Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsIf example.com works but www.example.com does not, the two hostnames are not configured identically. www is a separate subdomain: it needs its own DNS record, an explicit mapping at your hosting platform, and HTTPS coverage for that exact name. Create the required DNS record at the authoritative DNS provider, add the hostname to your host, choose one canonical address, then test redirects and certificates in that order.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Why the apex domain works while www fails
The bare domain, often called the apex or root domain, is example.com. The prefixed address, www.example.com, is a different DNS hostname. It does not automatically inherit a usable destination from the apex.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →When someone enters a URL, a resolver first looks up the requested hostname. If the zone contains an A, AAAA, or CNAME record for www, the resolver can find an address or another hostname. The web server must then recognize the Host value www.example.com and return the intended site. Finally, HTTPS negotiation must use a certificate that covers www.example.com.
Any one of those layers can fail independently:
- DNS failure: no record, a stale record, or incorrect nameserver delegation prevents resolution.
- Hosting-mapping failure: DNS resolves, but the platform or origin has not been configured to serve the www hostname.
- TLS failure: the server answers, but its certificate does not contain the hostname the browser requested.
- Redirect failure: both names resolve, but origin, CDN, or application rules point between them inconsistently.
Cloudflare’s documentation summarizes the reason to publish a www record: “Having a subdomain record on www helps guarantee that a visitor who types www. in front of your domain address can still find your website or application.” That documentation was updated April 16, 2026.
#1 Best Overall
Use this order to find the broken layer
Changing several settings at once makes troubleshooting harder. Follow this sequence and record the result of each step.
- Identify the authoritative DNS provider. Check your domain’s active nameservers at the registrar or with a public WHOIS/RDAP lookup. Edit the DNS zone at the service those nameservers identify, not merely at the company where the domain was purchased. If nameservers point to a CDN or managed DNS service, records entered at the registrar may have no effect.
- Inspect the existing www records. Look for A, AAAA, CNAME, and any unusual forwarding or alias entries. Remove duplicate, stale, or contradictory records before adding the one your host requires. A CNAME generally cannot coexist with other data at the same name, and an old AAAA record can send IPv6 clients to a broken server even when IPv4 works.
- Compare public resolution. Query
www.example.comfrom more than one resolver or network. Confirm that the answer matches the destination supplied by your host. If one resolver still shows an old value, propagation or caching may be involved; if every resolver returns no name, inspect delegation and the authoritative zone. - Add the hostname at the hosting platform. In the host’s domain, custom-domain, mapped-domain, or site settings, add
www.example.comexactly. DNS only directs traffic; it does not authorize a platform or virtual host to serve that name. - Verify plain HTTP before forcing HTTPS. Once both names resolve and the host accepts them, request each address and confirm that the intended site responds. A 404, 401, default page, or another customer’s site indicates a host mapping or origin virtual-host problem, not a missing DNS record.
- Set one canonical address and redirect the other. Decide whether the apex or www form is preferred. Keep both names resolving, then issue a single permanent redirect from the alternate to the canonical URL.
- Validate HTTPS and only then test every redirect. Visit both HTTP and HTTPS forms, including deep links. Check that the certificate, redirect chain, cookies, and application-generated URLs all use the same canonical hostname.
Choose the DNS record your host actually supports
An A or AAAA record points the hostname directly to an IP address. A CNAME points the hostname to another hostname whose address is resolved separately. Use the value documented by your hosting provider rather than guessing.
| Record | What it contains | Use it when | Important checks |
|---|---|---|---|
| A | An IPv4 address, such as the origin’s IPv4 endpoint | Your host gives you a fixed IPv4 address | Update it if the host changes the address; remove obsolete duplicates |
| AAAA | An IPv6 address | Your host explicitly provides IPv6 service | Test IPv6 separately; a bad AAAA record can break only some visitors |
| CNAME | A target hostname supplied by the platform | The platform manages changing infrastructure behind a hostname | Enter the exact target and avoid conflicting records at www |
The apex domain has special DNS restrictions at many providers, while www is an ordinary subdomain and can normally use a CNAME. Do not replace an A record with a CNAME, or vice versa, unless your host’s current instructions call for it. A DNS change cannot fix an origin that is offline, misconfigured, or refusing the hostname.
Add www to the hosting platform and origin
Most managed hosts provide an “Add domain,” “Custom domains,” or “Domains” screen. Add the complete hostname, not only the word www. The platform may ask you to verify ownership by checking the DNS record, and it may not issue a certificate until verification succeeds.
On a self-managed server, add the name to the web server’s virtual-host configuration and to the application’s allowed-host list. Frameworks and reverse proxies may reject an unfamiliar host with a 400 or 404 response even though DNS is correct. Confirm that the origin serves the same document root for both names or intentionally returns the redirect response for the non-canonical one.
Do not test only the home page. Request a representative article, an image, a JavaScript file, and a form endpoint. Mixed host rules often appear only on assets or authenticated routes. If the host dashboard shows a pending verification state, wait for the authoritative record to be visible publicly before troubleshooting the application.
Choose a canonical hostname: www or apex
Either form can be canonical. The important property is consistency: one address serves content, and the other performs one redirect to it. A redirect strategy requires both the source and destination to resolve, so do not delete the DNS record for the address you plan to redirect.
| Strategy | Canonical URL | DNS and host setup | Redirect rule | Typical reason to choose it |
|---|---|---|---|---|
| www-canonical | https://www.example.com |
Publish www as required by the host; configure the apex as an accepted domain or redirect source |
Redirect https://example.com/* to the matching www URL |
Useful when infrastructure treats the subdomain as the primary web endpoint or when separate subdomains are expected later |
| apex-canonical | https://example.com |
Keep the apex mapped to the site; publish and map www as an alternate hostname |
Redirect https://www.example.com/* to the matching apex URL |
Useful when the shorter address is the established public identity |
Use a single 301 or 308 redirect where appropriate, preserve the path and query string, and avoid alternating rules such as apex-to-www at the CDN followed by www-to-apex at the origin. A redirect loop usually means two layers disagree about the canonical scheme or hostname.
Direct origin DNS versus a proxied CDN
In a DNS-only arrangement, the browser connects to your origin. The origin must present the correct certificate and serve both mapped hostnames. In a proxied CDN arrangement, the browser first connects to the provider’s edge; the edge certificate is presented to the visitor, and the edge then connects to the origin according to the configured TLS mode.
| Architecture | Visitor-facing certificate | Where to inspect first | Common www failure |
|---|---|---|---|
| DNS-only, direct origin | Origin server’s certificate | Origin virtual host, certificate names, and port 443 configuration | The origin certificate covers the apex but not www |
| Proxied CDN | CDN edge certificate | Proxy status, edge certificate activation, and hostname coverage | The record is unproxied, or the edge certificate is not active for www |
Proxying changes which layer terminates the visitor’s TLS session; it does not remove the need for a valid origin configuration when the CDN connects to your server. If you switch a record from proxied to DNS-only while diagnosing, re-check the certificate and firewall behavior because traffic is now reaching a different endpoint.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallFix HTTPS and certificate-name errors
A certificate is valid only for the DNS names listed in its subject or alternative names. Google’s certificate troubleshooting guidance gives the common example of a certificate that covers example.com while the visitor opens www.example.com. The browser correctly reports a name mismatch because the requested hostname is absent. Obtain or configure a certificate containing the exact www name, or an appropriate alternative DNS name, and ensure it is installed on the layer that answers the connection.
Cloudflare notes that visitors see a security warning when subdomains are not correctly covered by an SSL/TLS certificate. Before requesting or renewing a certificate, check the validation path:
- DNS resolution: the validation hostname must resolve publicly to the expected service.
- DNSSEC: signatures must be valid; a broken chain can make an otherwise correct record appear unavailable.
- CAA records: any CAA policy must permit the certificate authority you are using.
- Validation URL access: redirects, authentication, firewall rules, or security products must not block
/.well-known/*paths used for domain control validation.
After activation, inspect the certificate actually delivered for each hostname, not merely the certificate shown in a dashboard. Test from a clean browser session and from a second network so cached certificates, HSTS state, or local interception do not disguise the result.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Error-to-cause map
NXDOMAIN or “site can’t be reached”
NXDOMAIN means the resolver was told that the name does not exist. Typical causes are a missing www record, an incorrectly delegated zone, a misspelled target, or stale records at the wrong DNS provider. Cloudflare also documents local DNS or network conditions as possible causes. Compare authoritative answers and another public resolver before editing the zone.
404, 401, default page, or the wrong website
These responses show that DNS reached a server, but the server or platform did not map the www hostname to your site. Add the hostname in the hosting dashboard, then check the origin’s virtual-host and application allow-list settings. A default page often means the request landed on the server’s fallback site.
Certificate name mismatch
The certificate does not include www.example.com. Install a certificate with that exact name or a suitable alternative DNS name on the terminating layer, then retest the full redirect chain.
VERSION_OR_CIPHER_MISMATCH
Cloudflare lists missing certificate coverage and unproxied DNS records among common causes of this error. Check whether the record’s proxy status matches the certificate that is active, verify edge certificate activation, and, for direct traffic, inspect origin TLS versions and certificate configuration.
Redirect loop
Find every layer that can redirect: application code, origin web server, CDN rules, and HTTP-to-HTTPS policies. Select one canonical scheme and hostname, remove opposing rules, and ensure certificate-validation paths are not redirected into a blocked or authenticated route.
Separate a local problem from a public DNS problem
If www.example.com works on a phone over cellular data but fails on office Wi-Fi, the authoritative zone may be correct. The failing network could have a stale resolver cache, DNS filtering, a captive portal, or an IPv6 path that cannot reach the destination. Flush the local DNS cache, restart the network connection, and test with another resolver approved for your environment.
If the name fails from several unrelated networks and public resolvers, inspect nameserver delegation and the authoritative record instead. Do not keep changing browser settings when every external resolver returns NXDOMAIN. Conversely, do not delete a valid DNS record because one local resolver has not refreshed its cache.
Quick Recap
Complete repair checklist
- Confirm which nameservers are authoritative.
- Create exactly the A, AAAA, or CNAME record required for
www. - Remove stale or conflicting records and verify the apex separately.
- Wait until public resolvers return the intended answer.
- Add
www.example.comto the hosting platform and origin virtual host. - Confirm that HTTP requests reach the intended site before enforcing redirects.
- Keep both hostnames resolvable and choose one canonical URL.
- Configure one redirect direction, preserving paths and query strings.
- Install a certificate covering every hostname users can visit.
- Check DNSSEC, CAA, and
/.well-known/*accessibility if certificate issuance or renewal fails. - Retest from another network, with IPv4 and IPv6 where applicable, and inspect a deep link as well as the home page.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
