> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ownsi.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Diagnostics catalogue

> Every reason a check can fail to find your record, with the cause and the fix ownsi shows you.

A check that does not find the token never stops at "not verified". It names one of the thirteen
codes below, and the `cause` and `fix` sentences on this page are the exact strings the API
returns in `diagnosis` — they are generated from the same function the product renders.

Every claim on this page is diagnosed against `acme.com`, whose token is
`ownsi_v1_9f3a2c8d1e4b7a6053c21f8e4d7b0a95`. Yours will read your own domain and your own token.

## domain\_appended

Your panel appended the domain to what you typed, so the record landed on \_ownsi-challenge.acme.com.acme.com instead of \_ownsi-challenge.acme.com.

**What to do.** Put only \_ownsi-challenge in the Host field — the panel adds acme.com for you.

```json theme={null}
{
  "code": "domain_appended",
  "cause": "Your panel appended the domain to what you typed, so the record landed on _ownsi-challenge.acme.com.acme.com instead of _ownsi-challenge.acme.com.",
  "fix": "Put only _ownsi-challenge in the Host field — the panel adds acme.com for you.",
  "observed": {
    "name": "_ownsi-challenge.acme.com.acme.com"
  }
}
```

## record\_at\_apex

The token is on acme.com itself, not on \_ownsi-challenge.acme.com.

**What to do.** Move the record to the \_ownsi-challenge host and leave the records on acme.com alone.

```json theme={null}
{
  "code": "record_at_apex",
  "cause": "The token is on acme.com itself, not on _ownsi-challenge.acme.com.",
  "fix": "Move the record to the _ownsi-challenge host and leave the records on acme.com alone.",
  "observed": {
    "name": "acme.com",
    "value": "ownsi_v1_9f3a2c8d1e4b7a6053c21f8e4d7b0a95"
  }
}
```

## foreign\_token

\_ownsi-challenge.acme.com already carries an ownsi token, and it is not the one issued for this claim.

**What to do.** Replace its value with ownsi\_v1\_9f3a2c8d1e4b7a6053c21f8e4d7b0a95.

```json theme={null}
{
  "code": "foreign_token",
  "cause": "_ownsi-challenge.acme.com already carries an ownsi token, and it is not the one issued for this claim.",
  "fix": "Replace its value with ownsi_v1_9f3a2c8d1e4b7a6053c21f8e4d7b0a95.",
  "observed": {
    "value": "ownsi_v1_1c05de77a4b83f2690ab4e1d6c7f8352"
  }
}
```

## expired\_token

\_ownsi-challenge.acme.com carries the token from an earlier claim of yours, and that claim has ended.

**What to do.** Change its value to ownsi\_v1\_9f3a2c8d1e4b7a6053c21f8e4d7b0a95. The record is already in the right place, so this is one edit rather than a new record.

```json theme={null}
{
  "code": "expired_token",
  "cause": "_ownsi-challenge.acme.com carries the token from an earlier claim of yours, and that claim has ended.",
  "fix": "Change its value to ownsi_v1_9f3a2c8d1e4b7a6053c21f8e4d7b0a95. The record is already in the right place, so this is one edit rather than a new record.",
  "observed": {
    "value": "ownsi_v1_4c07e9a2d61b83f5029ae7c4b1d6083f"
  }
}
```

## value\_formatted

The value at \_ownsi-challenge.acme.com is not exactly the token: your panel wrapped or padded what you pasted.

**What to do.** Set it to exactly ownsi\_v1\_9f3a2c8d1e4b7a6053c21f8e4d7b0a95, with no quotes and no surrounding spaces.

```json theme={null}
{
  "code": "value_formatted",
  "cause": "The value at _ownsi-challenge.acme.com is not exactly the token: your panel wrapped or padded what you pasted.",
  "fix": "Set it to exactly ownsi_v1_9f3a2c8d1e4b7a6053c21f8e4d7b0a95, with no quotes and no surrounding spaces.",
  "observed": {
    "value": "\"ownsi_v1_9f3a2c8d1e4b7a6053c21f8e4d7b0a95\""
  }
}
```

## no\_matching\_record

\_ownsi-challenge.acme.com carries 2 TXT records, and none of them holds your token.

**What to do.** Add the token as one more TXT record on that host, or correct the one meant to carry it.

```json theme={null}
{
  "code": "no_matching_record",
  "cause": "_ownsi-challenge.acme.com carries 2 TXT records, and none of them holds your token.",
  "fix": "Add the token as one more TXT record on that host, or correct the one meant to carry it.",
  "observed": {
    "values": [
      "v=spf1 include:_spf.google.com ~all",
      "google-site-verification=aB3"
    ]
  }
}
```

## cname\_conflict

\_ownsi-challenge.acme.com is a CNAME pointing at acme.pages.dev, and a name that holds a CNAME can hold nothing else (RFC 1034).

**What to do.** Remove the CNAME on \_ownsi-challenge, then create the TXT record.

```json theme={null}
{
  "code": "cname_conflict",
  "cause": "_ownsi-challenge.acme.com is a CNAME pointing at acme.pages.dev, and a name that holds a CNAME can hold nothing else (RFC 1034).",
  "fix": "Remove the CNAME on _ownsi-challenge, then create the TXT record.",
  "observed": {
    "target": "acme.pages.dev"
  }
}
```

## record\_absent

Nothing exists at \_ownsi-challenge.acme.com — the record was never created, or it was saved under a different name.

**What to do.** Create a TXT record on \_ownsi-challenge with the value ownsi\_v1\_9f3a2c8d1e4b7a6053c21f8e4d7b0a95.

```json theme={null}
{
  "code": "record_absent",
  "cause": "Nothing exists at _ownsi-challenge.acme.com — the record was never created, or it was saved under a different name.",
  "fix": "Create a TXT record on _ownsi-challenge with the value ownsi_v1_9f3a2c8d1e4b7a6053c21f8e4d7b0a95.",
  "observed": {
    "answer": {
      "type": "nxdomain"
    }
  }
}
```

## record\_on\_www

The token is on \_ownsi-challenge.[www.acme.com](http://www.acme.com); the proof reads \_ownsi-challenge.acme.com, without the [www](http://www).

**What to do.** Create the record on \_ownsi-challenge at acme.com, and remove the one under [www](http://www).

```json theme={null}
{
  "code": "record_on_www",
  "cause": "The token is on _ownsi-challenge.www.acme.com; the proof reads _ownsi-challenge.acme.com, without the www.",
  "fix": "Create the record on _ownsi-challenge at acme.com, and remove the one under www.",
  "observed": {
    "name": "_ownsi-challenge.www.acme.com",
    "value": "ownsi_v1_9f3a2c8d1e4b7a6053c21f8e4d7b0a95"
  }
}
```

## not\_published

dana.ns.cloudflare.com and rick.ns.cloudflare.com answer for acme.com and do not have the record, so nothing is spreading yet.

**What to do.** Reopen the record in your panel and confirm it saved — some panels hold zone changes in a draft until you publish them.

```json theme={null}
{
  "code": "not_published",
  "cause": "dana.ns.cloudflare.com and rick.ns.cloudflare.com answer for acme.com and do not have the record, so nothing is spreading yet.",
  "fix": "Reopen the record in your panel and confirm it saved — some panels hold zone changes in a draft until you publish them.",
  "observed": {
    "nameservers": [
      "dana.ns.cloudflare.com",
      "rick.ns.cloudflare.com"
    ]
  }
}
```

## negative\_cache

Your nameservers have the record; the public resolvers are still holding the "does not exist" they cached before you created it.

**What to do.** Nothing to do — that memory expires in about 4 minutes, and ownsi rechecks on its own.

```json theme={null}
{
  "code": "negative_cache",
  "cause": "Your nameservers have the record; the public resolvers are still holding the \"does not exist\" they cached before you created it.",
  "fix": "Nothing to do — that memory expires in about 4 minutes, and ownsi rechecks on its own.",
  "observed": {
    "secondsRemaining": 240
  }
}
```

## servfail

cloudflare and quad9 answered SERVFAIL for \_ownsi-challenge.acme.com, which means the zone fails to validate rather than that the record is missing.

**What to do.** Check DNSSEC at your provider — while the signatures are broken, no record in acme.com can be read.

```json theme={null}
{
  "code": "servfail",
  "cause": "cloudflare and quad9 answered SERVFAIL for _ownsi-challenge.acme.com, which means the zone fails to validate rather than that the record is missing.",
  "fix": "Check DNSSEC at your provider — while the signatures are broken, no record in acme.com can be read.",
  "observed": {
    "resolvers": [
      "cloudflare",
      "quad9"
    ]
  }
}
```

## lame\_delegation

acme.com is delegated to ns1.oldhost.example and ns2.oldhost.example, and none of them answered.

**What to do.** This is a delegation problem at your provider, not a problem with the record — the nameservers acme.com points at are not serving the zone.

```json theme={null}
{
  "code": "lame_delegation",
  "cause": "acme.com is delegated to ns1.oldhost.example and ns2.oldhost.example, and none of them answered.",
  "fix": "This is a delegation problem at your provider, not a problem with the record — the nameservers acme.com points at are not serving the zone.",
  "observed": {
    "nameservers": [
      "ns1.oldhost.example",
      "ns2.oldhost.example"
    ]
  }
}
```