we can work through it together.
Found this useful?
These guides are free and always will be. If one saved you a support ticket or a refund, you can throw a coffee my way. It keeps the notes coming.
Buy me a coffee on Ko-fi