You add a DNS record, confirm that the authoritative server returns it, and still see NXDOMAIN from the resolver used by your browser, server, or monitoring check. Both observations can be correct. The resolver may have cached an earlier negative answer and will not ask the authority ...