Domain troubleshooting

A custom domain can fail at several independent layers. Diagnose them in order:

1. DNS resolution
2. Project assignment
3. TLS certificate
4. Deployment routing
5. Application behavior

Domain status model

The dashboard exposes these primary statuses:

Also confirm the project has a Ready Current production deployment. A live domain still needs Current to serve application content.

The domain does not resolve

Check authoritative records:

dig example.com NS
dig example.com A
dig example.com AAAA
dig www.example.com CNAME

Possible causes:

• Record added at the wrong DNS provider
• Typo in the hostname
• Missing record
• Conflicting records
• Broken DNSSEC delegation
• Nameserver change still propagating
• Provider proxy or flattening behavior

Easel cannot verify the domain

Check:

• Apex domains use an A record to an Easel edge IP shown in the dashboard
• Subdomains use a CNAME to cname.easelusercontent.com
• The provider did not alter the value
• The record was added to the authoritative zone
• A proxy is not rewriting the A record during verification
• The Name field was not duplicated with the apex domain

DNS is correct but the domain shows an Easel error

Check that:

• The domain is assigned to the intended project
• The project has a Ready Production deployment that is Current
• The project is not paused
• The workspace is not suspended

Test the project's Easel-provided production URL. If that also fails, the problem is probably not DNS. See Deployment troubleshooting.

HTTPS certificate is pending

Check:

dig example.com CAA
dig example.com A
dig www.example.com CNAME

Possible causes:

• DNS does not point to Easel
• A proxy intercepts HTTP-01 validation
• CAA blocks Let's Encrypt (letsencrypt.org)
• Certificate-authority rate limit
• Broken DNSSEC

Disable DNS proxy until the certificate is live. See HTTPS and TLS.

Browser shows a certificate mismatch

A certificate mismatch usually means traffic reached an endpoint that does not have a certificate for the requested hostname.

Check:

• DNS records (A and AAAA)
• Proxy settings
• Exact domain assignment
• Whether www and apex were added separately
• Whether an old AAAA record sends IPv6 traffic elsewhere

Redirect loop

Inspect the response chain:

curl -I -L --max-redirs 10 https://example.com

Check for redirects in Easel domain settings, application middleware, framework configuration, Cloudflare or another proxy, authentication middleware, and browser HSTS or cached 301/308 responses.

Some users see the old site

Likely causes:

• DNS cache has not expired
• Resolver cache differs by network
• Old A or AAAA record remains
• Proxy cache serves old content
• Browser cache or service worker
• The domain points to the correct project but an old deployment remains Current

Compare answers from multiple resolvers and test the unique deployment URL.

Email stopped working

Connecting a website should not remove email records.

Check:

dig example.com MX
dig example.com TXT
dig selector._domainkey.example.com TXT
dig _dmarc.example.com TXT

Restore missing MX, SPF, DKIM, and DMARC records at the authoritative DNS provider.

Domain returns 404

A 404 can come from different layers:

• Easel does not recognize the hostname (unassigned or removed)
• The domain is assigned to the wrong project
• The current deployment has no matching application route
• A proxy rewrites the Host header
• The application rejects the hostname

Check response headers and compare the root path with a known application path.

Information to include with a support request

Include:

• Workspace and project
• Exact hostname
• Domain status shown in Easel
• Expected current deployment ID
• DNS provider
• Relevant dig output
• curl -I output
• Approximate time and user region
• Whether the issue affects IPv4, IPv6, HTTP, or HTTPS