How to Fix Shopify Domain DNS Error?

Shopify shows a domain DNS error or Needs attention badge when it cannot confirm the public DNS configuration for the custom domain connected to your store.

The store and theme may still work through the original myshopify.com address. What has failed is the route from your custom address to Shopify, or the certificate Shopify needs before that address can open securely over HTTPS.

The message beside the domain matters. A missing A, AAAA, or CNAME record needs a DNS correction. SSL pending can mean Shopify is still issuing the certificate, while This domain requires verification belongs to a separate ownership check.

1. Check the Exact Warning and the DNS Provider in Control

The records visible at the company that sold you the domain are not always the records being published. Checking the nameservers confirms which provider answers DNS requests, so you do not spend time editing an inactive zone.

This check is not needed when Shopify already names the faulty record and you have confirmed which provider publishes the domain’s DNS.

1. In Shopify, open Settings > Domains, select the affected domain, and write down the exact warning. Shopify’s domain troubleshooting page explains each current Needs attention message.
2. Confirm that the domain registration is active and has not expired, been suspended, or been placed on hold.
3. Check whether Shopify labels it as a Shopify-managed domain or a third-party domain.
4. For a Shopify-managed domain, open Settings > Domains > [domain] > DNS settings > Manage. Shopify normally creates the core records. Use its DNS settings instructions to reset only the record named in the warning.
5. For a third-party domain, open Nameservers. Shopify expects the provider’s default nameservers, not custom nameservers. Before switching, save the active zone; then recreate the Shopify, email, verification, and subdomain records with the provider.
6. If an EU domain shows an action or nameserver warning, check the registrant email address for a registry verification request before editing more records.

   

If Shopify begins reading the records after the nameserver or registration issue is corrected, leave the rest of the zone unchanged. If the warning remains, continue below and compare the three storefront records.

2. Fix the A, AAAA, and www CNAME Records Without Disturbing Email

A manually connected third-party domain needs one route for the root address, one IPv6 route, and one alias for www. The connection fails when duplicate root records send different visitors to different servers.

Do not use the default table to overwrite a different regional A record that Shopify already marks as valid.

Use the exact value displayed in Shopify when it differs from the default above. Shopify can assign a valid regional A record such as 23.227.38.32 or 23.227.38.68; a different final number is not automatically an error.

1. Open the active DNS zone identified in Method 1.
2. Compare the root A record with the address shown in Shopify > Settings > Domains. Keep one Shopify A record and remove only additional root A records that point elsewhere.
3. Set the root AAAA record to 2620:0127:f00f:5::. If the provider rejects the shortened form, use 2620:0127:f00f:0005:0000:0000:0000:0000.
   
4. Set the www CNAME to shops.myshopify.com.. Some DNS providers add the final period automatically, so do not add a second one if the interface already normalizes the value.
5. Leave only one root AAAA record and one www record. Other CNAME records can remain when they use unique names such as shop, email, or help.
6. Do not remove MX or TXT records just because they are not listed in Shopify’s storefront requirements. They can belong to email, search verification, or another service.

   

Shopify’s manual domain connection instructions confirm the current IPv4, IPv6, and www values. Keep the provider’s default TTL unless Shopify or the provider gives a specific reason to change it.

If Shopify accepts the records, leave the zone stable. If the values are correct but Shopify reports a proxy or wildcard, continue below.

3. Remove a Shopify-Facing Cloudflare Proxy or Wildcard Record

The records can contain the correct text and still fail Shopify’s check when Cloudflare proxies them. Switching the Shopify records to DNS only removes the orange-cloud proxy while you confirm the warning.

This section is not needed when the domain does not use Cloudflare and Shopify does not flag a wildcard record.

1. If Cloudflare controls the nameservers, open Cloudflare > DNS > Records.
2. Set the A, AAAA, and www records used by Shopify to DNS only.
3. Wait up to 24 hours before judging a proxy warning that remains after the switch. Shopify notes that the warning can take time to clear.

   

4. Find any wildcard record named * or *.example.com that points to Shopify and remove that record.
5. Create separate records for the subdomains you actually use. Do not delete a wildcard that belongs to another service without confirming what it handles.

   

If you intentionally use a custom Cloudflare Orange-to-Orange configuration, do not replace it with this standard setup without reviewing the service design.

Shopify currently treats Cloudflare DNS and Orange-to-Orange proxying as unsupported. The fully supported long-term setup is the domain provider’s default nameservers; a custom proxy configuration belongs with Cloudflare rather than Shopify Support.

If the proxy or wildcard warning clears, leave those records unchanged. If Shopify now shows SSL pending, continue below.

4. Fix SSL Pending with the Correct DNSSEC and CAA Settings

SSL pending is normal for up to 48 hours after a clean domain connection. It becomes a configuration problem when Shopify also names DNSSEC or CAA, or when the public records are correct and the certificate still has not been issued after that period.

Correcting a rejected DNSSEC signature or restrictive CAA policy prevents the domain’s security rules from blocking Shopify’s approved certificate authorities.

This section is not needed when Shopify already shows the certificate as provisioned and the storefront opens securely on another device.

1. Confirm the A, AAAA, and CNAME records from Method 2 before changing certificate settings. SSL cannot finish while the domain still points elsewhere.
2. For a third-party domain, open the provider’s DNS security settings and deactivate DNSSEC. If the option is unavailable, ask the provider to remove it.
3. If a Shopify-managed domain reports an inherited or unsupported DNSSEC record, contact Shopify Support instead of trying to remove it at another registrar.

   

4. Review the domain’s CAA records. If no CAA records exist, you do not need to create them unless Shopify specifically asks.
5. If your organization keeps a CAA policy, it must permit letsencrypt.org, pki.goog, and ssl.com. Remove an invalid semicolon or unrelated restrictive CAA value that blocks those authorities.
6. Save the change and allow up to 48 hours for DNS propagation and certificate issuance.

   

If the records are publicly correct and SSL pending remains after 48 hours, ask Shopify to check or reprovision the certificate.

Investigate a browser-side connection privacy warning locally only when Shopify shows the certificate as provisioned and the store opens securely on other devices.

If the storefront opens securely, the certificate is ready. If Shopify is still asking for ownership verification, continue below.

5. Verify Ownership When the Domain Belongs to Another Store

The message This domain requires verification appears when Shopify finds the third-party domain on another store. The TXT record confirms that you control its DNS before Shopify moves the connection.

Do not add a verification TXT record unless Shopify displays this message and provides the unique value.

1. In the new store, open Settings > Domains and select Connect existing.
2. Enter the root domain without www.
3. If Shopify offers automatic verification for your provider, follow that sign-in flow. Otherwise, copy the unique TXT value shown under Verify domain ownership.
4. At the active DNS provider, add a TXT record named shopify_verification and paste the value supplied by Shopify.

   

5. For a subdomain such as shop.example.com, use the name Shopify provides, normally shopify_verification_shop.
6. Return to Shopify and select Verify connection. Verification can take up to 48 hours.

Shopify’s ownership verification instructions apply only when this message appears.

If Shopify accepts the verification, the domain should leave the old store automatically. Disconnect it there manually if you still have access and Shopify leaves it attached. If a DNS warning remains instead, continue below.

6. Check the Live Records, Then Contact the Provider That Owns the Failure

The Shopify status can remain unchanged when public DNS resolvers still hold an earlier answer. Repeated edits during that window make it harder to tell whether the corrected record has reached Shopify.

A public lookup helps because it shows the records Shopify and visitors can actually receive, not just the values saved in a provider’s dashboard.

Do not use the 48-hour wait to postpone an expired-domain renewal or an explicit provider verification request; those conditions require action first.

1. After the final correction, stop editing the zone and allow up to 48 hours.
2. Use a public DNS lookup to check the root domain’s A and AAAA answers, then check the www CNAME. Compare the public result, not only the provider’s dashboard, with Shopify’s values.
3. Return to Shopify > Settings > Domains and reopen the domain details. Do not rely on an older browser tab.
4. Check the official Shopify Status page if several stores or Shopify admin functions are failing at the same time.
5. When public DNS is still wrong after 48 hours, contact the active registrar or DNS provider. Send the nameservers, the complete DNS zone, the exact Shopify warning, and the time of the last change.
6. When public DNS matches Shopify but Shopify still reports an error, contact Shopify Support with screenshots of the domain details and public record results. Shopify cannot directly edit a third-party provider’s zone.

If Shopify shows the domain as connected and the store opens on other networks, the DNS connection is no longer the problem.

A single Windows computer that still shows DNS_PROBE_FINISHED_NXDOMAIN may be using an old local or ISP lookup. Our NXDOMAIN troubleshooting guide covers that separate visitor-side case.

If the public A, AAAA, and www records resolve correctly, leave them stable and let Shopify finish updating. If they still resolve incorrectly after 48 hours, the active DNS provider needs to correct the published zone.