Troubleshoot custom domains

When adding a new custom domain, no products appear in the Products dropdown.

This happens when you either don’t have a product that supports custom domains, or you have already configured a custom domain for every supported product.

‘Unable to find matching CNAME records. Check your DNS entries for this domain’ error.

This error happens when we can’t detect one or all of the required CNAME records on your DNS.

Users will get a 404 error when trying to access your product using the custom domain.

To resolve this, make a note of the required records (you can get this from the details view), then check your DNS provider.

‘We suspended this domain because <reason>’ error.

These errors happen when we detect changes to your DNS that may be suspicious.

In some cases the changes may be legitimate, but we suspend your custom domain immediately as a precaution.

If this happens, contact our support team for assistance.

Status is still ‘provisioned’ after records have been added to DNS provider.

Generally it takes several hours for DNS records to propagate, but may take longer depending on your DNS provider.

If the status has not changed to 'Inactive’ after 24-48 hours:

• Check that you’ve added all the required records correctly.

• Check whether your DNS uses CAA records to control which Certificate Authorities can issue certificates for your domain. Learn more about CAA problems

If the status is still Provisioned after 60 days we delete the custom domain request.

‘We’re unable to create the custom domain. This may be because the product is no longer available, or the domain is already in use’ error

This error can happen when something changes between selecting the product and entering your domain details, and creating the custom domain.

For example, the target product is removed, or its plan changed to Free, another admin creates a domain for the same product, or we detect that the fully qualified domain name is now in use.

‘Domain can’t include ‘www’.’ error when requesting a custom domain.

We use the public suffix list to confirm that what you enter in the domain field is a valid effective top-level domain. View the public suffix list

If you want your custom domain to begin with ‘www', you can enter that in the subdomain field.

‘Unable to set up a custom domain because of an existing CloudFront distribution with the same name’ error

This error happens when you set up a CloudFront distribution with a domain that uses the same name.

To solve this, delete your CloudFront distribution and the custom domain, then create a new custom domain.

Problem

Recommended action

‘Unable to issue a certificate for your domain. AWS requires additional verification for domains that are sensitive or very popular.’ error after creating a domain.

This error happens when the domain name you requested is on the AWS list of popular domain names or the top-level domain is sensitive or subject to sanctions. Learn about AWS Certificate Manager’s verification requirements

If this happens, contact our support team for assistance.

‘Unable to issue a certificate for your domain. Your DNS uses CAA records to block some Certificate Authorities.’ error after requesting a domain.

Check whether your DNS uses CAA records to control which Certificate Authorities can issue certificates for your domain.

To resolve this you will need to:

• Add a CAA record for amazon.com to resolve this. Learn more about CAA problems

• Delete this custom domain and create a new one.

‘Unable to issue a certificate for your domain. This is because VirusTotal reports this domain as potentially unsafe.’ error after requesting a domain.

VirusTotal is a service that analyzes files and URLs for viruses, worms, trojans and other kinds of malicious content.

You won’t be able to create a custom domain if the fully qualified domain name or redirect URL you entered is reported as potentially unsafe.

To resolve this you will need to:

• Look up your domain on VirusTotal to investigate the source and cause of the report. Search VirusTotal

• Notify the organization that reported the domain to resolve the issue and update VirusTotal.

• Delete this custom domain and create a new one.

‘A certificate already exists for that domain’ error.

This error happens when we attempt to create the SSL certificate for your custom domain, but detect an existing one that matches the domain you specified.

Usually this is because a certificate uses a wildcard, such as *.example.com . You may need to work with your network administrator to resolve this.

‘We detected another certificate that matches your domain’ error.

This error happens when we detect a new certificate that matches the domain you created, but have not yet activated.

As above, this may be due to a certificate that uses a wildcard. We require a unique certificate for each fully qualified domain name, and you can’t bring your own certificate.

To resolve this you will need to delete your custom domain and create a new one.