DNS misconfiguration
Wrong A/AAAA records, missing CNAMEs, stale nameservers after migration, MX records pointing to the wrong host. Symptoms: site loads for some users, email bounces, mail-from domain mismatch.
Domain field guide
Common Domain Problems and Solutions (Field Guide)
From DNS misconfigurations to expired SSL, transfer locks, and ownership disputes — a field guide to the domain problems that actually break production, with the exact tools to diagnose each.
Quick summary
- Most outages trace back to DNS, SSL, or registrar status.
- WHOIS reveals expiry, status codes, and nameserver mismatches.
- Lower TTL before changes; verify with multi-region DNS lookups.
- Document recovery so the next incident takes minutes, not hours.
Expired or invalid SSL
Expired certs, missing intermediates, name mismatches, or a CAA record that blocks your CA. Symptoms: full-page browser warning, dropped API calls, mobile apps failing silently.
Ownership and transfer issues
Locked transfers, expired registrant emails, GDPR-redacted contacts, and disputes over recently dropped domains. WHOIS status codes (clientTransferProhibited, pendingDelete, redemptionPeriod) tell you exactly where you are in the lifecycle.
Reputation damage
Compromise → blacklist → email and search visibility collapse. Recovery means fixing the cause, then submitting delisting requests with evidence.
Troubleshooting workflow
Run through these steps in order. Each step links to the right diagnostic tool.
- 1
- 2
- 3
- 4
Check blacklist & reputation
Catch reputation issues that block traffic at the edge.
Open Blacklist Checker - 5
Recommended next steps
Frequently asked questions
My domain expired — can I still recover it?
Usually yes during a 30-day grace period at the registrar, then a 30-day redemption window with a fee. After that it goes back to the registry.
Why won't my domain transfer?
Common blocks: clientTransferProhibited status, missing auth code, recent registration (<60 days), or expired contact email at the losing registrar.
DNS changes aren't taking effect — why?
TTL caching at recursive resolvers. Lower the TTL before changes, then change records. Propagation usually completes within an hour.
My SSL works in my browser but not for users — why?
Almost always an incomplete certificate chain. Servers must send the intermediate, not just the leaf cert.
Monitor it continuously
Save this check, get alerts on changes, and track multiple domains in one dashboard.