Skip to main content
Back to Category

DNS Troubleshooting and Resolution Guide

Comprehensive guide to diagnosing and resolving DNS issues using dig, nslookup commands, DNS propagation checks, cache clearing, and common DNS error solutions.

Read time: 14 min Troubleshooting
dnsdignslookuppropagationcachetroubleshooting
Author
REXE Teknoloji Network & Security Team
Editor
REXE Teknoloji Technical Editorial
First published
Last updated

Introduction

DNS (Domain Name System) is one of the fundamental components of internet infrastructure. This system translates domain names to IP addresses, and when it doesn't work correctly, many services including website access, email delivery, and server connections can be disrupted.

In this guide, we'll examine the tools and methods you can use to diagnose and resolve DNS issues in detail.

DNS Fundamentals

DNS Record Types

Record TypeDescriptionExample
AIPv4 address mappingexample.com → 1.2.3.4
AAAAIPv6 address mappingexample.com → 2001:db8::1
CNAMEAlias to another domainwww → example.com
MXMail server routingmail.example.com (priority: 10)
TXTText record (SPF, DKIM, etc.)v=spf1 ip4:1.2.3.4 -all
NSNameserver definitionns1.example.com
PTRReverse DNS record4.3.2.1 → example.com
SOAZone authority recordTTL, serial, refresh info

DNS Resolution Process

User → Local DNS Cache → Recursive Resolver → Root NS → TLD NS → Authoritative NS → IP Address

DNS Diagnosis with dig Command

dig (Domain Information Groper) is the most powerful tool for diagnosing DNS issues.

Basic Usage

hljs bash
# Query A record
dig example.com A

# Query from a specific DNS server
dig @8.8.8.8 example.com A

# Short output
dig example.com +short

# Query all record types
dig example.com ANY

# Query MX record
dig example.com MX

# Query NS record
dig example.com NS

# Query TXT record
dig example.com TXT

Detailed Queries

hljs bash
# Trace mode — shows resolution process step by step
dig example.com +trace

# SOA record — zone information
dig example.com SOA

# Reverse DNS query
dig -x 1.2.3.4

# Query over TCP (for large responses)
dig example.com +tcp

# DNSSEC validation
dig example.com +dnssec

Reading dig Output

hljs bash
$ dig example.com A

;; QUESTION SECTION:
;example.com.                   IN      A

;; ANSWER SECTION:
example.com.            300     IN      A       93.184.216.34

;; AUTHORITY SECTION:
example.com.            86400   IN      NS      ns1.example.com.

;; Query time: 23 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; MSG SIZE  rcvd: 56

Key fields:

  • ANSWER SECTION: The query response
  • TTL (300): How long the record stays in cache (seconds)
  • Query time: Response time
  • SERVER: DNS server that provided the answer

nslookup Command

nslookup is a simpler tool for DNS queries:

hljs bash
# Basic query
nslookup example.com

# Query from specific DNS server
nslookup example.com 8.8.8.8

# MX record query
nslookup -type=MX example.com

# NS record query
nslookup -type=NS example.com

# TXT record query
nslookup -type=TXT example.com

# Reverse DNS
nslookup 1.2.3.4

DNS Propagation Check

When DNS changes are made, it takes time for new records to propagate to all DNS servers.

Propagation Times

Record TypeTypical TTLPropagation Time
A / AAAA300-3600 sec5 min - 1 hour
MX3600-86400 sec1 - 24 hours
NS86400 sec24 - 48 hours
TXT300-3600 sec5 min - 1 hour

Checking from Different DNS Servers

hljs bash
# Google DNS
dig @8.8.8.8 example.com A +short

# Cloudflare DNS
dig @1.1.1.1 example.com A +short

# Quad9 DNS
dig @9.9.9.9 example.com A +short

# Local ISP DNS
dig example.com A +short

Online propagation check tools:

To speed up DNS propagation, lower the TTL value before making changes (e.g., 300 seconds). You can increase the TTL again after the change is complete.

DNS Cache Clearing

Operating System Cache Clearing

hljs bash
# Linux (systemd-resolved)
sudo systemd-resolve --flush-caches
sudo resolvectl flush-caches

# macOS
sudo dscacheutil -flushcache
sudo killall -HUP mDNSResponder

# Windows
ipconfig /flushdns

DNS Server Cache Clearing

hljs bash
# BIND named cache clearing
sudo rndc flush

# For a specific zone
sudo rndc flushname example.com

# Unbound cache clearing
sudo unbound-control flush_zone example.com

Browser DNS Cache

To clear DNS cache in Chrome browser:

chrome://net-internals/#dns → Clear host cache

Common DNS Issues and Solutions

1. NXDOMAIN (Domain Not Found)

hljs bash
$ dig nonexistent.example.com
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN

Causes:

  • Domain name misspelled
  • DNS record not yet created
  • Domain expired

Solution:

hljs bash
# Check domain WHOIS information
whois example.com

# Check nameservers
dig example.com NS +short

# Query from authoritative NS
dig @ns1.example.com example.com A

2. SERVFAIL

hljs bash
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL

Causes:

  • Nameserver unreachable
  • DNSSEC validation error
  • Corrupted zone file

Solution:

hljs bash
# Check nameserver reachability
dig @ns1.example.com example.com A

# Check DNSSEC status
dig example.com +dnssec

# Try with a different resolver
dig @1.1.1.1 example.com A

3. Wrong IP Address Returned

Causes:

  • Stale DNS cache
  • Incorrect A record
  • DNS hijacking

Solution:

hljs bash
# Clear cache
sudo systemd-resolve --flush-caches

# Query directly from authoritative NS
dig @ns1.example.com example.com A +short

# Check resolution path with trace
dig example.com +trace

4. Slow DNS Resolution

Causes:

  • DNS server is remote or slow
  • Network latency
  • DNS server overloaded

Solution:

hljs bash
# Measure DNS response time
dig example.com | grep "Query time"

# Compare different DNS servers
for dns in 8.8.8.8 1.1.1.1 9.9.9.9; do
  echo "$dns: $(dig @$dns example.com +short +stats | grep 'Query time')"
done

# Update /etc/resolv.conf
sudo nano /etc/resolv.conf

nameserver 1.1.1.1
nameserver 8.8.8.8
nameserver 9.9.9.9

For persistent DNS settings, use systemd-resolved or NetworkManager configuration instead of directly editing /etc/resolv.conf.

5. DNS Zone Transfer Issue

hljs bash
# Zone transfer test
dig @ns1.example.com example.com AXFR

# Restrict zone transfer (named.conf)
zone "example.com" {
    type master;
    file "/etc/bind/zones/example.com.zone";
    allow-transfer { SLAVE_IP; };
};

DNS Troubleshooting Checklist

hljs bash
#!/bin/bash
# DNS Troubleshooting Script
DOMAIN="example.com"

echo "=== DNS Troubleshooting: $DOMAIN ==="

# 1. Nameserver check
echo -e "\n[1] Nameservers:"
dig $DOMAIN NS +short

# 2. A record check
echo -e "\n[2] A Record:"
dig $DOMAIN A +short

# 3. MX record check
echo -e "\n[3] MX Record:"
dig $DOMAIN MX +short

# 4. TXT record check
echo -e "\n[4] TXT Records:"
dig $DOMAIN TXT +short

# 5. SOA record check
echo -e "\n[5] SOA Record:"
dig $DOMAIN SOA +short

# 6. Check from different DNS servers
echo -e "\n[6] Propagation Check:"
for dns in 8.8.8.8 1.1.1.1 9.9.9.9; do
  result=$(dig @$dns $DOMAIN A +short)
  echo "  $dns → $result"
done

# 7. Reverse DNS check
IP=$(dig $DOMAIN A +short | head -1)
if [ -n "$IP" ]; then
  echo -e "\n[7] Reverse DNS ($IP):"
  dig -x $IP +short
fi

echo -e "\n=== Check Complete ==="

Conclusion

DNS issues are among the most common problems in server management. By effectively using dig and nslookup tools, you can quickly diagnose issues, track propagation processes, and resolve cache problems. Remember to lower TTL values before DNS changes and verify from different DNS servers after changes.

Frequently Asked Questions

How long does DNS propagation take?

DNS propagation time depends on the TTL value. With low TTL (300 sec), changes can propagate in 5-30 minutes. With high TTL (86400 sec), it can take 24-48 hours. NS record changes typically take the longest.

dig command not found, how do I install it?

Ubuntu/Debian: sudo apt install dnsutils, CentOS/RHEL: sudo yum install bind-utils, macOS: Install with Homebrew using brew install bind.

I cleared DNS cache but still see the old IP, why?

Your ISP's DNS server may still be caching the old record. Test using Google DNS (8.8.8.8) or Cloudflare DNS (1.1.1.1). Also remember to clear your browser's DNS cache.

I'm getting NXDOMAIN error, what should I do?

Check that the domain hasn't expired using whois. Verify nameservers are correctly configured with dig domain.com NS. Check that the DNS record exists on the authoritative nameserver with dig @ns1.domain.com domain.com A.

How can I change my DNS server?

On Linux, you can change your DNS server by editing /etc/resolv.conf or updating the systemd-resolved configuration. For persistent changes, it's recommended to use NetworkManager or netplan configuration.

Related Articles

SSH Connection Problem: Can't Connect to Server

SSH connection troubleshooting guide: Path.net firewall rules, Default Block, creating a filter rule for SSH port, and step-by-step troubleshooting.

8 min
sshconnection problemtroubleshooting
Network TrafficInbound— GbpsOutbound— Gbps