Recommended Free Tools
Fix a broken VPS subdomain in layers: verify its DNS record and authoritative nameservers, confirm the hostname resolves to the right address, open ports 80/443, match the hostname in Nginx or Apache, test the local application, and only then issue an HTTPS certificate. A DNS failure never reaches your VPS; a default website usually means virtual-host matching; a 502 usually means the reverse-proxy application is unhealthy.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Work through the checks below in that order. Changing web-server files before DNS and network tests can hide the real fault and leave a correct configuration unreachable.
As an Amazon Associate I earn from qualifying purchases.
What the symptom tells you
A subdomain request crosses several independent layers. The browser first asks DNS for an address, then opens a TCP connection to that address, then negotiates TLS for HTTPS, and finally sends an HTTP request containing the hostname. Your VPS must be correct at every layer.
- DNS layer: the label (for example,
sub.example.com) must exist at the authoritative DNS provider and resolve to the intended IPv4 address, IPv6 address, or alias. - Network layer: the resolved address must be your VPS, and the provider firewall, operating-system firewall, and service must permit TCP 80 and/or 443.
- HTTP host-selection layer: Nginx or Apache must have a virtual host whose name exactly matches the request. Otherwise the default site often answers.
- Application layer: a reverse proxy must be able to reach the local process, socket, or container.
- TLS layer: the certificate and HTTPS virtual host must contain and select the requested name.
The browser message narrows the search, but it does not identify the exact configuration file. Use the three-minute sequence first, then apply the server-specific fixes.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
The three-minute diagnostic order
1. Verify the authoritative DNS record
At the DNS service that hosts your domain’s authoritative zone, check that the exact subdomain label exists. Cloudflare’s current subdomain guidance says to first ensure that the hosting provider can serve the hostname, then create an A, AAAA, or CNAME record for the subdomain label: Cloudflare’s create-subdomain documentation (updated April 16, 2026).
Confirm that you are editing the zone served by the domain’s authoritative nameservers, not an unused registrar zone. A record at the wrong provider has no effect. If you recently changed nameservers, query the delegation before changing the record itself.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →| Record | What it does | When to use it | Common mistake |
|---|---|---|---|
| A | Maps the subdomain directly to an IPv4 address. | Your VPS has a stable public IPv4 address. | Entering the hostname in an A record instead of an address, or leaving an old address behind. |
| AAAA | Maps the subdomain directly to an IPv6 address. | Your VPS has working IPv6 routing and the web server listens on IPv6. | Publishing an obsolete IPv6 address; IPv6-capable clients then fail even though IPv4 works. |
| CNAME | Aliases the subdomain to another hostname, which is resolved separately. | A provider or another DNS name owns the changing address. | Creating a CNAME at the zone apex, or assuming it overrides an existing A/AAAA record at the same label. |
Do not publish conflicting record types at one label. A CNAME cannot coexist with ordinary A or AAAA data at that same name. Remove stale records when moving the subdomain.
2. Resolve it from outside the VPS
Run these commands from a workstation or another network, not only from the server you are debugging:
dig +short sub.example.com A
dig +short sub.example.com AAAA
dig +short sub.example.com CNAME
dig +trace sub.example.comThe A and AAAA answers should be the addresses assigned to this VPS. The trace shows the delegation path and the nameservers that are authoritative. Compare a public recursive answer with a direct query to an authoritative nameserver:
dig NS example.com +short
dig @ns1.example-dns.net sub.example.com A +short
dig @ns1.example-dns.net sub.example.com AAAA +short
dig sub.example.com A +shortUse the nameserver names returned for your own domain; ns1.example-dns.net is only an illustrative syntax example. If the authoritative query is empty or wrong, repair the zone or delegation. If the authoritative answer is correct but a public resolver is temporarily old, wait for the record’s TTL while testing with the authoritative answer. Do not proceed to Nginx or Apache until the hostname consistently resolves to the intended VPS address.
3. Check reachability and listeners
On the VPS, verify that a process is listening on the required ports:
sudo ss -ltnp | grep -E ':80|:443'You should see a listener on TCP 80 for HTTP and, when HTTPS is enabled, TCP 443. Check both the operating-system firewall and the hosting provider’s separate network firewall. For a system using UFW, for example:
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
sudo ufw statusAllow the ports in the firewall system you actually use, and confirm that the provider’s control panel has matching inbound rules. A timeout often means packets are being filtered; an immediate refusal usually means the address is reachable but no service is listening. Test from outside the VPS with:
curl -I http://sub.example.com
curl -vkI https://sub.example.comIf these commands cannot establish a TCP connection, fix the address, firewall, or listener before editing virtual-host files. Certbot likewise requires that the machine remain reachable from the Internet on the validation port for each requested name: Certbot’s usage guide.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
4. Match the hostname in the web server
Once DNS and ports work, send a request with the exact hostname and inspect which virtual host answers. A default page means the request reached the VPS but no configured host matched it. Nginx selects a server block from the request name; if no server_name matches, it uses the default server for that port. See Nginx server-name selection and the Nginx web-server administration guide.
Apache performs the equivalent selection with ServerName and optional ServerAlias. After editing Apache configuration, apachectl -S prints the parsed virtual-host map so you can see which file owns each address and name.
5. Test the upstream application separately
If the web server is a reverse proxy, bypass it and query the application on its local bind address and port:
curl -i http://127.0.0.1:3000Use the port your application actually listens on. A successful local response proves the process is alive and reachable from the proxy. A connection refusal, timeout, or empty socket means the application, its bind address, service manager, or container network needs attention. A 502 or 504 from Nginx or Apache is therefore an upstream problem, not a DNS problem.
6. Fix HTTPS only after HTTP works
Do not start certificate troubleshooting while the hostname still resolves incorrectly or port 80 is blocked. First make http://sub.example.com reach the intended virtual host. Then choose a validation method:
| Validation method | Network prerequisite | What you must control | Typical use |
|---|---|---|---|
| HTTP-01 | Public TCP port 80 must reach the web server serving the hostname. | The HTTP challenge path and the web server response. | A normal website where port 80 can remain reachable. |
| DNS-01 | No inbound web connection is required for validation. | An authoritative TXT record under _acme-challenge.sub.example.com. |
Wildcard certificates or hosts that cannot expose port 80. |
Certbot documents both HTTP-01 and DNS-01, including the TXT record location, in its official usage documentation. Once DNS and HTTP are confirmed, the common integrations are:
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
sudo certbot --nginx -d sub.example.com
sudo certbot --apache -d sub.example.comRun only the command for the web server you use, review the proposed changes, and verify renewal afterward. A challenge failure still points to a DNS target, blocked port 80, an unreachable challenge path, or a missing DNS-01 TXT record.
Correct DNS records for a VPS subdomain
Pointing directly to the VPS
For a fixed IPv4 address, create an A record such as sub → 203.0.113.20. If the VPS has correctly configured IPv6, add an AAAA record such as sub → 2001:db8:1234::20. The addresses above are documentation examples; use the public addresses assigned to your server.
An AAAA record is not harmless if IPv6 is incomplete. Browsers commonly prefer IPv6 when it resolves, so a bad AAAA record can make the site fail for some users while IPv4 tests appear healthy. Either make IPv6 routing, firewall rules, and listeners work, or remove the stale AAAA record until they do.
Using a hostname alias
A CNAME makes sub.example.com follow another hostname’s DNS answer. Resolve the CNAME target as well and ensure that the target ultimately reaches the VPS or service that is prepared to serve the original hostname. The web server still needs the original name in its host configuration; DNS aliasing does not automatically create an Nginx server_name or Apache ServerName.
Delegated subdomains
If the parent zone delegates sub.example.com to different nameservers, records in the parent provider’s ordinary zone may be ignored. Query the delegation with dig +trace, then create the A, AAAA, or CNAME record on the delegated authoritative service. A managed DNS service can simplify this, but it cannot compensate for incorrect nameserver delegation or a wrong target address.
Fixing Nginx host matching on a VPS
Serve static files
Create a dedicated server block containing the complete hostname:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →server {
listen 80;
listen [::]:80;
server_name sub.example.com;
root /var/www/sub.example.com;
index index.html;
location / {
try_files $uri $uri/ =404;
}
}Place it in the directory used by your distribution for enabled Nginx sites, or include it from the main Nginx configuration. Ensure the document root exists and is readable by the Nginx worker. The important part for the “main site appears” symptom is the exact server_name; spelling, hyphens, and the requested level of the domain must match.
Check syntax before reloading:
sudo nginx -t
sudo systemctl reload nginxIf nginx -t reports an error, do not reload. Correct the reported file and line first. If the test succeeds but the wrong site remains, inspect all enabled server blocks for a duplicate name and check which block is marked default_server. Test the host header directly against the VPS address to remove DNS from the equation:
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
curl -i -H 'Host: sub.example.com' http://203.0.113.20/Replace the example address with the VPS’s IPv4 address. A correct response here means Nginx host matching works and any remaining failure is DNS, IPv6, or client-side caching.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteProxy to a local application
For an application listening on port 3000, use a location block that forwards the original host and client information:
server {
listen 80;
listen [::]:80;
server_name sub.example.com;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}Confirm that the process is actually bound to 127.0.0.1:3000 (or to the Unix socket named in your configuration). If it binds only to a different interface or port, change the proxy target or the application bind setting. Keep the upstream private unless it is intentionally designed to be public.
Configure the HTTPS server block
After obtaining a certificate, the 443 block must carry the same hostname and the matching key pair:
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name sub.example.com;
ssl_certificate /etc/letsencrypt/live/sub.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/sub.example.com/privkey.pem;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto https;
}
}Keep a separate port-80 block for the HTTP-01 challenge and, if desired, redirect ordinary HTTP requests to HTTPS after validation. Verify that the certificate files belong to this hostname and that the Nginx process can read them. Reload only after sudo nginx -t succeeds.
Fixing Apache virtual hosts
Define the HTTP host
In a name-based Apache setup, define the subdomain explicitly:
<VirtualHost *:80>
ServerName sub.example.com
DocumentRoot /var/www/sub.example.com
<Directory /var/www/sub.example.com>
Require all granted
AllowOverride All
</Directory>
</VirtualHost>Use ServerAlias only for additional names that should serve the same site, such as a deliberately configured www name. Do not add a broad alias to hide a typo; it can cause unrelated hostnames to land on this site.
On Debian- or Ubuntu-style systems, enable the site if it is stored as a separate file, test the complete configuration, and reload:
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
sudo a2ensite sub.example.com.conf
sudo apachectl configtest
sudo apachectl -S
sudo systemctl reload apache2The exact service name can differ by distribution. apachectl -S is the decisive diagnostic: it shows parsed virtual hosts, their addresses, and the file Apache selected. If the subdomain is absent or appears under an unexpected file, fix the enabled-site layout rather than changing DNS.
Free tools Windows power users keep installed
One-click scans. No signup required.
Add HTTPS without losing host matching
Create a separate 443 virtual host with the same ServerName and the certificate paths supplied by your certificate manager:
<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerName sub.example.com
DocumentRoot /var/www/sub.example.com
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/sub.example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/sub.example.com/privkey.pem
<Directory /var/www/sub.example.com>
Require all granted
</Directory>
</VirtualHost>
</IfModule>Enable the SSL module and site according to your distribution, run apachectl configtest, then reload. The 80 and 443 virtual hosts are independent; configuring ServerName only on port 80 does not make the HTTPS host match.
Why HTTPS can fail when HTTP works
TLS selection happens before the browser sends its ordinary HTTP request. Nginx explains: “The SSL connection is established before the browser sends an HTTP request and nginx does not know the name of the requested server.” The full explanation is in Nginx’s HTTPS configuration documentation.
Modern clients use SNI to provide the requested name during the TLS handshake, allowing one IP address to host several certificates. A missing or mismatched 443 server_name, an old default certificate, or a certificate that omits the subdomain can therefore produce a certificate warning even though port 80 is correct.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors- Inspect the served certificate and names with
curl -vkI https://sub.example.comor a TLS inspection tool. - Ensure the certificate contains
sub.example.com, either as an exact Subject Alternative Name or through an appropriate wildcard. - Ensure the 443 server block uses the same exact hostname and the corresponding private key.
- Check that DNS does not send some clients to a second server with an unrelated certificate.
- Reload the web server after certificate renewal and verify that the renewed files are the ones referenced by the active configuration.
A wildcard certificate covers names within its declared level, but it does not automatically cover a deeper level. For example, a certificate for *.example.com covers sub.example.com, not deep.sub.example.com.
Error-to-layer map
| Observed result | Most likely layer | First check |
|---|---|---|
DNS_PROBE_FINISHED_NXDOMAIN or “server not found” |
DNS record, delegation, or stale target | Query A, AAAA, CNAME, and the authoritative nameservers with dig. |
| Connection timeout | Wrong address, provider firewall, operating-system firewall, or filtered port | Compare the resolved address with the VPS and verify inbound 80/443 rules. |
| Connection refused | No service is listening on the selected address and port | Run ss -ltnp and inspect the web-server service status. |
| The main website appears | Nginx server_name or Apache ServerName mismatch; default virtual host handled the request |
Inspect Nginx server blocks or run apachectl -S, then test with an explicit Host header. |
| 502 Bad Gateway or 504 Gateway Timeout | Reverse-proxy upstream is down, on the wrong port, bound to the wrong interface, or blocked locally | Curl the upstream on its local address and inspect proxy and application logs. |
| Certificate name mismatch or an unexpected certificate | Certificate omits the subdomain or SNI selected the default HTTPS host | Inspect the certificate names and the active 443 host configuration. |
| Certbot challenge failure | Validation host is not reached, port 80 is blocked, challenge path is intercepted, or DNS-01 TXT is absent | Recheck DNS, port 80, the HTTP challenge response, or _acme-challenge TXT data. |
A repeatable verification checklist
- Write down the exact fully qualified hostname, intended IPv4/IPv6 addresses, and whether the service is static or proxied.
- At the authoritative DNS provider, create or correct one A, AAAA, or CNAME record and remove conflicting stale data.
- Run
dig +shortfor A, AAAA, and CNAME, then usedig +traceto confirm delegation. - Confirm that the resolved address belongs to this VPS and that IPv6 works if an AAAA record exists.
- Verify listeners and firewall rules for TCP 80 and 443 at both the VPS and hosting-provider levels.
- Configure the exact hostname in Nginx
server_nameor ApacheServerName; add aliases only intentionally. - Run
nginx -torapachectl configtest, inspectapachectl -Swhen using Apache, and reload the service. - If proxying, curl the application locally and correct its process, bind address, port, socket, or container network.
- Test HTTP from outside the VPS and with an explicit Host header to separate DNS from virtual-host errors.
- Issue or renew the certificate only after HTTP or the chosen DNS challenge is reachable, then verify the certificate names and the active 443 configuration.
Following this order prevents category errors: DNS changes cannot repair a closed firewall port, a certificate cannot make an unmatched virtual host serve the right site, and restarting a proxy cannot create a missing DNS record. Once each layer returns the expected result, the subdomain will reach the intended application instead of the default site or an error page.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
