DNS and SSL Troubleshooting

After adding your custom domain to Kanorio, is the status stuck on the yellow "Waiting for DNS to propagate" indicator, or is the secure padlock (HTTPS) missing from your browser? This usually doesn't mean your website is broken; it means the global network is still syncing your new settings or a specific record needs a minor adjustment.

This guide will help you understand the automatic diagnostic tips in the "DNS Settings" drawer and provide a step-by-step troubleshooting checklist.

The Golden Rule: Never "Remove and Re-add" Your Domain!

When you see "Waiting for DNS to propagate" or your site is temporarily inaccessible, it's tempting to remove the domain and add it again. Please do not do this:

1. Removing and re-adding won't fix the issue; it resets the process: Every time you add a domain, global edge nodes must rebuild routing and validation schedules. If you delete it while waiting, previous progress is discarded, and some nodes may cache expired states, extending downtime by 10 minutes to 1 hour.
2. 10-minute security cooldown: To prevent routing anomalies caused by repeated deletions, a domain cannot be re-added within 10 minutes of removal (a countdown will appear).
3. The correct approach: To force the system to re-check immediately, click "Check again now" at the bottom left of the "DNS Settings" drawer (or via the "..." menu next to your domain).

Understanding the 8 Diagnostic Messages in "DNS Settings"

Go to "Website Settings › Domains" and click the "DNS Settings" button next to your domain (or expand "View details" at the bottom of the drawer). The system probes public DNS in real-time to pinpoint where the process is stuck:

1. "DNS configured, waiting to propagate" or "Domain verified, issuing certificate"

• What it means: Congratulations! Your CNAME record is correctly pointing to saas.kanorio.com. The system is waiting for global ISP caches to update and is automatically issuing a free HTTPS secure padlock (SSL certificate) from the certificate authority.
• What to do: No further action is needed at your domain registrar. Keep your settings as they are. It usually turns green ("Active") within 5 to 15 minutes (though some registrars may take up to 24 hours). The system checks automatically every 15 seconds while the drawer is open and continues retrying in the background every 5 minutes.

2. "Turn off the Cloudflare orange cloud (DNS Only)"

• What it means: Your domain uses Cloudflare for DNS, but the record has the orange cloud (Proxied mode) enabled. This hides your saas.kanorio.com pointer and reports Cloudflare's proxy IP instead, preventing Kanorio from verifying the domain and blocking SSL issuance.
• What to do: Log in to your Cloudflare dashboard → "DNS" → "Records". Find the CNAME record pointing to saas.kanorio.com, click edit, and switch the orange cloud to "Gray cloud (DNS Only)", then save. Return to Kanorio and click "Check again now". (Note: Kanorio includes global edge CDN acceleration, DDoS mitigation, and automatic SSL protection, so using the gray cloud will not compromise your site's speed or security.)

3. "A record failed validation" or "Please delete A record"

• What it means: Your domain is currently pointing to Kanorio using an A record (IP address), or an old A record remains on the same name. Kanorio only supports binding via CNAME (pointing to saas.kanorio.com). An A record prevents automated certificate validation.
• What to do:
  • If it's a www or subdomain (or your registrar supports root domain CNAME/ALIAS): Delete the A record at your registrar and add a CNAME record pointing to saas.kanorio.com.
  • If it's a root domain (yourbrand.com) and your registrar doesn't support root CNAMEs: See the next section, "Consider using www."

4. "Consider using www.yourbrand.com"

• What it means: You entered a root domain without www (e.g., yourbrand.com), but your registrar (e.g., GoDaddy, Squarespace, and some traditional providers) does not technically allow CNAME records on root domains.
• What to do:
  1. Click the "Use www.yourbrand.com" button in the drawer; the system will automatically update your binding to www.
  2. At your registrar, add a CNAME record named www pointing to saas.kanorio.com.
  3. Delete the root domain's A record pointing to your old site and enable "URL Forwarding" at your registrar to redirect yourbrand.com to https://www.www.yourbrand.com.

5. "Update record target to Kanorio" or "Replace existing record with CNAME"

• What it means: The record for this name already exists at your registrar but points elsewhere (usually an old host or a parked page).
• What to do: Log in to your DNS provider, find the existing record for this name (www or @):
  • If it's already a CNAME: Edit it and change the target to saas.kanorio.com.
  • If it's an A or AAAA (IPv6) record: Delete the old A and AAAA records and add a new CNAME record pointing to saas.kanorio.com. (Note: Only modify the @ or www records; do not delete MX or TXT records used for company email.)

6. "Add a TXT verification record"

• What it means: In some network environments (e.g., if the domain was previously used with other cloud services), the system needs extra verification to confirm ownership before switching and issuing certificates.
• What to do: The drawer will display the Name and Value for a TXT record. Copy these and add them to your DNS provider (keep your existing CNAME record). Validation usually passes within minutes.

7. "CAA record restricts certificate issuance"

• What it means: CAA records are security rules that restrict which certificate authorities can issue SSL certificates for your domain. If your existing CAA record doesn't include Kanorio's international certificate authorities (e.g., letsencrypt.org, pki.goog), the secure padlock cannot be issued.
• What to do: Check with your IT team. If there are no specific restrictions, remove the blocking CAA record or contact Kanorio support with a screenshot of your current CAA records so we can help you identify the necessary rule.

8. "DNSSEC configuration error" or "Nameservers not found"

• What it means:
  • Domain/Nameservers not found: Check for typos and ensure the domain is purchased and paid for. New domains or recent nameserver changes can take hours to propagate to global root servers.
  • DNSSEC error: If you enabled advanced DNSSEC signing but changed DNS providers without removing the old DS records, global resolution will fail. Correct or temporarily disable DNSSEC at your registrar.

The Fastest Troubleshooting Order

If you've updated your settings but things still feel "off" (e.g., works on mobile but not desktop), check these 6 points:

1. Confirm you are using the right dashboard

Common mistake: The domain was bought at Company A, but years ago, the "Nameservers" were pointed to Company B (e.g., Cloudflare or a previous agency). Changing settings at Company A will have no effect.

• How to check: Click "View details" at the bottom of the Kanorio "DNS Settings" drawer. The system will show the currently detected service provider or nameservers (e.g., ns.cloudflare.com). Update settings at that platform.

2. Check for residual "old A or AAAA records"

If your root domain still has an IPv4 (A) or IPv6 (AAAA) record pointing to an old site, browsers might randomly connect to the old IP, causing the site to flicker between the new and old versions or fail to load. Ensure all old A and AAAA records for the same name (@ or www) are deleted.

3. Check for "double-appended domains" in the name field

For most registrars, when adding a CNAME for www, you only need to enter www. The system automatically appends .yourbrand.com. If you enter the full www.yourbrand.com, some registrars save it as www.yourbrand.com.yourbrand.com, making it unresolvable.

4. Check if the target needs a trailing dot . (Common with Gandi and traditional registrars)

At registrars using traditional Zone File formats, if you don't add a trailing dot . to the CNAME target, the system might append your domain, resulting in saas.kanorio.com.yourbrand.com. If "View details" shows this, change the target to saas.kanorio.com. (with the trailing dot).

5. Ensure both root and www are handled

yourbrand.com and www.yourbrand.com are distinct addresses. If you only bound www.yourbrand.com in Kanorio but didn't set up a redirect at your registrar, visitors typing yourbrand.com will see an error. See to add the redirect.

6. Test with mobile data (Wi-Fi off) and Incognito mode

Your computer, office router, and ISP cache old DNS results (based on TTL). When Kanorio shows green "Active" but your computer shows the old site, turn off Wi-Fi on your phone, use 4G/5G, and open an Incognito window. If it works on mobile, the setup is 100% successful. Your computer will recover once the cache expires.

About the 7-day auto-cleanup mechanism: If a new custom domain doesn't point to Kanorio for over 7 days, the system will clean up the incomplete setup. You can simply re-add it when you're ready. (If your CNAME is correctly pointing to Kanorio, the system will automatically extend the retention and continue retrying in the background.)

When to Contact Support (Include these 2 screenshots)

If you encounter any of the following, stop troubleshooting and contact us via the bottom-right chat or :

• "DNS Settings" has shown "DNS configured, waiting to propagate" for over 24 hours.
• The drawer shows CAA certificate restrictions, DNSSEC errors, or "This is a system-side issue."
• You are unsure which old records to delete or which are required for company email.

To get the fastest help, include these 2 screenshots:

1. A full screenshot of your registrar's "DNS record list" (showing type, name, and target value).
2. A screenshot of the Kanorio "DNS Settings" drawer (ideally with "View details" expanded). (Do not provide login passwords or verification codes.)

Related Documents