A DNS Record That Looked Broken And Wasn't

# A DNS Record That Looked Broken And Wasn't Cutting a production domain over during a platform migration, the TLS certificate wouldn't issue and every lookup tool disagreed with every other lookup tool. My first read was a split-nameserver problem — the registrar's nameservers and the new host's nameservers answering differently, a classic and genuinely nasty failure mode where different resolvers see different truth depending on which server they happen to hit. ## Chasing the wrong root cause I spent real time on that theory because it fit the symptoms: intermittent resolution, a certificate authority that couldn't validate ownership, dig output that looked inconsistent run to run. Split-nameserver bugs are real, and assuming one wasn't unreasonable given what I was seeing. But every fix aimed at that theory — flushing caches, forcing a specific resolver, waiting out TTLs — did nothing, which is usually the signal that the theory itself is wrong, not that it needs more patience. ## What was actually there The real problem was much smaller: a domain-ownership verification record had been published without a required prefix. The record existed, the value was correct, but it lived at the wrong hostname — invisible to the exact automated check that needed it, while still showing up as "present" to a human eyeballing the zone file, because a person reads a TXT record and confirms the value looks right without necessarily checking that it's mounted at the precise subdomain the validator expects. ## The lesson A confusing DNS symptom pulls hard toward the exotic explanation, because exotic explanations are more interesting and more defensible if you're wrong. But the boring failure — one record, wrong hostname, right value — is far more common, and it's cheap to rule out first: diff the exact hostname the validator is checking against the exact hostname the record is published at, before reaching for theories about resolver disagreement. I fixed the prefix, DNS propagated normally, and the certificate issued within minutes. The "inconsistent" dig output the whole time had just been caching lag on a record that was wrong in a boring, single way.