Warning: Beware of Email When Changing DNS Records

NameCheap and Issues with DNS Forwarding

A few weeks ago, my employer (Chick-fil-A in Tulsa, Oklahoma) informed me we were having issues with our DNS settings for a few work-related domains. What a great opportunity to break things for the sake of learning! Here was the issue:

We had a few URL forwarding rules set up in our NameCheap account. When someone hit thedomain.com, we wanted to forward things onto theotherdomain.com.

In most browsers, this was no issue. However, we found Google Chrome had difficulty loading the domains on different devices. After digging, we found it had to do with a lack of a valid SSL certificate for the original domains on NameCheap's forwarding server.

The request path went something like this:

+----------+       +--------------------+
|  CLIENT  | ----> |      NAMECHEAP     |
|          | HTTPS |      (NO SSL)      |
+----------+       +--------------------+
     ^                       |
     |                       | 301/302 Redirect
     +-----------------------+
     |
     | New HTTPS Request
     v
+------------------+
| FORWARDED DOMAIN |
|      HTTPS       |
+------------------+

In the second step, where we pass through the NameCheap forwarding server, the lack of a valid SSL certificate was causing issues in Chrome.

The browser needs to establish a secure connection with NameCheap before it can receive the redirect. Since that connection was failing, the browser never made it to the forwarded domain, even though the destination had a valid SSL certificate.

The Solution

At first, we searched around for ways to get HTTPS working on NameCheap. Just a quick PSA to anyone considering domain/hosting providers, NameCheap's cPanel (their hosting control panel) is an absolute nightmare to navigate.

I'm sure there was some way to get HTTPS working through NameCheap, but the options I found were confusing, and I wasn't particularly interested in spending another afternoon navigating their control panels. After a failed attempt at thinking I resolved the issue in cPanel, I started considering different solutions.

Prior to all this, I had just managed to get a few personal domains I owned under Squarespace routed through Cloudflare's name servers. I wondered if the same thing could be done in NameCheap. It could.

For anyone confused, here is a distinction worth making: You can own a domain in one domain provider (NameCheap) and manage the DNS settings in another provider (Cloudflare). The trick is the name server. You simply point the name servers in NameCheap over to Cloudflare. It is pretty straightforward once you see it for the first time. You'll probably think to yourself, "That's what that form field was for?"

One thing worth mentioning here is that changing your name servers changes which provider is responsible for answering DNS requests for your domain. This means all those DNS records you had configured with your old provider are no longer being used. Your A records, CNAME records, MX records, TXT records, and anything else you've configured need to be accounted for with the new provider.

As I was about to find out, this is an important detail.

The Email Nightmare

I thought everything was fine. I logged into NameCheap, pointed my domains over to Cloudflare's name servers, tested the connections, and went on my way.

Fast forward and I get a text telling me all the email forwarding rules associated with the domains were down. Looking back, I should've seen this coming, but it was my first time making a live name server migration. These are those small learning moments which end up in tales from senior engineers.

In my case, the fix was easy. I logged into Cloudflare, sent email verifications to those involved, and set up my new forwarding rules in Cloudflare's control panel.

Getting my old records from NameCheap was not trivial, as it took the sites offline for just a bit, but things were salvaged and I was able to recover all of the old forwarding rules.

Words of advice, check the email forwarding rules before migrating name servers. In fact, check all your DNS records. You'll save yourself a big headache and potential email loss.

Cheers.