Diagnostics catalogue

{
  "code": "domain_appended",
  "cause": "Your panel appended the domain to what you typed, so the record landed on _ownsi-challenge.acme.com.acme.com instead of _ownsi-challenge.acme.com.",
  "fix": "Put only _ownsi-challenge in the Host field — the panel adds acme.com for you.",
  "observed": {
    "name": "_ownsi-challenge.acme.com.acme.com"
  }
}

{
  "code": "record_at_apex",
  "cause": "The token is on acme.com itself, not on _ownsi-challenge.acme.com.",
  "fix": "Move the record to the _ownsi-challenge host and leave the records on acme.com alone.",
  "observed": {
    "name": "acme.com",
    "value": "ownsi_v1_9f3a2c8d1e4b7a6053c21f8e4d7b0a95"
  }
}

{
  "code": "foreign_token",
  "cause": "_ownsi-challenge.acme.com already carries an ownsi token, and it is not the one issued for this claim.",
  "fix": "Replace its value with ownsi_v1_9f3a2c8d1e4b7a6053c21f8e4d7b0a95.",
  "observed": {
    "value": "ownsi_v1_1c05de77a4b83f2690ab4e1d6c7f8352"
  }
}

{
  "code": "expired_token",
  "cause": "_ownsi-challenge.acme.com carries the token from an earlier claim of yours, and that claim has ended.",
  "fix": "Change its value to ownsi_v1_9f3a2c8d1e4b7a6053c21f8e4d7b0a95. The record is already in the right place, so this is one edit rather than a new record.",
  "observed": {
    "value": "ownsi_v1_4c07e9a2d61b83f5029ae7c4b1d6083f"
  }
}

{
  "code": "value_formatted",
  "cause": "The value at _ownsi-challenge.acme.com is not exactly the token: your panel wrapped or padded what you pasted.",
  "fix": "Set it to exactly ownsi_v1_9f3a2c8d1e4b7a6053c21f8e4d7b0a95, with no quotes and no surrounding spaces.",
  "observed": {
    "value": "\"ownsi_v1_9f3a2c8d1e4b7a6053c21f8e4d7b0a95\""
  }
}

{
  "code": "no_matching_record",
  "cause": "_ownsi-challenge.acme.com carries 2 TXT records, and none of them holds your token.",
  "fix": "Add the token as one more TXT record on that host, or correct the one meant to carry it.",
  "observed": {
    "values": [
      "v=spf1 include:_spf.google.com ~all",
      "google-site-verification=aB3"
    ]
  }
}

{
  "code": "cname_conflict",
  "cause": "_ownsi-challenge.acme.com is a CNAME pointing at acme.pages.dev, and a name that holds a CNAME can hold nothing else (RFC 1034).",
  "fix": "Remove the CNAME on _ownsi-challenge, then create the TXT record.",
  "observed": {
    "target": "acme.pages.dev"
  }
}

{
  "code": "record_absent",
  "cause": "Nothing exists at _ownsi-challenge.acme.com — the record was never created, or it was saved under a different name.",
  "fix": "Create a TXT record on _ownsi-challenge with the value ownsi_v1_9f3a2c8d1e4b7a6053c21f8e4d7b0a95.",
  "observed": {
    "answer": {
      "type": "nxdomain"
    }
  }
}

{
  "code": "record_on_www",
  "cause": "The token is on _ownsi-challenge.www.acme.com; the proof reads _ownsi-challenge.acme.com, without the www.",
  "fix": "Create the record on _ownsi-challenge at acme.com, and remove the one under www.",
  "observed": {
    "name": "_ownsi-challenge.www.acme.com",
    "value": "ownsi_v1_9f3a2c8d1e4b7a6053c21f8e4d7b0a95"
  }
}

{
  "code": "not_published",
  "cause": "dana.ns.cloudflare.com and rick.ns.cloudflare.com answer for acme.com and do not have the record, so nothing is spreading yet.",
  "fix": "Reopen the record in your panel and confirm it saved — some panels hold zone changes in a draft until you publish them.",
  "observed": {
    "nameservers": [
      "dana.ns.cloudflare.com",
      "rick.ns.cloudflare.com"
    ]
  }
}

{
  "code": "negative_cache",
  "cause": "Your nameservers have the record; the public resolvers are still holding the \"does not exist\" they cached before you created it.",
  "fix": "Nothing to do — that memory expires in about 4 minutes, and ownsi rechecks on its own.",
  "observed": {
    "secondsRemaining": 240
  }
}

{
  "code": "servfail",
  "cause": "cloudflare and quad9 answered SERVFAIL for _ownsi-challenge.acme.com, which means the zone fails to validate rather than that the record is missing.",
  "fix": "Check DNSSEC at your provider — while the signatures are broken, no record in acme.com can be read.",
  "observed": {
    "resolvers": [
      "cloudflare",
      "quad9"
    ]
  }
}

{
  "code": "lame_delegation",
  "cause": "acme.com is delegated to ns1.oldhost.example and ns2.oldhost.example, and none of them answered.",
  "fix": "This is a delegation problem at your provider, not a problem with the record — the nameservers acme.com points at are not serving the zone.",
  "observed": {
    "nameservers": [
      "ns1.oldhost.example",
      "ns2.oldhost.example"
    ]
  }
}