Troubleshooting DNS records

When you add or update DNS (Domain Name System) records for your organization—for example, when setting up a CNAME, Listen, or Orchestrate—Pendo must validate those records before setup can complete. If you've already added your DNS records but Pendo hasn't been able to validate them yet, there are a few common factors that could be causing the delay. This article explains the common problems with DNS record approval delays, and how to resolve them.

Before you troubleshoot, confirm the records were entered correctly. You can do this by opening a terminal and running nslookup or dig.  For command examples, see Split-horizon DNS. If they were entered correctly and still aren't validating, this article covers the four most likely causes and solutions.

• Split-horizon DNS
• DNS update delays
• Cloudflare proxy mode
• CNAME flattening

For more information on the steps involved in setting up a CNAME, see Configure organization CNAME.

Split-horizon DNS

If your organization's network uses a split-horizon (also called split-brain or split-view) DNS architecture, it maintains separate DNS zones for internal and external networks. Each zone must be updated independently, changes to one aren't automatically reflected in the other. This creates two possible scenarios:

• Records added to the internal zone only. External queries fail with an NXDOMAIN error, but internal network queries succeed. Pendo's validation servers can't verify your domain.
• Records added to the external zone only. Pendo's validation succeeds, but internal users receive an NXDOMAIN error because their DNS server doesn't check the public internet.

To ensure successful validation, the record must be published to your public-facing, external DNS zone. Your network team should replicate the record to both the internal and external zone files to ensure access on both sides.

Resolution

Test this by opening your terminal or command prompt and querying a public resolver (like Google's 8.8.8.8 or Cloudflare's 1.1.1.1) instead of your default corporate DNS.

Examples:

Using nslookup (Windows, Mac, or Linux):

nslookup -type=txt verification.<yourdomain.com> 8.8.8.8

Using dig (Mac or Linux):

dig @8.8.8.8 verification.<yourdomain.com> TXT

If these commands return no results or an NXDOMAIN error, but the record appears to work on your corporate network, the record hasn't been added to your public DNS yet. To fix this:

1. Add the record to your public DNS registrar.
2. If you're adding a CNAME, return to Pendo and select Retry to complete the CNAME setup.

DNS update delays

Even when records are published correctly, DNS changes can take time to update across the internet. This is because DNS servers around the world cache records based on a setting called TTL (Time to Live). If you recently modified an existing record rather than creating a new one, some DNS servers may still be serving the old data until that timer expires.

Resolution

Check the TTL value on your record. A TTL of 3600 means DNS servers can cache the record for up to one hour before checking for updates. If you're still in the initial setup phase, setting a lower TTL, such as 300 seconds (five minutes), speeds up validation. You can increase it again after everything is working.

Cloudflare proxy mode

If your organization uses Cloudflare for DNS, your records may be automatically masked by Cloudflare's proxy network.

When a record is set to proxied (indicated by an orange cloud icon in the Cloudflare dashboard), Cloudflare masks your record values and returns its own IP addresses instead. This prevents Pendo from verifying the values required to complete the validation.

Resolution

1. Go to your Cloudflare Dashboard.
2. Go to your DNS settings.
3. Locate the specific records you created.
4. Change the proxy status from proxied (orange cloud) to DNS only (gray cloud).
5. Save the changes. This makes your records publicly visible and allows Pendo's validation to succeed.
6. (Optional) If you're adding a CNAME, you can return to Pendo and select Retry to complete the CNAME setup.

CNAME flattening

Some DNS providers automatically resolve CNAME records down to a final IP address, a feature called CNAME flattening (also known as ANAME or ALIAS records). Some enterprise firewalls and security DNS services also block queries that don't resolve to a routable IP address.

Pendo's verification records are text-based strings used for domain ownership validation — they don't point to a website or server and won't resolve to an IP address. If your DNS provider or firewall tries to flatten or resolve the record to an IP, the query will fail and Pendo's validation won't succeed.

Resolution

Turn off CNAME flattening for the validation record so your DNS server returns the exact value instead of resolving it to an IP address. Steps vary by provider so check your DNS provider's settings or individual records for more information on how to do this. 

If none of these solutions worked, see Get help with Pendo from Technical Support.