Verification goal
What are we trying to verify?
A tagging server has been provisioned, the tracking domain has been connected, and the GTM server container has been configured. But is the infrastructure actually reachable, and is the correct server container running there?
Before you start troubleshooting clients, tags, or the client-side configuration of a server-side tagging setup, it is worth answering this question.
In practice, this takes two steps: opening Preview for the Google Tag Manager server container and sending a unique test request through the intended tracking endpoint.
01
Client-side tracking
02
Tracking endpoint
Tracking domain or same-origin path
03
Tagging server
04
GTM server container
05
Processing
Clients, tags, and destination platforms
To verify basic reachability and routing up to the server container, ask this question:
Is the intended tagging server reachable, and is the expected Google Tag Manager server container running there?
You can answer this question independently of the client-side tracking configuration.
Direct verification
Start Preview and send a unique test request
Open your Google Tag Manager server container and start Preview.
Then open a clearly identifiable test path through the configured server URL in a second browser tab. For a standard tracking domain, for example:
https://collect.example.com/infrastructure-test?timestamp=20260908T120000
For a same-origin setup, for example:
https://www.example.com/metrics/infrastructure-test?timestamp=20260908T120000
The timestamp or another unique value helps you find the test request in Preview. What matters is that it appears there as an incoming request. It does not need to be claimed by a client for this test.
If the test request appears in Preview, you have shown that the intended tracking endpoint forwarded the request to Preview for the expected server container at that time. This verifies basic reachability and routing.
The Google manual setup guide provides the technical reference: a request sent through the configured server URL must appear in Preview.
However, this test does not verify continuous availability, redundancy, scaling, or correctly triggered tags. It also cannot rule out infrastructure problems that occur intermittently or only under load.
Troubleshooting
If Preview or the test request does not work
If Preview does not start correctly or the test request does not appear there, narrow down the problem step by step.
The next troubleshooting steps depend on how the tracking endpoint is connected. For a tracking domain, check DNS resolution and the direct connection to the tagging server. For a same-origin setup, focus on whether your website infrastructure forwards the intended path correctly.
Check the health endpoint first
In both cases, the first step is to check the health endpoint through the same tracking endpoint that will later receive the tracking requests.
For a tracking domain, for example:
https://collect.example.com/healthy
For a same-origin setup, for example:
https://www.example.com/metrics/healthy
You can also check both variants from the command line:
curl -fsS
https://collect.example.com/healthy
curl -fsS
https://www.example.com/metrics/healthy
A successful request returns only:
ok
-s hides the progress meter, -S keeps error messages visible, and -f treats HTTP status codes of 400 or higher as errors. For this test, an error message, an empty response, or any response other than ok is not a successful result. Google documents /healthy as an available health endpoint for the tagging server. See Google: Set up server-side tagging with Cloud Run and the Google manual setup guide.
If the endpoint responds as expected, the tagging server application is generally reachable.
You now know that:
- the endpoint can be reached;
- the HTTPS connection works;
- the request reaches the tagging server infrastructure;
- the tagging server application responds.
This makes the health check a useful first troubleshooting step.
What /healthy does not tell you
A successful health check shows that a functioning tagging server application is reachable at the endpoint. It does not tell you which Google Tag Manager server container or container configuration is running there.
For example, /healthy does not reveal:
- which container ID is being used;
- which container version is published;
- which specific configuration was loaded.
This is why Preview combined with a unique test request is the better starting point. It checks more than whether any tagging server application responds: it connects the test to the specific server container you want to verify.
Tracking domain
Troubleshooting a tracking domain
A tracking domain such as collect.example.com connects directly to the tagging server. If the health endpoint cannot be reached, check DNS, TLS, and the tagging server configuration in that order.
- Check DNS resolution for the tracking domain
- Check TLS and the certificate for the tracking domain
- Check the tagging server configuration
Check DNS
If the health endpoint is already unreachable, check DNS resolution next.
For example:
dig CNAME collect.example.com +short
dig A collect.example.com +short
dig AAAA collect.example.com +short
To compare the responses from different public resolvers:
dig @8.8.8.8 CNAME collect.example.com +short
dig @1.1.1.1 CNAME collect.example.com +short
The key question is:
Does the tracking domain point to the intended target?
After a DNS configuration change, different resolvers may temporarily return different results.
Check TLS and the certificate
If the domain resolves correctly but the HTTPS request still fails, check the TLS connection next.
Typical questions include:
- Is the certificate valid?
- Does it match the domain being used?
- Is the complete certificate chain being served correctly?
The browser often provides a useful first indication of a TLS problem.
From the command line, start by displaying the complete HTTPS request, including the TLS handshake:
curl -v -o /dev/null
https://collect.example.com/healthy
For a more detailed check of the hostname and certificate chain:
openssl s_client
-connect collect.example.com:443
-servername collect.example.com
-verify_hostname collect.example.com
-verify_return_error
-showcerts </dev/null
The output should not contain any verification errors. -servername sends the hostname through SNI during the TLS handshake; -verify_hostname checks whether the certificate matches the tracking domain.
Check the tagging server configuration
If the basic connection tests do not reveal a clear cause, check the hosting configuration.
In ProxyRiders, for example, you can check directly in the application:
- Is the tagging server configured correctly?
- Is the correct domain assigned to the tagging server?
- Is the domain shown as connected?
If the health endpoint for the tracking domain responds successfully but the unique test request does not appear in Preview, also check whether this exact server URL is configured in the server container and selected for Preview.
Same origin
Troubleshooting a same-origin setup
In a same-origin setup, the tracking endpoint sits under a path on the website, for example https://www.example.com/metrics. In this case, DNS and TLS initially belong to the website address. A reachable website therefore does not prove that the tracking path is being forwarded correctly to the tagging server.
Google distinguishes between a subdomain and a same-origin deployment under a website path when using your own domain. See Google: Custom domain configuration.
- Open the website
- Check the health endpoint under the tracking path
- Check routing / reverse proxy
- Check the server URL selected for Preview
Open the website and tracking path separately
First check whether the website itself is reachable. Then request the health endpoint under the intended same-origin path:
https://www.example.com/metrics/healthy
You can also compare the two from the command line:
curl -sS -o /dev/null
-w 'Website: HTTP %{http_code}n'
https://www.example.com/
curl -fsS
https://www.example.com/metrics/healthy
For the website, expect the status code from its normal configuration, often 200 or an intentional redirect. The health endpoint under the tracking path must return ok.
If the website works but the health endpoint under /metrics does not, the problem is probably not the website’s general DNS resolution. In that case, check the routing between the website infrastructure and the tagging server.
Same origin
Check routing / reverse proxy
This troubleshooting step applies only to a same-origin setup: requests for the intended path must be forwarded correctly from the website infrastructure to the tagging server. Depending on the technical setup, this is handled by a routing rule or a reverse proxy.
Check the following in particular:
- Are all requests under the intended path forwarded to the tagging server?
- Is the required path preserved during forwarding, or rewritten as intended?
- Are query parameters, cookies, and required headers forwarded?
- Is the tagging server response returned to the browser unchanged?
- Do redirects, caching rules, or security rules interfere with the tracking path?
Use curl -v to display the status code, redirects, and requested path. -o /dev/null suppresses the response body:
curl -v -o /dev/null
'https://www.example.com/metrics/infrastructure-test?timestamp=20260908T120000'
This command-line call makes externally observable HTTP behavior visible and can reveal routing errors. It does not replace opening the URL in the same browser in which GTM Preview is running, because the Preview session is associated with the browser context.
Check the server URL selected for Preview
If /metrics/healthy responds successfully but the unique test request does not appear in Preview, the tagging server is generally reachable through the path. Then check:
- Is the complete same-origin URL configured as a server URL in the GTM server container?
- If multiple server URLs are configured, was the correct URL selected for Preview?
This keeps the boundary clear: DNS and TLS explain basic reachability. Routing under the same-origin path determines whether a specific request reaches the tagging server.
Conclusion
Can Preview for the expected server container be started, and does a unique test request sent through the intended tracking domain or same-origin path appear there?
If so, basic reachability and routing to Preview for the intended server container have been verified at the time of the test. This does not verify continuous availability, redundancy, scaling, or the business logic of the tag configuration.
If not, first check the health endpoint through the affected tracking endpoint. For a tracking domain, continue with DNS, TLS, and the tagging server configuration. For a same-origin setup, check website reachability separately from the routing or reverse proxy to the tagging server.
This lets you narrow down basic connection and routing problems before moving on to the rest of the server-side tagging implementation.
Next step
Separate tracking implementation from server operations
With ProxyRiders, you can create a tagging server and connect your tracking domain in just a few steps. You can then verify reachability with the test described above. ProxyRiders handles provisioning and technical operations, while you focus on container configuration and data flow.