www works but the root domain does not

What does this mean?

The root domain needs its own supported DNS and hosting configuration. A working www alias does not automatically supply the apex address. A missing root record, wrong IPv6 address, unsupported alias or certificate mismatch can prevent access.

What should I check first?

Record the exact error for the root and compare it with a successful www request. Check whether DNS resolves at all before examining redirects. If a certificate warning appears, the browser reached a server, so the next question is which server and certificate it received.

How can I diagnose the cause?

Query the apex A and AAAA records and compare them with the host’s supplied values. If the host supplies an alias name, ask whether your DNS provider supports an apex ALIAS, ANAME or flattening feature. An ordinary root CNAME generally conflicts with other required zone data.

How do I fix it safely?

Set the provider-supported root record and add the root domain to the hosting account. Ensure its certificate covers that exact name. Then redirect the noncanonical variant directly to your chosen hostname while retaining paths and queries. DNS records cannot themselves perform a URL redirect.

Verify the fix and know when to contact your provider

Back up the zone and routing rules before editing. Retest on another network and check both address families where available. Contact the DNS provider when the panel cannot represent the required apex setup, or the host when correct DNS reaches an incorrect site. Keep the working www service available throughout.

Work through these checks in order

1. Query the root name’s A and AAAA records and compare with the host’s actual values. Check for an outdated AAAA destination even when IPv4 looks correct.
2. If the provider gives an alias hostname rather than an IP, use its supported apex arrangement. Preserve root MX and TXT data; an ordinary CNAME is not a reason to erase those records.
3. Add the root hostname and certificate coverage at the host, then test a deep HTTPS request. Only after this works should you rely on a canonical redirect from that hostname.

Which tool can help?

DNS lookup · DNS record explainer

DNS tools show one resolver’s public answers. Record explainers do not authenticate a message, and calculators do not monitor a server. Use the evidence alongside your provider’s logs.