Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
If example.com works but www.example.com does not, the two names are not automatically equivalent. www is a subdomain that needs its own DNS record, an explicit hostname mapping at your web host, and a TLS certificate covering that exact name. Fix those layers in that order, then redirect one hostname to the other as your canonical address.
The same sequence applies to an NXDOMAIN response, a 404 or wrong website, an SSL name warning, a Cloudflare cipher error, or a redirect loop. Do not begin by changing random DNS records: first identify which provider is authoritative for the domain, then test DNS, hosting, redirects, and HTTPS separately.
What is different about the apex domain and www?
The apex (or root) domain is example.com. The www.example.com address is a separate hostname one level below it. DNS does not assume that a subdomain should point to the same server as its parent. An authoritative zone therefore needs a record for www, and the hosting service must be configured to accept that hostname.
Cloudflare’s documentation describes the practical reason for creating the record: “Having a subdomain record on www helps guarantee that a visitor who types www. in front of your domain address can still find your website or application.” A record can send visitors to the same origin as the apex site, to a platform hostname, or to a redirecting web server. DNS alone cannot make an unconfigured host serve your content.
#1 Best Overall
Use this order of operations
- Find the authoritative DNS provider. Make changes at the service named by the domain’s active nameservers, not necessarily at the company where the domain was purchased.
- Inspect the
wwwrecord. Remove stale or conflicting entries and create the type required by your host. - Map the hostname at the host. Add
www.example.comas a custom, accepted, or mapped domain. - Choose one canonical URL. Keep both names reachable, then redirect the non-canonical one to the preferred address.
- Activate HTTPS for both names. The certificate presented for a visit to
www.example.commust include that exact hostname. - Test from more than one network and resolver. This separates a public DNS problem from a local cache, router, or resolver problem.
1. Find where DNS is actually managed
Log in to the registrar or DNS service and locate the domain’s nameserver delegation. If the nameservers point to a separate DNS provider, that provider’s zone is authoritative. Editing a dormant zone at the registrar has no effect on public lookups.
Confirm delegation from a terminal
Replace the example domain with yours:
dig NS example.com +short
nslookup -type=NS example.comThe names returned should match the service whose DNS dashboard you will edit. If the nameserver set was recently changed, different resolvers can temporarily see different delegations; verify the change with an independent resolver before troubleshooting the www record.
Free tools Windows power users keep installed
One-click scans. No signup required.
2. Create the correct DNS record for www
Use the record type required by the hosting platform. A, AAAA, and CNAME records are not interchangeable.
| Record | What it points to | Use it when | Important constraint |
|---|---|---|---|
| A | An IPv4 address, such as 203.0.113.10 |
Your host gives you a fixed IPv4 address. | The address must be the host’s current address; an old address can send visitors to a different server. |
| AAAA | An IPv6 address | Your host explicitly provides IPv6 service. | A broken or outdated AAAA record can make IPv6-capable visitors fail even when A works. |
| CNAME | Another hostname, such as a platform-assigned target | Your host instructs you to delegate www to its hostname. |
A CNAME cannot coexist with other data at the same name. Remove conflicting A, AAAA, or duplicate CNAME records. |
Remove conflicts before adding the replacement
For the www label, look for multiple A records left by an old host, an AAAA record you no longer use, a second CNAME, or a forwarding entry supplied by a registrar. Follow the host’s exact target and trailing-dot requirements. Do not copy the apex record blindly: an apex may use special provider features that are not valid for a subdomain.
Check the result from public resolvers
dig www.example.com A +short
dig www.example.com AAAA +short
dig www.example.com CNAME +short
nslookup www.example.comA CNAME lookup normally returns the target name, while an A or AAAA lookup returns addresses (possibly after following the CNAME). An empty answer or NXDOMAIN means the name is not publicly resolving from that resolver; it does not prove that your browser or local network is the cause.
3. Add www to the hosting platform
Open the site, project, or domain settings in your hosting dashboard and choose the control labelled Custom domains, Domains, Allowed hosts, or Domain mapping. Add the complete name www.example.com, not only www. Some platforms require you to add the apex separately, so register both names if you intend to redirect between them.
Why DNS can look correct while the site is wrong
Web servers select a site by the HTTP Host header and by the TLS server name. If the origin has no virtual-host entry for www.example.com, it may return a default site, a 404, a 401, or an application from another project. A correct DNS answer proves only that traffic reached an address; it does not prove that the address is configured for your hostname.
After adding the domain, wait for the platform’s status to show that the mapping and certificate are active. If the platform supplies a verification CNAME or TXT record, add it exactly as shown and remove it only when the provider says it is no longer needed.
4. Decide which hostname is canonical
Choose one public URL and make the other a permanent redirect. Either policy is valid; consistency matters for links, cookies, caches, analytics, and search indexing.
| Policy | Preferred URL | Redirect | Operational notes |
|---|---|---|---|
| www-canonical | https://www.example.com |
Redirect https://example.com to the www address. |
Useful when infrastructure or cookies are organized under a subdomain; the apex still needs DNS and a web response for the redirect. |
| apex-canonical | https://example.com |
Redirect https://www.example.com to the apex. |
Common for shorter displayed URLs; the www hostname still needs a record, host mapping, and certificate so the redirect can be served safely. |
Configure the redirect at one deliberate layer—application, origin, or CDN—and make every layer agree on the same destination. A redirect strategy cannot work if the source hostname does not resolve first.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
5. Make HTTPS cover the exact name
A certificate for example.com does not automatically cover www.example.com. When a visitor enters the latter, the server must present a certificate whose subject alternative names include www.example.com (or an appropriate wildcard that covers it). Google’s SSL troubleshooting guidance gives this exact failure pattern: the certificate covers the apex while the user visits the www hostname.
Cloudflare also warns that visitors see a browser security warning when subdomains are not correctly covered by an SSL/TLS certificate. Enable certificates for both names in the hosting or CDN control panel, and include both names in the certificate request when the service allows a multi-name certificate.
Certificate validation blockers
Certificate issuance can fail even after DNS appears correct. Check each item:
- Resolvable DNS: the validation hostname must return the expected record from public resolvers.
- DNSSEC: an invalid signature or stale DS record can make a valid-looking zone fail validation.
- CAA: CAA records must permit the certificate authority you selected. An overly restrictive CAA policy blocks issuance.
- Validation paths: redirects, authentication, firewall rules, or bot protection must not block
/.well-known/*challenges. - Proxy state: if a CDN presents the edge certificate, confirm that its certificate is active; if traffic is DNS-only, confirm the origin certificate instead.
Test the certificate that users receive
curl -I https://www.example.com
openssl s_client -connect www.example.com:443 -servername www.example.com Inspect the response for the intended hostname and inspect the certificate’s names in the TLS output. Run the same test against the apex. A successful HTTP status alone is insufficient if the TLS handshake fails before HTTP begins.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →A/AAAA versus CNAME: choosing safely
An A or AAAA record binds www directly to an IP address. This is appropriate when you control a stable origin address, but it creates maintenance work whenever the host changes that address. A CNAME delegates the name to a hostname maintained by the platform, which is usually preferable for managed hosting because the platform can change its underlying addresses without asking you to edit the zone.
Follow the provider’s documentation rather than combining methods. A CNAME at www cannot share that label with an A or AAAA record. If a provider offers an “ALIAS,” “ANAME,” or flattened record for the apex, treat that as a provider-specific feature; it does not change the requirement to configure www separately.
Direct origin DNS versus a proxied CDN
| Characteristic | DNS-only / direct origin | Proxied CDN |
|---|---|---|
| Address returned | The origin’s IP address. | The CDN’s edge address, while the CDN connects to the origin. |
| Certificate presented to visitors | The origin certificate. | The CDN edge certificate; the origin still needs a valid certificate for the CDN-to-origin connection when strict TLS is used. |
| Common www failure | Origin lacks the hostname or certificate. | Edge certificate is inactive, proxy status is inconsistent, or origin TLS fails. |
| Best diagnostic question | Does the origin serve this Host name over HTTPS? | Does the edge serve the name, and can it reach the origin securely? |
A proxy changes which layer handles the public TLS handshake; it does not remove the need for a DNS record or an origin configuration. Cloudflare lists missing certificate coverage and unproxied records among causes of VERSION_OR_CIPHER_MISMATCH. Check proxy status, certificate activation, and origin TLS separately.
Error-to-cause map
| Symptom | Likely layer | What to check |
|---|---|---|
DNS_PROBE_FINISHED_NXDOMAIN or “name not resolved” |
DNS or local resolver | Authoritative delegation, the www record, DNSSEC, and a second network or resolver. |
| 404, 401, or a completely different site | Hosting or origin virtual host | Whether the platform has mapped www.example.com and whether the origin selects the correct site for the Host header. |
| Certificate name mismatch | TLS certificate | Whether the presented certificate includes www.example.com; issue or attach one that does. |
VERSION_OR_CIPHER_MISMATCH |
CDN/origin TLS or certificate coverage | Proxy state, edge certificate activation, and the origin’s TLS configuration when traffic is direct or proxied. |
| Redirect loop | Redirect layers | Which layer redirects, whether all layers use the same canonical URL, and whether HTTPS termination is understood correctly. |
Diagnose NXDOMAIN without making the outage worse
Compare authoritative and recursive answers
dig NS example.com +short
dig www.example.com @1.1.1.1
dig www.example.com @8.8.8.8
dig www.example.com +traceIf the authoritative nameserver has no www record, edit the zone. If the authoritative answer is correct but one recursive resolver is stale, wait for its cached TTL and test another network. If +trace shows a broken delegation or DNSSEC validation, fix the parent delegation or signing configuration rather than adding duplicate records.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsRule out local conditions
Try a mobile connection, a different Wi-Fi network, and a public resolver. Flush the operating system or browser DNS cache only after recording the public results. A local VPN, security product, router cache, or captive portal can produce an NXDOMAIN-like error that other visitors do not see. Conversely, if every independent resolver returns NXDOMAIN, the problem is public DNS, not your browser.
Redirect and cookie pitfalls
Do not redirect before both hostnames resolve and present valid certificates. Otherwise an HTTPS request can fail before the browser is able to receive the redirect. Check for rules at the application, web server, CDN, and load balancer; two rules that alternate between apex and www create a loop.
When changing canonical hosts, review cookies scoped to the old host, absolute asset URLs, callback URLs, CORS allowlists, sitemap entries, and monitoring checks. Keep the redirect permanent only after testing; use a temporary redirect while you are still correcting the destination.
Verification checklist
digandnslookupreturn the intended A, AAAA, or CNAME path forwww.- The hosting dashboard lists
www.example.comas an active mapped hostname. https://www.example.comcompletes TLS with a certificate containing the exact name.- The page served for www is the intended site, not a default virtual host.
- The non-canonical hostname redirects once to the chosen canonical HTTPS URL.
- Both hostnames work from an independent network and at least two recursive resolvers.
- Certificate validation paths and DNSSEC/CAA settings remain functional after the change.
What the fix tells you
When www fails, the root cause is usually a missing DNS record, an unrecognized hostname at the host, or a certificate that covers only the apex. Treat DNS, host mapping, redirects, and TLS as separate checkpoints. Once each checkpoint succeeds, selecting either www-canonical or apex-canonical is a policy decision rather than a technical limitation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
