Why Is My Domain Not Working? A Diagnostic Ladder
Work from the outside in: registration, then nameservers, then records, then the server. Nine times out of ten the answer is in the first two steps, and the fix takes minutes once you know which one it is.
September 22, 20267 min readDNS · Troubleshooting · Domains
The short answer. Check in this order: is the domain still registered, does it carry a status code blocking it, do the nameservers point where you think, do the records exist, and only then look at the server. Most outages are resolved at step one or two, and looking at the server first is why people lose an afternoon.
Something that worked yesterday does not load today. Before changing anything, find out which layer is broken. Each step below rules out a whole category.
Step 1: Is the domain still registered?
Start here every single time. An expired domain produces symptoms that look exactly like a server problem, and no amount of DNS work will fix it.
Look up the domain in our checker. It queries the registry directly over RDAP and shows the registration record, including the expiry date.
If it shows as available, the registration lapsed. Go straight to your registrar and renew. If you are inside the grace period you pay the normal rate; in redemption you pay a recovery fee. You have roughly 75 days from expiry before the name is released entirely, as covered in What Happens When a Domain Expires.
If it shows registered, note the expiry date anyway. A domain that expires next week is a problem you have not had yet.
Step 2: Check the registry status codes
Still in that same RDAP record. Status codes are the registry telling you something, and two of them stop a domain working entirely.
clientHold or serverHold means the registry is deliberately not publishing your domain in DNS. ICANN's guidance is unambiguous: contact your registrar immediately. Common causes are non-payment, an unverified registrant contact, or a dispute.
That last cause catches people out. ICANN requires registrars to verify registrant contact details, and an unanswered verification email can suspend the domain. The email went to the address on the domain, which may be an address at the domain that is now unreachable.
redemptionPeriod or pendingDelete means the domain was deleted and you are on a clock. Act now.
A domain on hold will not work no matter what your DNS says. We go through every code in the portfolio audit checklist.
Step 3: Are the nameservers right?
The RDAP record also lists the domain's nameservers. These tell the world which servers are authoritative for your DNS.
Do they match your DNS provider? If you moved hosts, or someone did, and the nameservers still point at the old provider, you are reading a zone nobody maintains.
Are there at least two? A single nameserver is a single point of failure.
Did they change recently without you? If nameservers changed and nobody on your team did it, stop troubleshooting and treat it as a security incident. That is one step in a hijack, and we set out the full sequence in Transfer Lock Removed.
Step 4: Do the actual records exist?
Now you are inside your DNS provider's zone.
Is there an A or AAAA record for the name you are testing? Both the bare domain and www, if you use both. A missing www record is one of the most common causes of "it works for me but not for them", because one person typed it and the other did not.
Is the value correct? Compare the IP against what your host currently gives you. Hosts change IPs, sometimes with notice you missed.
Is there a conflicting record? A CNAME cannot coexist with other records on the same name. Some providers let you create the conflict and then behave unpredictably.
Is DNSSEC half-configured? This produces the most confusing version of the problem: the site works from some networks and not others, because only validating resolvers reject it. If you enabled DNSSEC, or changed DNS provider while it was enabled, suspect this immediately. See DNSSEC Explained.
Step 5: Have you actually waited?
If you changed something in the last hour, you may simply be looking at a cached answer.
The important distinction: record changes are fast, nameserver changes are slow. Your own record TTLs are typically 300 to 3,600 seconds. But the delegation records at the .com registry carry a TTL of 172,800 seconds, which is 48 hours, and you do not control that.
So changing an A record should be visible within minutes. Changing nameservers can genuinely take a day or two for some resolvers. Full detail in How Long DNS Propagation Actually Takes.
Step 6: Only now, the server
If registration, status, nameservers and records are all correct, and the name resolves to the right address, the domain is doing its job. The problem is what answers at that address.
Is the site configured for this hostname? A server hosting several sites routes by hostname. If the domain is not in its configuration, you get the wrong site or a default page. That is a different problem, covered in Why Does My Domain Show the Wrong Website.
Is the certificate valid? An expired certificate blocks visitors with a security warning even though DNS is perfect.
Is the server up at all? Test the IP address directly. If the IP does not respond, the problem is hosting, not the domain.
The quick version
| Symptom | Most likely cause |
|---|---|
| Worked for years, suddenly nothing | Expired registration or expired card |
| Stopped right after you changed hosts | Nameservers still pointing at the old provider |
| Works for some people, not others | Half-configured DNSSEC, or caching |
| Works without www, not with it | Missing www record |
| Security warning instead of the site | Expired certificate |
| Shows somebody else's website | Server hostname configuration |
| Nothing at all, and nameservers changed | Possible hijack, treat as an incident |
Common questions
Why did my domain suddenly stop working?
The most common causes are an expired registration, an expired payment card that silently failed auto-renew, or a registry hold following an unanswered contact verification email. Check the registration record before touching DNS.
How do I check if my domain is expired?
Look it up in an RDAP-based checker. It queries the registry directly and shows the registration status and expiry date, rather than guessing from whether the website responds.
What does clientHold mean?
The registry is not publishing your domain in DNS, usually because of non-payment, unverified contact details or a dispute. The domain will not work until your registrar removes it, so contact them immediately.
My domain works on my phone but not my computer, why?
Almost always local caching. Your computer or router is holding an old answer. It resolves itself when the TTL expires, and you can flush the local DNS cache to check sooner.
How long should I wait after changing DNS?
Record changes are usually visible within minutes, governed by your TTL. Nameserver changes can take up to 48 hours, because the delegation records at the registry carry a two-day TTL you do not control.
Could my domain have been stolen?
If the nameservers or registrar changed and nobody on your team did it, yes, treat it as an incident. Check the registry record for the current registrar and whether the transfer lock is still present.
Put the research to work.
Check your shortlist across the extensions that matter, then save the strongest names to a project.
Check a domain