Start with the exact name and DNS status
Find the exact authority for the failed name, then distinguish an absent record, a missing address type and a broken delegated child zone.
For an intended name such as app.example.com, query A, AAAA and CNAME and read the full status. NXDOMAIN, NOERROR with no requested type and SERVFAIL describe different problems. Check whether the name was created only in a panel, misspelt or delegated to child servers that cannot answer.
This guide diagnoses DNS for an existing intended subdomain. A valid DNS answer does not prove the application or TLS endpoint works.
Act on NXDOMAIN, no address or failed delegation
If authoritative servers return NXDOMAIN, confirm that the record exists at the correct authority with the correct label. If NOERROR has no A or AAAA, look for a CNAME or a record type that does not provide a website address; do not add a second type without knowing the service requirement. If a CNAME exists, follow its target and check that it resolves; do not add A/AAAA alongside it at the same name. If a child delegation exists but its servers fail, ask the child-zone operator to correct its zone or the domain holder to correct delegation.
If app.example.com returns NOERROR with a TXT answer but no A answer, determine whether the application needs a separate A record; the empty A answer is not proof that the whole name is absent.
If direct authoritative answers are correct but recursive resolvers disagree, check previous TTL and negative caching before making a second edit. If both direct and recursive queries return SERVFAIL, use the DNSSEC/nameserver diagnostic path. A browser 404 or certificate warning after DNS resolves is an application or TLS problem, not a missing DNS record.
Make a bounded correction
At the actual authority, add or correct only the record the destination provider supplied, using its exact hostname or address. An A record needs the assigned IPv4 target; AAAA needs a working assigned IPv6 target; CNAME needs a valid destination name and cannot coexist with other data at the same owner. If the subdomain was intentionally delegated, repair its child zone rather than adding a competing record to the parent. Save the previous value and TTL.
Query the authoritative answer after saving, then a recursive resolver after cached responses have expired. Test the intended service with the exact hostname. If the correction misroutes traffic, restore the saved value and contact the DNS or application owner with query status, authoritative nameserver and timestamp. Do not change nameservers for one ordinary record without a full zone migration plan.
Common questions
Why does DirectAdmin show the subdomain but DNS says NXDOMAIN? DirectAdmin’s zone may not be authoritative.
Can an empty A answer still be valid DNS? Yes; the name may have another type such as CNAME.
Does a wildcard always catch the name? No. Explicit records and delegation can change the response.
Does NXDOMAIN from one recursive resolver prove the authoritative record is missing? No. Query the delegated servers and consider cached negative answers.
Sources and technical references
Related guides
Was this guide helpful?
If you accepted optional analytics, your Yes/No answer and this guide’s page address are sent to Google Analytics. No written feedback is collected. Read our privacy statement or change your choice in .
Need help with your service?
Open your client area or contact Novasean. Describe the symptom and checks you have performed. Keep passwords, recovery codes and private keys out of your message.