# Troubleshoot websites and DNS

> Fixes for domains that do not resolve, records the API refuses, certificates that fail and registrations that stall.

Source: https://www.coritan.com/docs/websites/troubleshooting/

Most checks here use `dig`. Add `@ns1.coritan.com` to ask Coritan's nameserver directly, which skips the answers that resolvers keep in their cache.

## The domain does not resolve

Check which nameservers answer for the domain:

```bash
dig example.com NS +short
```

If the answer does not list Coritan's nameservers, `ns1.coritan.com` to `ns8.coritan.com`, resolvers never ask Coritan. Set the nameservers at the domain's registrar ([Add a domain you already own](/docs/websites/add-an-existing-domain/)), or on the **Settings** tab for a domain registered with Coritan ([Change a domain's nameservers](/docs/websites/domains/change-nameservers/)).

If Coritan's nameservers are listed, ask one for the name:

```bash
dig @ns1.coritan.com www.example.com A
```

An `NXDOMAIN` status means the zone has no record at that name. Add one on the **DNS** tab ([Add, edit and delete DNS records](/docs/websites/dns/manage-dns-records/)).

## Coritan's nameservers answer REFUSED

Coritan's nameservers refuse queries for a domain that has no active zone here. The zone was never added, was deleted, or is suspended with its service. The **DNS zone** card on the domain's **Settings** tab shows a suspended zone's status. [Failed payments and suspended services](/docs/billing/failed-payments/) explains how to get a service running again.

## Resolvers answer SERVFAIL

A resolver that checks DNSSEC answers `SERVFAIL` when the DS record at the registrar does not match the zone's key. To confirm, ask with checking turned off:

```bash
dig example.com A +cd +short
```

If this gives an address while a plain query gives `SERVFAIL`, DNSSEC is the cause. Replace the DS records at the registrar with the ones on the **DS records for the registrar** card, and delete any DS record left by a previous DNS provider ([Set up DNSSEC](/docs/websites/dns/dnssec/)). A zone you delete and add again gets new keys, so it needs new DS records too.

## A change to a record does not show up

Coritan's nameservers answer with a change as soon as you save it. Resolvers that cached the old answer keep it until its TTL runs out. Compare the answer from `ns1.coritan.com` with your resolver's, and lower the TTL before your next planned change ([TTL](/docs/websites/dns/#ttl)).

## The dashboard or the API refuses a record

The error names the rule the record breaks, such as a `CNAME` at `@` or a name that a load balancer owns. [Add, edit and delete DNS records](/docs/websites/dns/manage-dns-records/#troubleshooting) lists each error with its fix, and [DNS record types](/docs/websites/dns/record-types/) gives the format for each type.

## An imported zone file has missing or doubled records

The import skips lines it cannot read and adds every record beside the ones the zone already has. [Import and export a zone file](/docs/websites/dns/import-and-export-a-zone-file/#troubleshooting) explains what it reads and how to fix a file.

## A load balancer answers with the wrong origin or with nothing

Open the load balancer's preview on the **Load balancing** tab to see which pool answers and why. [Create a load balancer](/docs/websites/load-balancing/create-a-load-balancer/#troubleshooting) and the [preview results](/docs/websites/load-balancing/reference/#preview-results) explain each outcome.

## A certificate does not issue

The **SSL** tab shows the reason under **The last request failed**. The usual causes are a CAA record that does not allow Coritan's certificate authorities, a name that does not point at Coritan's edge for HTTP validation, and a `TXT` record that is missing or has the wrong value. [Issue a certificate](/docs/websites/ssl/issue-a-certificate/#troubleshooting) lists each error with its fix.

## A certificate did not renew

A certificate validated with a manual `TXT` record cannot renew on its own, and any renewal fails when validation no longer works. [Renew or revoke a certificate](/docs/websites/ssl/renew-or-revoke-a-certificate/#troubleshooting) explains what to do before the **Expires** date.

## Visitors see a certificate warning

The edge has no valid certificate for the exact name the visitor opened. A certificate for `example.com` does not cover `www.example.com`, so each name needs its own. Check the name's certificate on the **SSL** tab, and [issue one](/docs/websites/ssl/issue-a-certificate/) if it has none.

## Visitors see "This domain is not assigned to any active service on our network"

The name resolves to Coritan's edge, but no web proxy serves it. This happens after you delete a web proxy while the name's record stays proxied. [Create a web proxy](/docs/proxies/web-proxies/create-a-web-proxy/) for the name, or turn **Proxied** off for its record on the **DNS** tab so the name resolves to your own address.

## Visitors see a page from the web application firewall

The WAF refused the request, or asked the visitor to prove they are human. [Protect a website with the WAF](/docs/websites/waf/#troubleshooting) explains both pages and what you can change.

## A registration stays at pending_transfer

Coritan does not move a transfer out of `pending_transfer` by itself. When your old registrar confirms that the domain has left, [contact support](/docs/support/) so the registration can be made active ([Transfer a domain to Coritan](/docs/websites/domains/transfer-a-domain-to-coritan/)).

## You cannot renew a domain or change its settings

Renewing, the switches, the nameservers and the EPP code need the registration to be `active`. While it is `expiring_soon`, `expired` or `pending_transfer`, the dashboard cannot change them. [Contact support](/docs/support/) if you need to ([Statuses](/docs/websites/domains/#statuses)).