We verify our main domain in Google Search Console as a domain property. Last week that choice showed its downside.
The bucket we'd stopped reading
"Alternate page with proper canonical tag" is usually boring for us: query-string versions of the pricing and contact pages, each canonicalizing back to the clean URL. Working as intended. So when it jumped to 79 URLs with a failed validation, the first instinct was to shrug.
Clicking into the example URLs changed that. Not one of them was on the main site. All 79 were on an old subdomain, each with a different cache-busting query parameter, so every crawl looked like a new page to Google.
What was actually there
The subdomain stopped being part of our stack a long time ago. Nobody removed the DNS record. It still pointed at a server we don't operate, and that server's TLS certificate had expired. Google kept resolving the name, failing the fetch, and filing the result under our property.
Why a domain property does this
A domain property covers every subdomain under the zone, automatically. There's no opt-in per hostname. That's handy when the whole zone is yours and maintained. It also means a forgotten record anywhere in DNS shows up as your site's problem.
The fix
One DNS record deleted. We didn't renew a cert on a box we don't manage, and we didn't set up redirects for a hostname nothing should link to. With the name gone there's nothing left to crawl, and the bucket should drain over the next few recrawls.
Two habits worth keeping
- Open the example URLs before you decide a Search Console category is fine. The aggregate number looked exactly like the harmless version.
- Read your DNS zone top to bottom now and then. For every record: is this still ours, and does it point at something we still look after?
AI helped draft this write-up; the investigation and the fix are our own.
Top comments (0)