DNS Troubleshooting and Resolution Guide

Introduction

DNS (Domain Name System) is one of the fundamental components of internet infrastructure. This system translates domain names to IP addresses, and when it doesn't work correctly, many services including website access, email delivery, and server connections can be disrupted.

In this guide, we'll examine the tools and methods you can use to diagnose and resolve DNS issues in detail.

DNS Fundamentals

DNS Record Types

Record Type	Description	Example
A	IPv4 address mapping	`example.com → 1.2.3.4`
AAAA	IPv6 address mapping	`example.com → 2001:db8::1`
CNAME	Alias to another domain	`www → example.com`
MX	Mail server routing	`mail.example.com (priority: 10)`
TXT	Text record (SPF, DKIM, etc.)	`v=spf1 ip4:1.2.3.4 -all`
NS	Nameserver definition	`ns1.example.com`
PTR	Reverse DNS record	`4.3.2.1 → example.com`
SOA	Zone authority record	TTL, serial, refresh info

DNS Resolution Process

User → Local DNS Cache → Recursive Resolver → Root NS → TLD NS → Authoritative NS → IP Address

DNS Diagnosis with dig Command

dig (Domain Information Groper) is the most powerful tool for diagnosing DNS issues.

Basic Usage

hljs bash

# Query A record
dig example.com A

# Query from a specific DNS server
dig @8.8.8.8 example.com A

# Short output
dig example.com +short

# Query all record types
dig example.com ANY

# Query MX record
dig example.com MX

# Query NS record
dig example.com NS

# Query TXT record
dig example.com TXT

Detailed Queries

hljs bash

# Trace mode — shows resolution process step by step
dig example.com +trace

# SOA record — zone information
dig example.com SOA

# Reverse DNS query
dig -x 1.2.3.4

# Query over TCP (for large responses)
dig example.com +tcp

# DNSSEC validation
dig example.com +dnssec

Reading dig Output

hljs bash

$ dig example.com A

;; QUESTION SECTION:
;example.com.                   IN      A

;; ANSWER SECTION:
example.com.            300     IN      A       93.184.216.34

;; AUTHORITY SECTION:
example.com.            86400   IN      NS      ns1.example.com.

;; Query time: 23 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; MSG SIZE  rcvd: 56

Key fields:

ANSWER SECTION: The query response
TTL (300): How long the record stays in cache (seconds)
Query time: Response time
SERVER: DNS server that provided the answer

nslookup Command

nslookup is a simpler tool for DNS queries:

hljs bash

# Basic query
nslookup example.com

# Query from specific DNS server
nslookup example.com 8.8.8.8

# MX record query
nslookup -type=MX example.com

# NS record query
nslookup -type=NS example.com

# TXT record query
nslookup -type=TXT example.com

# Reverse DNS
nslookup 1.2.3.4

DNS Propagation Check

When DNS changes are made, it takes time for new records to propagate to all DNS servers.

Propagation Times

Record Type	Typical TTL	Propagation Time
A / AAAA	300-3600 sec	5 min - 1 hour
MX	3600-86400 sec	1 - 24 hours
NS	86400 sec	24 - 48 hours
TXT	300-3600 sec	5 min - 1 hour

Checking from Different DNS Servers

hljs bash

# Google DNS
dig @8.8.8.8 example.com A +short

# Cloudflare DNS
dig @1.1.1.1 example.com A +short

# Quad9 DNS
dig @9.9.9.9 example.com A +short

# Local ISP DNS
dig example.com A +short

Online propagation check tools:

To speed up DNS propagation, lower the TTL value before making changes (e.g., 300 seconds). You can increase the TTL again after the change is complete.

DNS Cache Clearing

Operating System Cache Clearing

hljs bash

# Linux (systemd-resolved)
sudo systemd-resolve --flush-caches
sudo resolvectl flush-caches

# macOS
sudo dscacheutil -flushcache
sudo killall -HUP mDNSResponder

# Windows
ipconfig /flushdns

DNS Server Cache Clearing

hljs bash

# BIND named cache clearing
sudo rndc flush

# For a specific zone
sudo rndc flushname example.com

# Unbound cache clearing
sudo unbound-control flush_zone example.com

Browser DNS Cache

To clear DNS cache in Chrome browser:

chrome://net-internals/#dns → Clear host cache

Common DNS Issues and Solutions

1. NXDOMAIN (Domain Not Found)

hljs bash

$ dig nonexistent.example.com
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN

Causes:

Domain name misspelled
DNS record not yet created
Domain expired

Solution:

hljs bash

# Check domain WHOIS information
whois example.com

# Check nameservers
dig example.com NS +short

# Query from authoritative NS
dig @ns1.example.com example.com A

2. SERVFAIL

hljs bash

;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL

Causes:

Nameserver unreachable
DNSSEC validation error
Corrupted zone file

Solution:

hljs bash

# Check nameserver reachability
dig @ns1.example.com example.com A

# Check DNSSEC status
dig example.com +dnssec

# Try with a different resolver
dig @1.1.1.1 example.com A

3. Wrong IP Address Returned

Causes:

Stale DNS cache
Incorrect A record
DNS hijacking

Solution:

hljs bash

# Clear cache
sudo systemd-resolve --flush-caches

# Query directly from authoritative NS
dig @ns1.example.com example.com A +short

# Check resolution path with trace
dig example.com +trace

4. Slow DNS Resolution

Causes:

DNS server is remote or slow
Network latency
DNS server overloaded

Solution:

hljs bash

# Measure DNS response time
dig example.com | grep "Query time"

# Compare different DNS servers
for dns in 8.8.8.8 1.1.1.1 9.9.9.9; do
  echo "$dns: $(dig @$dns example.com +short +stats | grep 'Query time')"
done

# Update /etc/resolv.conf
sudo nano /etc/resolv.conf

nameserver 1.1.1.1
nameserver 8.8.8.8
nameserver 9.9.9.9

For persistent DNS settings, use systemd-resolved or NetworkManager configuration instead of directly editing /etc/resolv.conf.

5. DNS Zone Transfer Issue

hljs bash

# Zone transfer test
dig @ns1.example.com example.com AXFR

# Restrict zone transfer (named.conf)
zone "example.com" {
    type master;
    file "/etc/bind/zones/example.com.zone";
    allow-transfer { SLAVE_IP; };
};

DNS Troubleshooting Checklist

hljs bash

#!/bin/bash
# DNS Troubleshooting Script
DOMAIN="example.com"

echo "=== DNS Troubleshooting: $DOMAIN ==="

# 1. Nameserver check
echo -e "\n[1] Nameservers:"
dig $DOMAIN NS +short

# 2. A record check
echo -e "\n[2] A Record:"
dig $DOMAIN A +short

# 3. MX record check
echo -e "\n[3] MX Record:"
dig $DOMAIN MX +short

# 4. TXT record check
echo -e "\n[4] TXT Records:"
dig $DOMAIN TXT +short

# 5. SOA record check
echo -e "\n[5] SOA Record:"
dig $DOMAIN SOA +short

# 6. Check from different DNS servers
echo -e "\n[6] Propagation Check:"
for dns in 8.8.8.8 1.1.1.1 9.9.9.9; do
  result=$(dig @$dns $DOMAIN A +short)
  echo "  $dns → $result"
done

# 7. Reverse DNS check
IP=$(dig $DOMAIN A +short | head -1)
if [ -n "$IP" ]; then
  echo -e "\n[7] Reverse DNS ($IP):"
  dig -x $IP +short
fi

echo -e "\n=== Check Complete ==="

Conclusion

DNS issues are among the most common problems in server management. By effectively using dig and nslookup tools, you can quickly diagnose issues, track propagation processes, and resolve cache problems. Remember to lower TTL values before DNS changes and verify from different DNS servers after changes.

DNS Troubleshooting and Resolution Guide

Table of Contents

Introduction

DNS Fundamentals

DNS Record Types

DNS Resolution Process

DNS Diagnosis with dig Command

Basic Usage

Detailed Queries

Reading dig Output

nslookup Command

DNS Propagation Check

Propagation Times

Checking from Different DNS Servers

DNS Cache Clearing

Operating System Cache Clearing

DNS Server Cache Clearing

Browser DNS Cache

Common DNS Issues and Solutions

1. NXDOMAIN (Domain Not Found)

2. SERVFAIL

3. Wrong IP Address Returned

4. Slow DNS Resolution

5. DNS Zone Transfer Issue

DNS Troubleshooting Checklist

Conclusion

Related Articles

SSH Connection Problem: Can't Connect to Server

RDP Connection Problem: Can't Connect to Windows Server

How to Run an MTR Test and Submit Results to Support