How AutoSSL depends on DNS.
THE CONNECTION
AutoSSL validates that you control a domain, usually by placing a file and requesting it over HTTP.
That requires the domain to resolve to our server.
WHY AUTOSSL FAILS
The domain does not resolve here A subdomain has no DNS record A CDN or proxy intercepts the validation request A CAA record forbids the authority The domain resolves to a previous host
THE MOST COMMON
A domain not yet pointed at us. Certificates cannot be issued for a domain we do not serve.
CHECKING
Look up each domain and subdomain on the account. Each should return our server's address.
cPanel > SSL/TLS Status shows the failure reason per domain.
WITH CLOUDFLARE
Proxying can interfere with validation. A page rule bypassing cache and security for the validation path resolves it.
Or temporarily set the record to DNS only.
CAA RECORDS
Uncommon and genuinely puzzling when present. Check for one if nothing else explains the failure.
AFTER FIXING DNS
Run AutoSSL again. It does not retry immediately on its own.
