Web Server Rescue
Read-onlyCheck CAA Certificate Issuers
You need to see which certificate authorities are allowed to issue for a domain.
Command
dig +short example.com CAABefore you run this
System impact: Read-only. Low when scoped to the shown target.
When not to use it: Do not assume missing CAA is a failure; many domains intentionally omit CAA records.
Expected output
CAA issue and contact records for the domain.
System impact
Read-only. Nothing changes. The command queries DNS CAA records.
Recovery / rollback: no state is changed.
When to use it
Use before debugging failed certificate issuance or changing ACME providers.
When not to use it
Do not assume missing CAA is a failure; many domains intentionally omit CAA records.
next steps
Related commands
Compare A and AAAA Records
IPv4 worked. IPv6 sent users to a different edge.
printf 'A '; dig +short example.com A; printf 'AAAA '; dig +short example.com AAAA
Compare Authoritative Nameserver Answers
The recursive resolver was not the problem. One nameserver disagreed.
for ns in $(dig +short NS example.com); do printf '%s ' "$ns"; dig @"$ns" +short example.com A; done
Compare DNS Answers Across Resolvers
One resolver can still have the old edge IP while another has the new one.
for r in 1.1.1.1 8.8.8.8 9.9.9.9; do printf '%s ' "$r"; dig @"$r" +short example.com A; done
Check the WWW CNAME Target
The apex was right. The www name pointed through a different path.
dig +short www.example.com CNAME
Show the DNS Answer TTL
The fix was correct. The TTL explained why users still saw the old edge.
dig +noall +answer example.com A
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.