Fix Custom Domains After Platform Updates: Step-by-Step

Your app is live. The site works fine on the platform's generated URL. But the custom domain you pointed at it? Dead. No error messages. No platform alert. You test from mobile, a coffee shop, your office. The domain 404s everywhere. This silent failure is the most common post-update issue across hosting platforms--and it has specific causes.

What Just Happened? Recognizing Silent Domain De-Verification

When a hosting platform updates its infrastructure, it sometimes clears your domain binding without notification--even though your DNS records are untouched. This happens because the platform's backend IP addresses change, SSL certificates get re-issued, or the domain binding itself is revoked. Users discover the outage by testing, not by alert.

The term "silent de-verification" describes this exact failure mode. Your DNS records still point to where your domain used to resolve. The platform's database still shows your app. But the connection between them--the actual binding that tells the platform "this custom domain routes to this app"--has been severed. The platform just didn't tell you.

This is different from a DNS propagation delay. Your DNS is fine. The issue is platform-side. That's why restarting your browser doesn't help. That's why it works for everyone on your team. The problem isn't caching or connectivity. It's that the platform broke the link, silently.

If you're running on Northflank, Azure App Service, Heroku, Supabase, Netlify, Vercel, or Google Sites, you're vulnerable. GitHub issues and support threads from all these platforms report the exact same pattern after updates. Reddit threads echo it: users describe the identical symptom. Domain worked yesterday. Doesn't work today. Nothing in the logs.

Why Platform Updates Break Custom Domains: The Root Cause

Platform infrastructure updates rotate backend IP addresses, migrate SSL certificates, or reset domain bindings as collateral damage. Custom domains depend on three moving parts: DNS records, SSL certificates, and a platform-side binding. When any one changes without synchronizing with the others, the domain breaks.

Here's the mechanics. When you add a custom domain to a hosting platform, the platform assigns it specific infrastructure--an IP address, a certificate, a routing rule in its database. The platform tells you what DNS records to create. Your DNS provider points your domain to that infrastructure. Everything works.

But when the platform updates, it rotates to new servers with new IP addresses. Modern platforms, especially multi-cloud ones like Northflank, do this frequently to balance load, patch security, or migrate data centers. When the rotation happens, the platform's documentation says you might need to update your DNS records. But it often doesn't say your existing domain binding might be invalidated.

Azure's own troubleshooting documentation notes this explicitly: "The platform may clear your custom domain binding during infrastructure maintenance." Vercel's community forums show thread after thread of users discovering this the hard way. Heroku users report the same issue. The pattern is consistent: the platform changed its backend, the domain binding got cleared, no email.

Why doesn't the platform just update the binding automatically? Multi-cloud and distributed systems are hard. The domain binding is tied to specific infrastructure. When infrastructure rotates, the binding can't safely follow--it might point to stale servers. So the platform resets it, expecting you to re-verify. But many platforms don't notify you. They assume you'll notice when testing.

The deeper problem: you're paying these platforms for convenience, but the convenience breaks silently when they change their infrastructure. Simpler platforms with flat, stable infrastructure don't have this problem. That's part of why managed hosts like Ship appeal to engineering teams burned by this pattern multiple times.

Step 1: Confirm the Domain Is Actually Broken

Test the custom domain from multiple networks (mobile hotspot, different WiFi, office) and browsers (Chrome, Firefox, Safari). Use an online DNS checker like MXToolbox or dig webinterface to confirm the domain resolves to an IP address. If DNS resolves but the site doesn't load, the problem is platform-side, not DNS.

Start simple: open the custom domain in an incognito window. If it 404s there, it's not a local cache issue. Open it from your phone's cellular network. If it fails there too, it's not your WiFi. Test from a VPN or a friend's computer. If the failure is global, you've confirmed it's real.

Next, verify DNS is actually pointing somewhere. Use nslookup or dig to check what the domain resolves to. On Windows, open Command Prompt and type: nslookup yourdomain.com. On Mac or Linux, open Terminal and type: dig yourdomain.com. You should see an A record (an IP address like 1.2.3.4) or a CNAME record (pointing to something like yourdomain.platform.io).

If the DNS records don't exist, someone deleted them or they never propagated. If they exist but point to a random IP, you'll need to fix them. But if DNS looks correct, the problem is the platform's side. That's the next step.

Also test the platform's generated URL (the one you got when you deployed). If your app works at myapp.myplatform.io but not at myapp.com, this confirms the app is running. The platform is serving it. The routing for your custom domain is what's broken. This distinction matters: your app isn't down. The custom domain binding is.

Step 2: Diagnose the Specific Failure Point

Custom domain failures fall into three categories: DNS not resolving (A/CNAME record missing or wrong), SSL/TLS invalid (certificate mismatch or expired), or platform binding cleared (platform database lost the link). Use an SSL checker and your platform's dashboard to quickly narrow down which one.

Pull up your platform's dashboard. Navigate to the custom domain settings. Look for status indicators. Most platforms show: "pending verification", "validated", "certificate pending", or "error". If it says "error" or "certificate pending", the platform detected an issue.

Now check SSL. Open an SSL Lab checker (like Qualys SSL Labs or DigiCert's SSL Checker) and enter your domain. It will tell you immediately if the certificate is valid, expired, or mismatched. If the certificate is valid but was issued recently (last week or month), the platform re-issued it during the update. That's a clue.

Check your platform's logs or event history. Azure logs, Vercel's deployment history, Netlify's status page--all show when infrastructure changed. Look for timestamps matching when you first noticed the failure. If there's a log entry saying "infrastructure migrated" or "certificate re-issued" around that time, you've found the root cause.

Finally, manually inspect your DNS records at your DNS provider (Cloudflare, Route53, Namecheap, GoDaddy, etc.). Log in. Look for the A record or CNAME record you created. Compare it to what your platform's dashboard says it should be. If they don't match, the platform changed its target and your DNS is now pointing to dead infrastructure.

Step 3: Fix the Domain Binding (The Quick Win)

Remove the custom domain from your platform's dashboard entirely. Wait 2-3 minutes. Re-add it. Copy the new DNS targets from the platform (they may have changed). Update your DNS provider to point to the new targets. This re-triggers the platform's verification handshake and often fixes the issue immediately.

Here's the step-by-step:

1. Log into your hosting platform (Northflank, Azure, Vercel, Netlify, Supabase--wherever your app is).
2. Find the custom domain section (usually Settings > Domains or Hosting > Custom Domains).
3. Click "Remove Domain" or "Delete" on your affected domain.
4. Confirm deletion. Wait 2-3 minutes.
5. Click "Add Custom Domain" and enter your domain name again.
6. The platform will display new DNS targets. Copy them--they're likely different from before.
7. They're usually either an A record (single IP), a CNAME (points to platform.io), or a TXT verification code.
8. Log into your DNS provider.
9. Find your existing DNS records for your domain.
10. Delete the old A record or CNAME.
11. Create a new record with the platform's new targets.
12. Save the changes.

Wait for DNS to propagate. This usually takes 5-30 minutes, sometimes up to 2 hours. Use a DNS propagation checker to monitor progress globally. Within the propagation window, your domain should come back online.

Why does this work? Removing and re-adding forces the platform to issue a new domain binding in its database. It also forces you to get the current, correct DNS targets instead of relying on outdated ones. The manual re-verification also triggers any pending SSL certificate re-issues on the platform side.

Most of the time, this single step solves the problem. If it doesn't, move to Step 4.

Step 4: Verify DNS + SSL Are Correct

After you've re-added the domain and updated DNS, don't just wait. Actively verify using DNS checkers and SSL tools. Confirm DNS resolves globally and the certificate is valid. If DNS still doesn't resolve after 30 minutes, ask your DNS provider if there are rate limits or caching policies in place.

For DNS: use Google's Dig tool (search "dig webinterface") and enter your domain. It will show you what the domain resolves to from Google's servers. Compare the result to what your platform's dashboard says it should be. If they match, DNS propagation is working. If they don't, your DNS provider hasn't yet registered your change. Try again in 5 minutes.

For SSL: use Qualys SSL Labs (ssllabs.com). Click "Analyze" and enter your domain. It will report back in 1-2 minutes. Look for a green "A" rating. If you see red or yellow (HTTPS not working, certificate mismatch, expired date), click the details. Common issues: the certificate is for *.platform.io but your domain is myapp.com (the platform hasn't reissued your cert yet); or the certificate is "not yet valid" (the platform issued it but your domain hasn't propagated yet).

If the SSL report shows a pending state, wait another 15 minutes and re-check. Certificate re-issues take 10-30 minutes to become visible.

If DNS shows the right IP and SSL is green but your domain still 404s, the problem is deeper. Your platform might have a network rule or firewall blocking the domain, or there's an app-level configuration issue. Contact your platform's support with evidence: the DNS checkers and SSL reports showing everything is correct on the infrastructure side.

For stubborn cases: Clear your browser's DNS cache. On Windows, open Command Prompt as admin and type ipconfig /flushdns. On Mac, open Terminal and type sudo dscacheutil -flushcache. Then test the domain again.

How to Prevent This from Happening Again

Set platform alerts to notify you of infrastructure changes. Document your current DNS records in a spreadsheet. Test your custom domain monthly. Monitor your SSL certificate expiration date. Consider DNS monitoring tools like Uptime Robot that alert you when DNS stops resolving.

Most platforms offer notification settings. Log into your platform account and look for Settings > Notifications or Alerts. Enable infrastructure change alerts. You'll get an email when updates happen, giving you a heads-up to test your domain immediately.

Second, document your DNS setup. Screenshot or copy your DNS records into a spreadsheet. Include the date. Every 3 months, log back into your DNS provider and verify they haven't changed unexpectedly. If they have, investigate why.

Third, test regularly. Once a month, visit your custom domain from an incognito browser. Does it load? Is the site correct? This takes 30 seconds and catches silent failures within days, not weeks.

Fourth, track your SSL certificate expiration date. Most browsers and checkers show it. Make a calendar reminder to check it 30 days before expiration. If the platform auto-renews (most do), the cert should renew 1-2 weeks before expiration.

Fifth, if you're running a business-critical app, consider a DNS monitoring tool. Services like Uptime Robot can monitor your domain and alert you within minutes if DNS breaks. They cost $5-20/month but are worth it for production apps.

The meta-lesson: if your platform is prone to silent failures, it's a signal to evaluate your platform's reliability maturity. Are you paying for convenience, only to spend hours debugging infrastructure changes? That cost is real. Some teams find that migrating to simpler platforms like Ship or self-hosted options eliminates this class of failure entirely. You gain stability and predictability. You lose some convenience features. That's worth calculating.

The Real Solution: Simpler Platforms Don't Have This Problem

Hosting platforms like Northflank or Azure update frequently and rotate infrastructure to balance load and patch security. Simpler managed platforms like Ship use flat pricing and stable infrastructure, reducing unnecessary churn. If you're repeatedly dealing with post-update domain failures, consider whether your platform's complexity is delivering value or creating overhead.

Northflank is a multi-cloud platform running your app across various data centers and cloud providers. That's powerful for scaling, but it means your infrastructure changes often. IP rotations, SSL re-issues, backend migrations--this is the cost of that flexibility. You pay variable pricing, and you get volatility.

Azure and other enterprise platforms are similar. They're designed for large organizations that want granular control. That control comes with complexity. Infrastructure changes frequently. Domain bindings break. You spend time fixing them.

Verel, Netlify, and similar deployment platforms are designed for rapid CI/CD. Every commit triggers a new deployment, new infrastructure. That's useful for web developers, but your domain can get re-routed unexpectedly when the platform changes its backend.

Ship, by contrast, uses a managed PaaS model with predictable infrastructure. You deploy once. The infrastructure is stable. Your domain binding doesn't reset during updates because the platform doesn't frequently rotate IPs or change backend targets. You get predictable flat-fee hosting costs instead of per-minute surprises. You get stability instead of the constant vendor lock-in anxiety.

This isn't a pitch to abandon Northflank or Azure. It's a reality check. If you're running into silent domain failures frequently, ask yourself: what am I getting from this platform's complexity that justifies the debugging cost? If the answer is "nothing," you're in pain for no reason. A simpler platform might be the better fit.

If you do decide to migrate, the Ship migration checklist walks you through the actual process. It's simpler than most expect.

For now: Fix your domain using the steps above. Document your DNS records. Test monthly. And consider whether you're paying for features you're not using.

Frequently Asked Questions

Why did my custom domain suddenly stop working?

Your hosting platform likely updated its infrastructure, which changed the DNS targets (IP addresses or CNAME values), revoked the platform-side domain binding, or re-issued your SSL certificate. The platform didn't notify you, so you only discovered the outage by testing. This is common across platforms like Azure, Northflank, Vercel, and Heroku.

How do I fix a custom domain that stopped working after an update?

Remove the domain from your platform's dashboard, wait 2-3 minutes, then re-add it. Copy the new DNS targets and update your DNS provider's records to match. This re-triggers the platform's verification handshake. Wait 5-30 minutes for DNS to propagate, then test.

What causes SSL certificate errors on custom domains?

When a platform updates, it re-issues your SSL certificate. The old certificate is invalidated. If your domain hasn't propagated to the new backend yet, the browser sees a certificate mismatch or "not yet valid" error. This is temporary and resolves within 10-30 minutes as DNS propagates.

How do I verify DNS records are correctly configured?

Use an online DNS checker like nslookup, dig webinterface, or MXToolbox. Look for your A record (an IP address) or CNAME record (a domain pointing to the platform). Compare it to what your platform's dashboard says DNS should be. If they match, DNS is configured correctly.

Can a platform update clear my domain binding without my knowledge?

Yes. This is the most common cause of silent domain failures. Platforms like Azure, Northflank, and Vercel clear domain bindings during infrastructure maintenance or IP rotation. They expect you to re-verify, but rarely send notification. This is a platform design flaw, not your mistake.

What is the difference between a CNAME and an A record?

An A record points your domain to an IP address (like 1.2.3.4). A CNAME record points your domain to another domain (like myapp.myplatform.io). Use whichever your platform specifies. Most hosting platforms use CNAME records to hide infrastructure changes from you.

How long does DNS propagation take?

DNS propagation usually takes 5-30 minutes. In rare cases, it can take up to 2 hours depending on your DNS provider's TTL (time-to-live) setting. Use a DNS propagation checker to monitor progress globally. Your domain will likely be accessible within 30 minutes.

Why does my domain work on the generated URL but not the custom domain?

Your app is running fine (that's why the platform-generated URL works). The problem is the routing for your custom domain. The platform's binding for your custom domain is broken or the DNS is pointing to a stale IP. The fix: re-add the domain in the platform's dashboard and update your DNS records.

The Bottom Line

Silent custom domain failures after platform updates are a common pattern because complex, frequently-updated infrastructure creates moving targets. You can fix most cases in 20 minutes by removing and re-adding the domain in your platform's dashboard, then updating your DNS records. Preventing the issue requires monthly testing, DNS documentation, and monitoring.

But there's a bigger question: if you're repeatedly dealing with domain breaks because your platform's infrastructure is too complex and volatile, you're paying for a problem, not a solution. Explore Ship's hosting options and see if a simpler, flatter-fee platform fits your team better.