Web Server Rescue
Read-onlyCheck the WWW CNAME Target
You need to see whether www is an alias and where it ultimately resolves.
Command
dig +short www.example.com CNAMEBefore you run this
System impact: Read-only. Low when scoped to the shown target.
When not to use it: Do not assume a CNAME target is healthy; resolve and test the target separately.
Expected output
The CNAME target for the www hostname.
System impact
Read-only. Nothing changes. The command queries DNS records only.
Recovery / rollback: no state is changed.
When to use it
Use when apex and www behave differently after a CDN or hosting change.
When not to use it
Do not assume a CNAME target is healthy; resolve and test the target separately.
next steps
Related commands
Compare Authoritative Nameserver Answers
The recursive resolver was not the problem. One nameserver disagreed.
for ns in $(dig +short NS example.com); do printf '%s ' "$ns"; dig @"$ns" +short example.com A; done
Check CAA Certificate Issuers
The certificate request failed because DNS allowed the wrong issuer.
dig +short example.com CAA
Compare A and AAAA Records
IPv4 worked. IPv6 sent users to a different edge.
printf 'A '; dig +short example.com A; printf 'AAAA '; dig +short example.com AAAA
Compare DNS Answers Across Resolvers
One resolver can still have the old edge IP while another has the new one.
for r in 1.1.1.1 8.8.8.8 9.9.9.9; do printf '%s ' "$r"; dig @"$r" +short example.com A; done
Check the Certificate Served for SNI
The IP was right. The SNI name selected the wrong certificate.
openssl s_client -connect example.com:443 -servername www.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.