A site fails to open for reasons other than code. A common break after a move: the apex works, and www points nowhere or at a certificate that does not include that name. The visitor sees a browser error and never reaches the page.
One name is primary
Pick https and either the bare domain or www. The other name either opens on the same certificate and redirects, or it should not resolve. Two live addresses with no redirect are two sites to a crawler and a mess for people.
What to leave alone in DNS
Mail TXT records, including SPF, stay as they are. A Search Console domain check is a second TXT at the same apex, not a replacement for mail. A records for subdomains that already run other services are not rewritten “while you are here”.
The certificate
The name on the certificate matches the name in the address bar. A certificate for the bare domain will not open www until you add that name or remove www from DNS. A certificate error is not a redirect and not “wait for DNS”: there is no connection.
After the change
- Both http and https open on the primary name
- The other name either redirects or does not exist
- The canonical URL in the code is the one that actually opens
How that address gets into the sitemap — the note on sitemaps. Two languages on one domain — the note on hreflang. To check the setup — use the contact form.