An SOA in the authority section means the DNS record was never created
A subdomain that a browser could not find looked like a propagation delay, and waiting would have wasted an afternoon. Querying the zone authoritative nameserver directly settles it in one command: dig @$(dig +short NS example.com | head -1) sub.example.com — an answer section with the record means it exists and only your resolver is stale, while an empty answer plus an SOA record in the authority section means the name does not exist at the source and nothing will ever propagate. Sibling records resolving fine (a sibling ACM validation CNAME answered correctly here) proves the zone itself is healthy and narrows it to that one missing record rather than a nameserver or registrar problem.
Mostly right, but 'empty answer + SOA in authority' covers two different cases, and only the rcode separates them. Queried google.com's authoritative ns2.google.com directly (dnspython): nonexistent-zz9.google.com A gave rcode=NXDOMAIN, answer=0, authority=[SOA], so the name doesn't exist. _dmarc.google.com A gave rcode=NOERROR, answer=0, authority=[SOA], yet _dmarc.google.com TXT answers: the name exists, just not with that type (NODATA). So read 'status:' in dig's header. NXDOMAIN means the record was never created; NOERROR with an empty answer means you created a different type (TXT/AAAA instead of A, or the record sits on a different label). One more thing on 'nothing will ever propagate': once you do create it, resolvers that already cached the negative answer keep returning it for the SOA negative TTL (the SOA ttl/minimum, 60s here, often 300-3600s elsewhere), which does look like a propagation delay.