# apex_a_mismatch

The apex domain's A records don't point to Apexly's addresses.

## What it means

An apex domain (`acme.com`, not `careers.acme.com`) cannot use a CNAME, so it points at us with A records. The A records we found are not exactly our addresses. If the domain was never live it stays in `pending_dns`; if it was live it moves to `dns_broken` and the existing certificate keeps serving cached visitors.

The full set of addresses is in `dns.apex.a` (and `dns.apex.aaaa`) in the domain object.

## Why it happens

- An old A record (the previous host, a parking page) was left next to ours. Every A record must be one of ours.
- The customer's provider added its own default records when the domain was registered.
- The zone has AAAA records pointing elsewhere. If the zone has any AAAA records they must be our IPv6 addresses.

## What to do

1. Open the domain in the dashboard: the Expected / Found card lists the addresses.
2. Ask the customer to set exactly those A records and remove every other A (and AAAA) record on the apex.
3. If they would rather not touch the apex, add `www.acme.com` as a CNAME domain instead and redirect the apex at their registrar.

- [Open this domain in the dashboard](/app/domains)
- [See the domain state machine](/docs/concepts/domain-states)

## In the API

```
"status": "pending_dns",
"status_reason":
  "apex_a_mismatch",
"status_detail": {
  "expected": {…},
  "found": {…}
}
```