Troubleshooting

apex_a_mismatch

The apex domain's A records don't point to Apexly's addresses.

Seen in pending_dns and dns_brokenFix is on the customer's sideAuto-recovers

What it means

An apex domain (acme.com, not careers.acme.com) cannot use a CNAME, so it points at us with A records. The A records we found are not exactly our addresses. If the domain was never live it stays in pending_dns; if it was live it moves to dns_broken and the existing certificate keeps serving cached visitors.

ExpectedA@ → 203.0.113.10

FoundA@ → 192.0.2.44

The full set of addresses is in dns.apex.a (and dns.apex.aaaa) in the domain object.

Why it happens

An old A record (the previous host, a parking page) was left next to ours. Every A record must be one of ours.
The customer's provider added its own default records when the domain was registered.
The zone has AAAA records pointing elsewhere. If the zone has any AAAA records they must be our IPv6 addresses.

What to do

Open the domain in the dashboard: the Expected / Found card lists the addresses.
Ask the customer to set exactly those A records and remove every other A (and AAAA) record on the apex.
If they would rather not touch the apex, add www.acme.com as a CNAME domain instead and redirect the apex at their registrar.

Was this helpful?

Edit this page