What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A broken subdomain is usually a failure at one of four layers: DNS, network access, web-server host matching, or the application behind a reverse proxy. Check those layers in that order. Resolve the exact hostname from outside the VPS, confirm ports 80/443 are open and listening, add the subdomain to the correct Nginx or Apache virtual host, test the upstream application locally, and only then issue or repair its TLS certificate.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Use this three-minute diagnostic order
- DNS: verify that the exact subdomain has an authoritative A, AAAA or CNAME record and that it ultimately targets the intended VPS.
- Reachability: confirm the VPS and its hosting-provider firewall permit TCP 80 and/or 443, and that a service is listening on those ports.
- Host matching: configure the exact fully qualified domain name (FQDN) in Nginx
server_nameor ApacheServerName/ServerAlias. - Application: if the web server proxies to an app, test that app on its local address and port.
- HTTPS: after HTTP works, obtain a certificate containing the subdomain and verify the 443 virtual host and SNI selection.
Changing web-server files before DNS resolves wastes time: a browser cannot reach Nginx or Apache when the hostname has no usable DNS answer. Work from the public Internet, not only from a shell on the VPS, because local resolver caches and split-horizon DNS can hide the real failure.
As an Amazon Associate I earn from qualifying purchases.
1. Verify the authoritative DNS record
At the DNS provider that is authoritative for your domain, create or correct a record for the exact label, such as status.example.com. Cloudflare’s documentation states that the hosting provider must be able to serve the hostname before you create an A, AAAA or CNAME record: create a subdomain record (updated April 16, 2026).
Choose the appropriate record type
| Record | Target | Use it when | Important check |
|---|---|---|---|
| A | IPv4 address, for example 203.0.113.20 |
The subdomain should connect directly to the VPS over IPv4. | The address must be the VPS’s current public IPv4, not a private address such as 10.0.0.5. |
| AAAA | IPv6 address, for example 2001:db8::20 |
The VPS is configured to accept IPv6 traffic. | An incorrect AAAA record can make IPv6 clients fail even when the A record is correct. Remove it until IPv6 routing and firewall rules are ready. |
| CNAME | Another hostname, for example edge.example.net |
You want the subdomain to follow another hostname’s address. | Do not use a CNAME and another record at the same name. Resolve the target hostname and confirm it eventually reaches the VPS. |
Check the zone’s authoritative nameservers first. If the domain was recently moved, the registrar may still delegate to old nameservers, so editing a record at the wrong provider has no effect.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Query from outside the VPS
Run these commands from a workstation or another server:
dig +short status.example.com A
dig +short status.example.com AAAA
dig +short status.example.com CNAME
dig +trace status.example.comThe A and AAAA queries should return only addresses you expect to serve. A CNAME query should return the alias; query that alias separately to verify its final address. dig +trace follows delegation from the DNS root and shows where an answer disappears or becomes stale. Compare the result from a public recursive resolver with the authoritative nameserver shown by dig NS example.com:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstalldig @1.1.1.1 status.example.com A
dig @8.8.8.8 status.example.com A
dig @authoritative-nameserver status.example.com AIf the authoritative server has no record, fix the zone or delegation. If it has the new address but public resolvers still show the old one, wait for the record’s TTL and clear local DNS caches; do not alter Nginx or Apache yet. A hostname that returns no address produces errors such as DNS_PROBE_FINISHED_NXDOMAIN or “server not found” before any request reaches the VPS.
2. Confirm ports, listeners and firewalls
Once DNS returns the VPS address, test whether the machine can accept traffic. The VPS operating-system firewall and the hosting provider’s network firewall are separate controls; both must allow the needed port.
Inspect listeners on the VPS
sudo ss -ltnp | grep -E ':(80|443)b'You should see Nginx, Apache or another intended service bound to 0.0.0.0:80/0.0.0.0:443 and, when IPv6 is enabled, [::]:80/[::]:443. A listener bound only to 127.0.0.1 accepts local requests but cannot receive Internet traffic directly.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
For systems using UFW, inspect and allow the required ports:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemssudo ufw status verbose
sudo ufw allow 80/tcp
sudo ufw allow 443/tcpUse the equivalent rules for firewalld, nftables or your distribution’s firewall. In the VPS control panel, check inbound rules or security groups for TCP 80 and 443 from the Internet. A cloud firewall rule that permits only your office IP will make the site appear down to everyone else.
Test from an external network
curl -I http://status.example.com
curl -vk https://status.example.comA timeout generally indicates a dropped packet, blocked firewall or wrong address. “Connection refused” usually means the address is reachable but no process is listening, or a firewall is actively rejecting the connection. Test the VPS address directly to separate DNS from networking:
curl -I -H 'Host: status.example.com' http://203.0.113.20This request still needs a web server on port 80, but bypasses DNS. If it fails while DNS points correctly, stay in the network and listener layer.
3. Make the web server select the subdomain
When the main site appears at the subdomain, DNS and networking are usually working. The request reached the server, but no virtual host matched the HTTP Host header, so the default site handled it.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Nginx: exact server_name matching
Nginx selects a server block using the request name and port. If no server_name matches, it uses the default server for that port. See the Nginx documentation on server-name selection and the web-server configuration guide.
Create or edit a dedicated HTTP block, using the exact FQDN:
server {
listen 80;
listen [::]:80;
server_name status.example.com;
root /var/www/status;
index index.html;
location / {
try_files $uri $uri/ =404;
}
}Do not put the subdomain only in a comment or in an unrelated file that Nginx never includes. If you need several names, list them explicitly, for example server_name status.example.com www.status.example.com;. Remove an unintended wildcard or duplicate block that captures the request first.
Validate and reload safely:
sudo nginx -t
sudo systemctl reload nginxThen test the selected content:
curl -sS -D - -o /dev/null -H 'Host: status.example.com' http://127.0.0.1Review the access and error logs while making a request. A response from the wrong document root confirms host matching or root configuration, not DNS.
Free tools Windows power users keep installed
One-click scans. No signup required.
Apache: ServerName, aliases and parsed vhosts
For Apache, define the name in a name-based virtual host. A minimal HTTP block is:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
<VirtualHost *:80>
ServerName status.example.com
DocumentRoot /var/www/status
<Directory /var/www/status>
Require all granted
</Directory>
</VirtualHost>Add ServerAlias only for additional names that should serve the same site. HTTPS requires a corresponding <VirtualHost *:443> with the same hostname, certificate paths and proxy or document-root settings. Enable the site and modules required by your distribution, then inspect Apache’s parsed view:
sudo apachectl -S
sudo apachectl configtest
sudo systemctl reload apache2The apachectl -S output shows which virtual host is default, which file defined each name and whether the intended 80/443 blocks are loaded. Apache documents these directives and diagnostics in its name-based virtual-host guide.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →4. Test a reverse-proxy application separately
If Nginx or Apache forwards requests to Node.js, Python, PHP-FPM or another service, test the upstream without involving DNS or TLS. For an app expected on port 3000:
curl -i http://127.0.0.1:3000
sudo ss -ltnp | grep ':3000b'
sudo systemctl status your-app.serviceA healthy local response proves the process is running and reachable on that address. A failure means the process is stopped, listening on another port or socket, bound to the wrong interface, or blocked by a local policy. Correct the proxy target only after confirming the actual bind address.
Interpret proxy responses
- 502 Bad Gateway: the proxy could not connect to the upstream, commonly because the process is down, the port is wrong or a Unix-socket path is invalid.
- 504 Gateway Timeout: the upstream accepted or attempted the request but did not answer within the proxy timeout; inspect application logs and long-running operations.
- Main site or a static default page: the request likely matched the wrong virtual host before proxying.
- DNS error: the request never reached the proxy or application.
Check the Nginx error log or Apache proxy log at the same time as the request. Keep the upstream bound privately when possible, such as 127.0.0.1:3000, and expose only the web server’s public ports.
5. Repair HTTPS only after HTTP works
HTTPS adds certificate validation and TLS virtual-host selection. First confirm that http://status.example.com resolves to the VPS and returns the intended site.
Choose the ACME challenge that fits your network
| Challenge | Prerequisite | Use when | Typical failure |
|---|---|---|---|
| HTTP-01 | The validation service must reach TCP 80 at the hostname and retrieve the challenge path. | Port 80 is publicly open and the hostname points directly to this web server. | Port 80 is blocked, redirected incorrectly or DNS points elsewhere. |
| DNS-01 | You control authoritative DNS and can publish a TXT record under _acme-challenge.status.example.com. |
The server is not publicly reachable on port 80 or a wildcard certificate is needed. | The TXT record is missing, placed at the wrong zone or not yet visible to authoritative nameservers. |
Certbot describes HTTP-01 and DNS-01 validation, including the port and TXT-record requirements, in its usage documentation. Once DNS and HTTP are correct, the web-server integrations can request a certificate:
sudo certbot --nginx -d status.example.com
sudo certbot --apache -d status.example.comUse only the command for the server you actually run. Read the proposed changes before applying them, and verify renewal with your distribution’s scheduled timer or cron configuration.
Check certificate names and SNI
A certificate must contain the exact subdomain in its Subject Alternative Name, or a wildcard that legitimately covers it. Inspect the served certificate:
openssl s_client -connect status.example.com:443 -servername status.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltNameNginx explains that TLS is established before the browser sends an HTTP request, so the server may choose a default certificate when several HTTPS sites share one IP and the requested name is not selected correctly: Configuring HTTPS servers. Ensure the 443 block includes the same hostname and the matching key pair:
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name status.example.com;
ssl_certificate /etc/letsencrypt/live/status.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/status.example.com/privkey.pem;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}If HTTP works but HTTPS shows the main site’s certificate, check the 443 server_name, certificate paths, enabled configuration files and whether an older default 443 block is winning. If the certificate is correct but the app generates HTTP links or redirect loops, preserve the original scheme with the proxy headers and configure the application to trust the proxy according to its own documentation.
Error message to layer map
| Symptom | Most likely layer | First check |
|---|---|---|
DNS_PROBE_FINISHED_NXDOMAIN or “server not found” |
DNS record or delegation | Authoritative A/AAAA/CNAME records and nameservers with dig +trace. |
| Connection timeout | Firewall, closed port or wrong address | Provider firewall, OS firewall, listener output and external curl. |
| Connection refused | No service on the destination port | ss -ltnp, service status and bind address. |
| The main website appears | Virtual-host matching | Nginx server_name, Apache ServerName, enabled files and default-host order. |
| 502 Bad Gateway | Reverse-proxy upstream | Local curl to the app, process status, port/socket and proxy target. |
| Certificate name mismatch or wrong certificate | Certificate coverage or SNI | Subject Alternative Names, 443 hostname, certificate path and duplicate default blocks. |
| Certbot challenge failure | Validation path | HTTP-01 reachability on port 80, or DNS-01 TXT placement and authoritative visibility. |
Complete recovery procedure
- Write down the exact hostname, intended IPv4/IPv6 addresses and whether the service is static or proxied.
- Run A, AAAA, CNAME and trace queries from a network outside the VPS. Correct authoritative DNS and delegation first.
- Remove an incorrect AAAA record if IPv6 is not configured; otherwise open IPv6 in the provider and OS firewalls and test it deliberately.
- Confirm that the VPS provider permits inbound TCP 80 and 443, then confirm the OS firewall does too.
- Use
ssand service status commands to verify listeners and restart a stopped web server. - For Nginx, add the FQDN to the intended HTTP and HTTPS
serverblocks, runnginx -tand reload. For Apache, setServerName, add required aliases, runapachectl -Sandapachectl configtest, then reload. - Request the hostname with a
Hostheader and inspect logs to prove that the correct virtual host handled it. - Test the application locally if a proxy is involved; repair the process, port, socket or proxy target when that test fails.
- Issue or renew the certificate with HTTP-01 only when port 80 is reachable, or complete DNS-01 with the authoritative TXT record.
- Use
openssl s_clientwith-servernameto verify the certificate and then test both HTTP and HTTPS from an external network.
Nginx versus Apache for subdomain troubleshooting
| Question | Nginx | Apache |
|---|---|---|
| Hostname directive | server_name inside a server block. |
ServerName inside <VirtualHost>; use ServerAlias for additional names. |
| Configuration check | sudo nginx -t |
sudo apachectl configtest |
| Parsed host diagnostic | Review included files, default-server declarations and access logs. | sudo apachectl -S displays parsed name-based virtual hosts. |
| Reverse proxy role | Often proxies to an app with proxy_pass; test the local upstream separately. |
Can proxy with its proxy modules; test the local upstream separately. |
| HTTPS selection | Matching 443 server_name, certificate and key are required. |
Matching 443 ServerName, certificate and key are required. |
The diagnostic logic is the same regardless of server: DNS must reach the machine, the port must accept traffic, the hostname must select the intended virtual host, and the upstream must answer before TLS and application behavior can be trusted.
When to use managed DNS
A managed DNS service can simplify authoritative nameserver changes, record history and access controls, but it does not replace the VPS configuration. After moving DNS, verify the delegation at the registrar, then query the new authoritative nameservers directly. Keep a written inventory of every A, AAAA, CNAME and ACME TXT record so an old address or validation record is not accidentally restored. DNS management cannot open a blocked port, create a missing virtual host or repair a stopped application.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
