Domain troubleshooting

Start with the domain's status in Project settings → Domains; the row shows the last error. Then work through the layers in order: DNS, project assignment, certificate, deployment, and your app. For what each status means, see Domain statuses.

Stuck on Needs DNS records

dig example.com NS
dig example.com A
dig www.example.com CNAME

Check that:

• The record is at the authoritative DNS provider named by the NS records, not only at your registrar
• An apex uses an A record to the edge IP shown in the dashboard, and a subdomain uses a CNAME to its own target, exactly as the dashboard shows it. A target copied from another domain, or from before the domain was removed and added again, doesn't verify
• The hostname has no typo, and the Name field didn't double the apex (www.example.com.example.com)
• No conflicting A, AAAA, or CNAME records exist at the same name
• A proxy isn't hiding the record; switch it to DNS-only
• Enough time has passed for cached answers to expire, especially after a nameserver change

Broken DNSSEC delegation, such as a stale DS record after changing DNS providers, can stop the domain resolving at all.

Certificate stays pending

If the domain sits on Issuing certificate, check:

dig example.com CAA

• CAA records permit letsencrypt.org
• No proxy intercepts HTTP-01 validation
• DNSSEC validates
• You haven't hit a Let's Encrypt rate limit

See HTTPS and TLS.

Browser shows a certificate warning

Traffic reached an endpoint without a certificate for that exact hostname. Check that:

• You added this exact hostname; example.com and www.example.com are separate
• The domain is Live
• No old AAAA record sends IPv6 visitors elsewhere
• A proxy isn't serving its own certificate
• Local network or security software isn't intercepting TLS

Certificate doesn't renew

Renewal needs the same conditions as issuance: the domain still assigned, DNS still pointing at Easel, and CAA and any proxy still allowing validation. If the status went back to Needs DNS records, fix DNS and renewal resumes.

DNS is right but Easel returns an error or 404

Check that:

• The domain is on the intended project
• The project has a Ready Production deployment that's Current
• The project isn't paused and the workspace isn't suspended
• A proxy isn't rewriting the Host header
• Your app accepts the hostname and has a route for the path

Easel returns not found for hostnames that aren't assigned to any project. If the project's Easel-provided production URL fails too, the problem isn't DNS; see Deployment troubleshooting.

HTTP doesn't redirect to HTTPS

Confirm the domain is Live, then look for a proxy or custom redirect that handles the HTTP request before it reaches Easel.

Redirect loop

curl -I -L --max-redirs 10 https://example.com

Look for reciprocal domain redirects, framework redirects or middleware, authentication middleware, and proxy or CDN rules. A proxy that connects to Easel over HTTP while both sides force HTTPS loops forever; have it connect over HTTPS. Browsers also cache 301 and 308 redirects and HSTS, so test in a private window.

Some visitors see the old site

• Resolvers on some networks still cache the old answer
• An old A or AAAA record remains
• A proxy, browser cache, or service worker serves old content
• The domain is correct, but an older deployment is still Current

Compare answers from several resolvers and test the deployment URL directly.

Email stopped working

Connecting a website never requires removing email records. Restore missing MX, SPF, DKIM, and DMARC records at the authoritative DNS provider:

dig example.com MX
dig example.com TXT
dig selector._domainkey.example.com TXT
dig _dmarc.example.com TXT

Domain is in use by another workspace

Another workspace holds the domain, hosts an Easel DNS zone for it, or removed it while its DNS still points at Easel. Add the record the dashboard shows at the domain's DNS provider, then select Verify and add. For a subdomain that's a CNAME to the target shown for your claim; for an apex or a zone, a TXT record:

dig docs.example.com CNAME
dig _easel.example.com TXT

The value must match the dashboard exactly. If you don't control the domain's DNS, you can't add it. See Domain ownership.

Domain disappeared from the project

Another workspace proved it controls the domain's DNS, so the domain moved there. Your workspace's owners and admins get an email when that happens. If you still control the domain, check who can edit its DNS records.

Sign-in fails after moving to the domain

Add the HTTPS domain to your OAuth provider's callback URLs and your app's trusted origins, such as https://example.com/auth/callback.

Contact support

Include:

• Workspace, project, and exact hostname
• The domain status and last error in the dashboard
• The deployment ID you expect to be Current
• Your DNS provider, and whether a proxy is on
• dig and curl -I output
• When it happened, the visitor's region, and whether it affects IPv4, IPv6, HTTP, or HTTPS