Troubleshooting

Almost every WAF deployment problem falls into one of these groups: DNS, certificate, origin, or a WAF decision. The table starts from the symptom.

Symptoms and what to do

Symptom	Likely cause	What to do
Domain stuck in PENDING_VERIFICATION	TXT record missing, with the wrong name, or not propagated yet	Check _nnwaf-challenge.<hostname> and the nnwaf-verify=<token> value; wait for the TTL and run verification again
Domain in DEGRADED without you changing anything	Verification TXT missing for 7 days	Recreate the record; the domain is verified again on the daily re-read
Domain stuck in PENDING_CERTIFICATE	_acme-challenge CNAME missing or pointing elsewhere	Create the CNAME with the value shown in the Console and wait for issuance
Browser reports an invalid certificate	Certificate not issued yet, or DNS already points to the edge before issuance	Go back to the certificate step; if DNS was already switched, wait for issuance or redo the order
Domain stuck in READY_FOR_DNS	Routing still not pointing to the edge	Create the CNAME to edge.gw.nnumbers.com.br, or A/AAAA on the apex, and run the check
404 on every request for the hostname	DNS points to the edge, but the domain is not active there	Check the domain state; a domain that is not active answers 404 at the edge
403 in the browser	Request blocked by the WAF	Ask for the request identifier shown in the response and look up the matching event
413 on a large POST	Body above the policy inspection limit, default 64 KiB	Reduce the body, use the body inspection exemption on the upload endpoint, or adjust the policy limit up to 1 MiB
411 on an upload	Request with Transfer-Encoding (chunked/streaming) under a body exemption, which requires a declared size	Send Content-Length; without a declared size the exemption rejects the request
429 for a legitimate client	Rate limit too low for the real volume, or per-instance limit badly calibrated	Review the unit and the reach; see Rate limiting
502	Origin unreachable, or invalid origin certificate	Test the origin directly; TLS verification to the origin cannot be disabled, so the certificate must be valid and trusted
503	Temporary edge unavailability or timeouts at the origin	Retry; if it persists, check origin health and response time
504	Origin slower than the timeout	Investigate the application response time and the path to it
Legitimate traffic blocked, no clear pattern	OWASP false positive or aggressive custom rule	Read the event and create a narrow exception; see Events and exceptions
Metrics delayed or empty	Aggregation has a few minutes of delay	Use events for the point case and wait for aggregation
Domain does not activate	A previous step is incomplete: verification, certificate or routing	Follow the states in Domains up to READY_FOR_DNS

DNS did not propagate

DNS belongs to your provider, so propagation depends on the TTL you set. To check without waiting for the browser:

dig +short app.empresa.com.br CNAME
dig +short _nnwaf-challenge.app.empresa.com.br TXT
dig +short _acme-challenge.app.empresa.com.br CNAME

If the hostname CNAME does not appear, the record was not created or sits in the wrong part of the zone. If it appears and the domain is still READY_FOR_DNS, run the routing check in the Console — it looks at the answer from the edge, not at your computer cache.

Certificate not issued

Issuance depends on the _acme-challenge CNAME pointing to the value shown in the Console, ending with ._acme.gw.nnumbers.com.br. Common mistakes: creating the record as TXT instead of CNAME, using the name without the prefix, or leaving an older record with the same name at the provider.

While the certificate is not issued, do not switch the hostname DNS to the edge: you would get a certificate error in the browser during the window.

Origin unavailable

Before blaming the WAF, test the origin directly from your environment:

curl -sS -o /dev/null -w '%{http_code} %{time_total}\n' https://origin.empresa.com.br/

If the origin answers badly directly, the problem is there. If it answers well directly and badly through the WAF, check: the registered address and port, the Host the origin expects, the origin certificate (verification is always performed) and the origin response timeout.

Errors the end user sees

Code	Meaning	Who solves it
403	Request blocked by the WAF; the response carries a request identifier	Whoever manages the WAF, with the identifier
413	Body above the inspection limit, or above the exemption maximum size	Whoever sends it, or whoever adjusts the policy
411	Upload with Transfer-Encoding under a body exemption: Content-Length is missing	Whoever sends it
429	Rate limit reached	Whoever manages the WAF
404	Unknown host at the edge: DNS points to the edge, but the domain is not active	Whoever manages the WAF
502	Origin unreachable or invalid origin certificate	Origin
503	Temporary edge unavailability or origin timeouts	NNumbers or origin
504	Origin slower than the timeout	Origin

The request identifier is the shortcut

When a user reports 403, ask for the identifier shown on the error page. With it you find the exact event in seconds, without searching by approximate time.

Next steps

• Domains — states and registration steps.
• Events and exceptions — from block to exception.
• Security — restricting the origin and reviewing permissions.