Netlify DNS Configuration How to Set Up and Troubleshoot Your Domain

Netlify makes deploying static sites and serverless apps remarkably fast, but DNS configuration is still the step where most users hit a wall. Whether you're pointing a domain you registered elsewhere, trying to get a wildcard subdomain working, or scratching your head over why your HTTPS certificate won't provision, the root cause is almost always a DNS misconfiguration. This guide covers every scenario you're likely to encounter — from registrar setup to CLI verification — so you can get your domain live and keep it that way.

Two Ways to Use DNS with Netlify

Before touching any records, understand which DNS model you're using. Netlify offers two distinct approaches, and mixing them up causes most of the confusion.

• Netlify DNS (managed nameservers): You delegate your entire domain to Netlify's nameservers (dns1.p01.nsone.net through dns4.p01.nsone.net). Netlify manages all your records, including the automatic ALIAS/ANAME record for the apex domain. This is the recommended path for most users.
• External DNS: You keep your existing nameservers (at GoDaddy, Namecheap, Cloudflare, etc.) and manually add A/CNAME records pointing to Netlify's load balancer. This gives you more registrar-level control but requires more manual work.

Method 1: Using Netlify DNS (Recommended)

Step 1 — Add Your Domain in Netlify

1. Log into app.netlify.com.
2. Navigate to Team overview → Domains (or go directly to your site, then Site configuration → Domain management → Domains).
3. Click Add or register domain, enter your apex domain (e.g., example.com), and click Verify.
4. Netlify will check WHOIS to confirm you own it, then display your four assigned nameservers.

Step 2 — Delegate Nameservers at Your Registrar

Log into wherever you registered the domain and replace the existing nameservers with Netlify's. The exact path varies by registrar:

• GoDaddy: My Products → DNS → Nameservers → Change → Enter my own nameservers
• Namecheap: Domain List → Manage → Nameservers → Custom DNS
• Google Domains / Squarespace: DNS → Name servers → Use custom name servers
• Cloudflare Registrar: DNS → Nameservers (note: if Cloudflare is your registrar, you can still delegate out, but this disables Cloudflare's proxy for this domain)

Enter all four Netlify nameservers. Do not leave any old nameservers in the list — partial delegation causes intermittent resolution failures.

Step 3 — Wait for Delegation to Propagate

NS record changes can take anywhere from 15 minutes to 48 hours depending on your registrar's TTL and how aggressively global resolvers cache. Most users see propagation within 1–4 hours. You can monitor it with:

When all three return Netlify's nameservers, delegation is complete.

Step 4 — Verify HTTPS Provisioning

Once delegation propagates, Netlify automatically provisions a free Let's Encrypt certificate. Go to Site configuration → Domain management → HTTPS and click Verify DNS configuration. If it's stuck on "Awaiting certificate provisioning," the most common cause is that NS propagation isn't complete yet. Wait 30 more minutes and try again.

Method 2: External DNS (Keep Your Existing Nameservers)

If you can't or don't want to delegate to Netlify DNS — for instance, you have MX or other records at a current provider you don't want to migrate — use the external DNS method.

Apex Domain (root domain) — The ALIAS/ANAME Problem

Standard DNS doesn't allow a CNAME at the zone apex (example.com itself), because RFC 1034 prohibits coexisting a CNAME with SOA/NS records. Netlify's load balancer IP is not static, so an A record pointing to a hard-coded IP is fragile. The correct approach depends on your DNS provider:

• Cloudflare: Create a CNAME for @ pointing to your-site-name.netlify.app. Cloudflare's CNAME flattening resolves it at query time. Enable the orange cloud (proxy) only if you want Cloudflare in front; disable it (gray cloud) for Netlify to handle HTTPS directly.
• DNS Made Easy, NS1, Route 53: Use their ANAME or ALIAS record type, pointed at your-site-name.netlify.app.
• GoDaddy, Namecheap (no ALIAS support): Use Netlify's published load balancer IP as an A record. At time of writing, Netlify's documented IP is 75.2.60.5. Check Netlify's official external DNS docs for the current value before hardcoding it.

www Subdomain

For www, add a CNAME record pointing to your-site-name.netlify.app. This is safe at any subdomain level and is fully standards-compliant.

Redirect Configuration Inside Netlify

Regardless of DNS method, configure which domain is the "primary" in Netlify. Go to Site configuration → Domain management → Domains, set either example.com or www.example.com as the primary domain. Netlify will automatically 301-redirect the other. Getting this backward causes redirect loops — a common misdiagnosis blamed on DNS when it's actually a Netlify configuration issue.

Adding DNS Records in Netlify DNS

When you're using Netlify as your DNS provider, managing records is done entirely in the Netlify UI:

1. Go to Team → Domains → your domain → DNS settings.
2. Click Add new record.
3. Choose record type (A, AAAA, CNAME, MX, TXT, SRV, CAA, NS).
4. Fill in the Name (leave blank or use @ for apex), TTL (300 is a safe default), and value.

Common records you'll likely need:

• MX records for Google Workspace, Microsoft 365, or Zoho Mail
• TXT records for SPF, DKIM, DMARC, and domain verification (Google Search Console, etc.)
• CNAME records for subdomains like blog.example.com pointing to a CMS or third-party service
• CAA records if you want to restrict which CAs can issue certificates for your domain

CLI Verification Commands

Don't guess — verify. These commands work across platforms and give you ground truth about what's actually in DNS.

Linux and macOS

Windows (PowerShell / Command Prompt)

Linux with systemd-resolved

Common Problems and Exact Fixes

Problem: "Check DNS configuration" Error Won't Clear

This appears in Site configuration → Domain management → HTTPS. Root causes in order of frequency:

1. NS delegation incomplete: Run dig NS example.com @8.8.8.8. If it still shows your old registrar's nameservers, wait longer or check your registrar for errors.
2. DNSSEC not disabled: If your domain had DNSSEC enabled at the old provider and you switched nameservers without removing the DS record at the registrar, you'll get SERVFAIL errors. Log into your registrar and delete DS records before or immediately after changing nameservers.
3. CAA record blocking Let's Encrypt: Run dig CAA example.com +short. If you see a CAA record that doesn't include letsencrypt.org, Netlify can't issue a certificate. Add 0 issue "letsencrypt.org" or remove the restrictive CAA record.
4. Propagation not complete: Netlify's provisioning system checks from specific vantage points. Even if your local dig resolves correctly, provisioning might check from a region that hasn't propagated yet. Give it up to 4 hours before escalating.

Problem: Apex Domain Resolves but www Returns NXDOMAIN

You forgot to add the www custom domain in Netlify. Go to Site configuration → Domain management → Domains → Add domain alias and add www.example.com explicitly. Then add the corresponding CNAME record in your DNS provider.

Problem: www Works but Apex Returns Cloudflare's Default Page

This happens when Cloudflare is proxying the apex but Netlify isn't set as the origin. Either: (a) point the Cloudflare CNAME/A record to Netlify's address and make sure the CNAME flattening resolves to Netlify, or (b) disable Cloudflare proxy for the apex record (gray cloud) and let Netlify handle it end-to-end. Using both Cloudflare proxy and Netlify HTTPS simultaneously causes certificate conflicts — pick one to terminate TLS.

Problem: Subdomain Redirects to Wrong Site

If you have multiple Netlify sites and a subdomain is landing on the wrong one, check that the subdomain is added as a custom domain on the correct site, not just present as a DNS record. A CNAME pointing to netlify.app isn't enough — the subdomain must be registered under that specific site in Netlify's UI.

Problem: MX Records Not Working After Moving to Netlify DNS

When you migrate to Netlify DNS, none of your old records transfer automatically. Before changing nameservers, export all existing records from your current provider and re-enter them in Netlify DNS. Failing to migrate MX and SPF records before the NS cutover is the single most common cause of email outages during a Netlify migration.

DNSSEC on Netlify

As of 2026, Netlify DNS does not sign zones with DNSSEC. If your domain had DNSSEC enabled with a previous provider, you must remove the DS record at your registrar before or immediately after pointing to Netlify's nameservers. Leaving a stale DS record causes DNSSEC validation failures — resolvers that validate (including most ISP resolvers and Google's 8.8.8.8) will return SERVFAIL for your entire domain, making it unreachable for a significant portion of users.

Verify with:

If dig DS returns a record but you're now on Netlify's unsigned nameservers, log into your registrar immediately and delete the DS record. Allow up to 48 hours for the DS record TTL to expire globally.

IPv6 and AAAA Records

Netlify's load balancer supports IPv6. If you're using Netlify DNS, an AAAA record is automatically created alongside the A record for your apex domain. If you're using external DNS, you can optionally add Netlify's AAAA address — check the current value in your Netlify dashboard under the domain's DNS settings, as Netlify may update it. For dual-stack environments (most modern networks), having both A and AAAA records improves availability and can slightly reduce latency for IPv6-native clients.

DNS over HTTPS (DoH) and Troubleshooting Gotchas

Modern browsers (Chrome, Firefox, Edge) and operating systems increasingly use DNS over HTTPS by default, which bypasses your OS resolver and queries DoH providers directly (Cloudflare, Google, or your ISP's DoH endpoint). This means flushing your OS DNS cache may not help if your browser has its own DoH cache. To force a fresh lookup during troubleshooting:

• Chrome/Edge: Navigate to chrome://net-internals/#dns → Clear host cache
• Firefox: Settings → Privacy & Security → DNS over HTTPS → scroll to clear, or disable DoH temporarily during testing
• iOS 14+: DNS settings may be set by a configuration profile (MDM or DNS app like 1.1.1.1 app). Check Settings → General → VPN & Device Management
• Android 9+: Settings → Network & internet → Advanced → Private DNS — this sets DoT, not OS resolver

When testing propagation, always use dig or nslookup directly rather than relying on your browser, since browser-level DoH caches are separate from OS caches and have different TTL handling. For a reference on how DNS resolution standards work at the protocol level, see RFC 1035 at the IETF.

Pre-Migration Checklist to Prevent Recurrence

Follow this before making any DNS changes to avoid downtime:

1. Export all current DNS records (A, AAAA, CNAME, MX, TXT, SRV, CAA) from your existing provider.
2. Lower all record TTLs to 300 seconds at least 24 hours before migration so old values expire quickly.
3. Add all necessary records to Netlify DNS before changing nameservers.
4. Remove any DS records (DNSSEC) from your registrar before switching nameservers.
5. Change nameservers during low-traffic hours.
6. Monitor propagation from multiple resolvers for the first 4 hours.
7. Test apex, www, mail, and any critical subdomains individually after propagation completes.
8. Verify HTTPS certificate provisioned successfully in Netlify's dashboard.

Common Misdiagnoses

• "It's not propagating" when actually NS delegation was never saved at the registrar (check the registrar's current NS settings explicitly — don't assume the save worked).
• "Netlify's servers are down" when actually your browser is caching an old A record or a DoH response. Use dig to verify independently.
• "The redirect loop is a Netlify bug" when actually the primary domain is misconfigured in Netlify, or Cloudflare's "Always Use HTTPS" conflicts with Netlify's own redirect.
• "My SSL certificate expired" when actually the domain's A record changed and Netlify can no longer validate the domain for auto-renewal. Check that all custom domains still resolve to Netlify.