If a newly purchased domain will not open, first identify the browser error, then verify registration and nameserver delegation, inspect the authoritative DNS records, confirm that the hosting account accepts the domain, and only then troubleshoot HTTPS. A registered domain is not automatically connected to a website: the registrar must delegate DNS correctly, DNS must point the apex and any www hostname to the right origin, and the host must be configured to serve that name.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What a newly configured domain needs before a page can load
Four separate systems have to line up:
- Registration: the domain is active at the registrar and has not expired or been placed on hold.
- Delegation: the registrar publishes the authoritative nameservers supplied by your DNS provider.
- DNS records: those nameservers return an address for the hostname visitors enter, such as
example.comorwww.example.com. - Origin and TLS: the hosting account is configured for the custom domain, and its web server and certificate answer for the requested hostname.
Failure at one layer can look like failure at another. For example, a browser may show a DNS error even though the hosting account is healthy, or a domain may resolve correctly while the host returns a default page because the custom domain was never attached to the account.
As an Amazon Associate I earn from qualifying purchases.
Start with the exact browser error
Do not begin by changing records at random. The message identifies which layer to test first. Also check the spelling and the complete hostname in the address bar: the apex (example.com) and www.example.com are different DNS names.
| Browser result | What it usually tells you | First check |
|---|---|---|
DNS_PROBE_FINISHED_NXDOMAIN |
The DNS lookup completed, but the resolver determined that the requested domain has no associated DNS records. Cloudflare defines NXDOMAIN this way. | Verify the hostname, registration, nameserver delegation, and the record for that exact name. |
DNS_PROBE_POSSIBLE |
Often indicates a missing or incorrect DNS record. | Inspect the authoritative records for the apex and www. |
SERVFAIL |
A resolver could not validate or obtain an answer. Incorrect DNSSEC delegation is a common cause when nameservers have just been changed. | Check the registrar’s DS record, DNSSEC status, and authoritative nameserver health. |
| Page cannot be reached, connection refused, or timeout after the name resolves | DNS may be working, while the origin server, firewall, port, or host configuration is not. | Confirm the hosting target and that the account accepts the custom domain. |
| Provider parking page or a generic “site not found” page | The request reached a server, but it is not serving your site for that hostname. | Attach the domain at the host and compare the DNS target with the host’s current infrastructure. |
| HTTP works but HTTPS fails, loops, or warns about a certificate | DNS and the origin may be correct; the certificate, proxy mode, or redirect is incomplete. | Test both hostnames over HTTPS and verify certificate coverage and proxy settings. |
Fix the domain in the right order
1. Confirm the hostname you are testing
Type the exact address your DNS records cover. A record for example.com does not automatically create one for www.example.com, and the reverse is also true. Test both explicitly in a browser and with DNS queries. Remove accidental spaces, misspellings, and an incorrect top-level domain from your test.
#1 Best Overall
2. Confirm that the domain is registered and delegated
Log in to the registrar and verify that the registration is active, the domain is not expired or suspended, and the nameserver fields contain the exact authoritative nameservers supplied by your DNS provider. Cloudflare warns that if the registrar’s nameservers do not exactly match the assigned Cloudflare nameservers, the domain will not resolve correctly. Delete unintended extra nameservers; a mixed set can send different resolvers to servers that do not contain the same zone.
Some registrars may take up to 24 hours to publish a nameserver change, according to Cloudflare’s 2026 documentation. That is an upper allowance for publication by some registrars, not a guarantee that every change takes that long. Continue checking from more than one resolver instead of repeatedly editing the configuration.
3. Check NS and SOA before checking the website record
The NS (name server) response shows which servers are authoritative. The SOA (start of authority) response confirms that an authoritative zone is answering. If either response is missing or inconsistent, an A record change will not solve the problem.
From a terminal, replace example.com with your domain:
dig NS example.com
dig SOA example.com
dig +trace example.comCompare the names returned by dig NS with the names entered at the registrar. dig +trace follows delegation from the root and top-level-domain servers and can reveal where the chain breaks. Google recommends checking DNSSEC, authoritative nameserver health, delegation, and response behavior with tools such as dig and DNSViz. Cloudflare likewise requires valid NS and SOA responses when a domain is added.
4. Verify the apex record
Query the address records for the bare domain:
dig A example.com
dig AAAA example.comThe returned A or AAAA value must be the address of the current hosting origin, or the value explicitly required by your hosting provider. If the provider uses a CNAME-style setup for the apex, follow its documented method rather than inventing an address. Remove obsolete A or AAAA records that send some visitors to an old server; different answers can make the site appear intermittently broken.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →5. Verify the www record separately
Visitors often type www. even when you normally advertise the bare domain. Query it directly:
dig A www.example.com
dig AAAA www.example.com
dig CNAME www.example.comAdd the www A, AAAA, or CNAME record required by the host. Cloudflare notes that a www DNS record helps visitors who type that hostname find the site. Decide which hostname is canonical and configure a deliberate redirect only after both names reach the intended service.
6. Allow for caching and test from another network
Resolvers cache NS and record responses for their time-to-live. After changing delegation or records, compare results from your home connection, a mobile connection, and an independent DNS checker. A single local result can be stale while another resolver already sees the new delegation. Do not lower the TTL after the failure and expect an immediate global change; caches must still age out the previous response.
7. Investigate DNSSEC when the result is SERVFAIL or the setup remains pending
A DNSSEC chain contains a DS record at the registrar that points to the signing key at the authoritative DNS provider. If you change nameservers while an old DS record remains, validators can reject otherwise valid responses. Cloudflare states that a pre-existing DS record at the registrar must be removed before changing to its authoritative nameservers. After the migration works, enable DNSSEC again at the provider that now hosts the authoritative zone and publish the new DS value through the registrar.
Do not remove DNSSEC casually on a stable domain. First establish whether the DS record belongs to the previous provider and whether the new provider has supplied replacement signing information. Use a DNSSEC-aware checker such as DNSViz to identify a broken chain.
8. Separate DNS from the hosting origin
If dig returns the expected address but the browser shows a blank page, refusal, timeout, or provider default page, stop editing DNS and inspect the hosting account. Add the custom domain in the host’s control panel, select the correct site or virtual host, and confirm that the DNS target is the host’s current infrastructure. Google Search Central’s site-move guidance specifically says to change DNS to point to the new hosting infrastructure after a hosting move.
Rank #4
A correct DNS response only proves that visitors can find an IP address or hostname. It does not prove that the web server has a site configured for the Host header, that the application is running, or that a firewall allows HTTP and HTTPS traffic. If your host recently migrated servers, compare the published target with the migration instructions and remove records for the retired server.
9. Finish with HTTPS, redirects, and hostname coverage
Test all four combinations deliberately: http://example.com, https://example.com, http://www.example.com, and https://www.example.com. The certificate must include every hostname you expect visitors to use. A certificate for only www.example.com will not validate example.com.
If HTTPS loops, check whether both the hosting server and a proxy are forcing redirects, or whether the proxy’s encryption mode disagrees with the origin. Cloudflare documents that A, AAAA, and CNAME records may require appropriate proxy settings. Change one setting at a time, clear the browser’s cached redirect if necessary, and retest each hostname. Do not treat a browser certificate warning as a DNS failure when the DNS answer is already correct.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Useful checks and how to read them
| Command | Expected evidence | If the result is wrong |
|---|---|---|
dig NS example.com |
The exact authoritative nameservers listed by your DNS provider. | Correct the registrar’s delegation and remove unintended servers. |
dig SOA example.com |
An SOA record returned by an authoritative server. | The zone may not exist at the delegated provider or delegation is incomplete. |
dig A example.com and dig AAAA example.com |
The current origin’s IPv4 and IPv6 addresses, when used. | Replace stale, missing, or contradictory records with the host’s required values. |
dig CNAME www.example.com |
The target hostname specified for www, when the host uses a CNAME. |
Create or correct the www mapping; do not assume the apex record covers it. |
dig +trace example.com |
A continuous delegation path from the root to the authoritative zone. | Identify the exact handoff where NS, DNSSEC, or authority responses diverge. |
Run the same query against a public resolver when you need to compare caches, for example dig @1.1.1.1 A example.com and dig @8.8.8.8 A example.com. Those commands test what those resolvers currently know; they do not bypass an incorrect authoritative configuration.
Common symptoms and the shortest recovery path
“I changed nameservers, but the domain still says NXDOMAIN”
- Confirm the registrar saved the exact nameservers and that no old nameserver remains.
- Query NS and SOA. If the old servers answer, wait for delegation caches or correct the registrar entry.
- Once the new authority answers, create the apex and
wwwrecords in that DNS provider’s zone. - Check DNSSEC for an old DS record if some resolvers return
SERVFAIL.
“The bare domain works, but www does not”
- Query
www.example.comdirectly. - Add the host-required A, AAAA, or CNAME record for
www. - Attach both hostnames to the hosting account and certificate, then choose one canonical redirect.
“The domain resolves, but I see a parking or default page”
- Compare the DNS answer with the host’s current origin address or target.
- Attach the custom domain to the correct site, project, or virtual host at the host.
- Remove records pointing at an old provider or an unused parking service.
“HTTP works, but HTTPS fails”
- Verify that the certificate includes the exact apex and
wwwnames being tested. - Check that the host has completed certificate issuance and that the origin serves the certificate on port 443.
- Review proxy and redirect modes so that the proxy and origin expect the same encryption behavior.
How to choose a registrar, DNS provider, or host for a new domain
Changing providers cannot repair a wrong record by itself, but service design affects how quickly you can diagnose and recover. Compare providers on these practical capabilities:
| Capability | Why it matters | Questions to ask |
|---|---|---|
| Control of authoritative DNS | You need to know which account actually serves the zone. | Does the registrar host DNS, or do you delegate to a separate provider? |
| Record visibility and editing | Clear A, AAAA, CNAME, NS, SOA, and TTL displays reduce mistakes. | Can you inspect the full zone and see validation or propagation status? |
| DNSSEC support | Signing improves authenticity but requires coordinated DS management during migrations. | Can the service create keys, show DS values, and explain a nameserver move? |
Apex and www mapping |
Visitors use both hostnames. | Does the host document the required apex method and www target? |
| Certificate coverage | Each hostname needs valid TLS coverage. | Are certificates issued automatically for both the apex and www? |
| Propagation and incident visibility | Status information distinguishes a local cache from a real outage. | Are nameserver changes, validation errors, and service incidents reported? |
| Custom-domain support at the origin | DNS can point correctly while the server still rejects the hostname. | Can you attach the domain to the exact site, project, or virtual host? |
Prevent the next domain setup failure
- Record the intended authoritative nameservers and the final A, AAAA, and CNAME values before making changes.
- Keep an inventory of both the apex and
wwwhostname, including which one redirects to the other. - When moving hosts, lower TTLs before the move if the provider recommends it, then change DNS to the new infrastructure and remove retired targets after verification.
- Document the DNSSEC DS value and the order required to disable or re-enable signing during a nameserver migration.
- After every change, check NS, SOA, apex,
www, HTTP, and HTTPS from at least two networks. - Save the host’s current origin target and certificate requirements so a default page or TLS warning can be distinguished from a DNS outage.
The reliable diagnosis is layered: an NXDOMAIN or missing NS/SOA response is a delegation or DNS-zone problem; a valid DNS answer followed by a default page is an origin configuration problem; and a valid HTTP response with a certificate or redirect error is an HTTPS configuration problem. Test that layer before changing the next one.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
