Skip to content
Browse documentation

Certificate and DNS problems

Fix tracking domains that stay pending, fail ownership checks, show certificate errors or stop working after a DNS change.

Last updated 4 min read

On this page

A tracking domain works when three things are true: its DNS points to TrackCrown's servers, (for your own domains) a TXT record proves you control it, and an HTTPS certificate has been issued. The Tracking domains page (/app/domains) shows each domain's status, the last DNS check error and the HTTPS state.

How activation works#

  1. You add the hostname on Tracking domains. It starts as pending and the dialog shows the DNS records to create.
  2. TrackCrown re-checks pending domains every minute (use Check now after your DNS change propagates). Active domains are re-checked hourly but never switched off automatically by a DNS hiccup.
  3. A domain becomes active when:
    • its A/AAAA record, or the end of its CNAME chain, resolves to one of TrackCrown's server addresses, and
    • for a workspace's own domain: the TXT record _arctrack-verify.<hostname> holds the exact value shown (arctrack-verify=…; the record name and prefix are fixed technical identifiers, the same for every brand).
  4. The first HTTPS request to the active domain triggers the certificate (Let's Encrypt, ZeroSSL as fallback). It takes a few seconds and renews automatically about 30 days before expiry.

A workspace domain still pending 14 days after it was added, never verified, is disabled with the error verification expired. Add it again to restart.

The DNS records#

RecordNameValueUse
TXT_arctrack-verify.trk.example.comarctrack-verify=… (shown in the dialog)Ownership proof (workspace domains only)
CNAMEtrk.example.comThe brand's tracking host shown in the dialogSubdomains (recommended) — follows server changes
Atrk.example.comEach server IPv4 shown in the dialogRoot domains (a root domain cannot be a CNAME)

Remove every other A, AAAA or CNAME record for the same name first.

Domain stays pending#

Read the error under the domain (hover the status) and check from a terminal:

Shell
dig +short CNAME trk.example.com
dig +short A trk.example.com
dig +short TXT _arctrack-verify.trk.example.com
SymptomCauseFix
ownership TXT record _arctrack-verify.… not foundTXT missing, on the wrong name, or with quotes/extra text.Create it exactly as shown. Some DNS providers append the zone automatically — enter only _arctrack-verify.trk there.
dig A shows Cloudflare addresses (104.x, 172.67.x)The record is proxied (orange cloud).Switch it to DNS only (grey cloud). Proxied records never verify, and a proxy in front of a tracker breaks Google certification.
dig A shows an old addressThe old record is still cached.Wait for its TTL to expire (use TTL 300 while setting up).
An AAAA record points elsewhereMixed records.Delete the AAAA record unless the dialog lists IPv6 addresses.
ownership TXT lookup … timed outYour DNS provider did not answer.Wait and use Check now; check the provider's status.

Certificate errors#

The HTTPS column shows Unreachable, Timed out, Certificate expired, Invalid certificate or Failed; hover for the full error and use the re-check button after fixing.

SymptomCauseFix
Browser shows a certificate for another name, or a TLS handshake errorThe domain is still pending (no certificate is requested before it is active), or the first request has not happened yet.Activate the domain, then open https://trk.example.com/healthz once.
Issuance keeps failingPorts 80/443 do not reach TrackCrown (a proxy or another server answers), or a CAA record forbids the certificate authority.Remove the proxy; if your zone has CAA records, allow letsencrypt.org (and sectigo.com for ZeroSSL).
Worked before, fails after a DNS changeThe record no longer points to TrackCrown. Active domains stay active, but certificates cannot renew.Restore the record.
Too many failed attemptsCertificate authorities rate-limit repeated failures for a hostname (about 5 failures per hour).Fix the cause, then wait an hour.

Verify a domain end to end:

Shell
H=trk.example.com
curl -sS -o /dev/null -w '%{http_code} %{ssl_verify_result}\n' https://$H/healthz   # 200 0
curl -sS -o /dev/null -w '%{http_code}\n' http://$H/healthz                        # 308 (redirect to HTTPS)

CNAME on the advertiser's domain#

An advertiser can serve tracking from a subdomain of their own site (for example track.shop.com CNAME to a brand tracking domain) with Advertiser CNAME on the Tracking domains page. Publish the TXT record shown; the domain turns active when both records resolve. Such a subdomain of the final-URL domain does not need its own Google certification.

Domains for Google Ads#

Google tests the certificate and the single 302 of each tracking domain. Keep tracking domains:

  • DNS only — no CDN, proxy, WAF, bot fight mode or challenge pages;
  • free of AAAA records that point elsewhere;
  • on a certificate that is valid and renewing. The Certificate column (hourly TLS check) shows the days left — amber at 21 days or fewer, red at 7 or fewer — or the handshake error. A certificate that is not renewed by then needs attention.

See Google Ads test failures.

Something unclear or missing in this article?Tell us