ngrok custom domain: separating DNS, CAA, and certificate-issuance failures
Where the fault could sit When an ngrok endpoint on a reserved custom domain shows a hostname-resolution or certificate-validation symptom, the cause could sit in the public DNS record and its CAA rules, in ngrok's asynchronous certificate provisioning, or in the local service behind the agent. The goal is to identify which layer to investigate first before