Troubleshoot Business DNS by Starting with the Symptom
Record the full hostname, record type, expected value, observed value, resolver and time. The apex domain, www host, mail exchanger and verification record are different queries and may have different owners.
| Symptom | First checks |
|---|---|
| Domain does not resolve anywhere | Registration status, parent delegation, authoritative nameserver reachability and DNSSEC validation. |
| Some networks see the old value | Authoritative answer, prior TTL, recursive cache and whether all authoritative servers agree. |
| www works but the root does not | Query the apex and www separately; compare A/AAAA/CNAME or flattening behaviour. |
| Email stopped after a change | MX targets, their address records, SPF/DKIM/DMARC, mail-provider verification and accidental proxying. |
| DNS answer is correct but the site fails | TLS certificate, virtual host, proxy/CDN mode, firewall and origin application. |
DNS Troubleshooting Guide: The Testing Sequence
- Freeze and document changes. Record the zone before editing more records and identify the last known-good state.
- Confirm registration and delegation. Verify the domain is active and the registry points to the intended nameservers.
- Trace the chain. Follow root, TLD and authoritative referrals; include DNSSEC validation where enabled.
- Query each authority directly. All authoritative servers should return the intended record and serial state.
- Compare recursive resolvers. Check whether the difference is caching, location or validation behaviour.
- Inspect record interactions. Look for CNAME conflicts, duplicate names, wrong targets, proxied records and missing target addresses.
- Test the service behind DNS. A correct IP does not prove the web server, certificate or mail service is healthy.
- Make one controlled correction. Preserve the old value, note TTL and verify both authoritative and application results.
What DNS Propagation Really Means
Authoritative changes can be immediate at the provider while recursive resolvers continue serving a previously cached answer until its TTL expires. That differs from inconsistent authoritative servers, broken delegation or a cached negative answer. Record which resolver returned which value rather than waiting without evidence.
DNS often carries website, email, verification and security records owned by different systems. Export or record the full zone and identify dependencies before destructive changes.
DNS Mistakes That Extend Outages
- Editing several records while different resolvers still show different cached states.
- Testing only the root domain when users visit www or another hostname.
- Creating a CNAME where another record type already exists at that name.
- Pointing MX to a hostname that has no usable address record.
- Confusing a web proxy or certificate failure with DNS resolution.
- Disabling DNSSEC at one layer but not the delegation chain.
DNS Troubleshooting Frequently Asked Questions
Where should DNS troubleshooting start?
At the authoritative nameserver. DNS troubleshooting that starts with a public resolver is reading a cache, which may be showing an answer that no longer exists.
How long does a DNS change take to apply?
As long as the record's TTL, plus whatever the resolver in front of the user decides to keep. DNS troubleshooting accounts for TTL before concluding a change has failed.
What is the most common DNS troubleshooting mistake?
Changing several records at once. When something then breaks, DNS troubleshooting has no way to attribute the failure, so changes are made one at a time and verified.
Can DNS troubleshooting explain email that stopped arriving?
Often, yes. MX, SPF, DKIM and DMARC are all DNS records, and DNS troubleshooting is usually where an unexplained mail failure is actually resolved.
What tools are used for DNS troubleshooting?
Direct queries against the authoritative server and a sample of public resolvers, comparing what each returns. DNS troubleshooting depends on comparing answers, not trusting one.
DNS Troubleshooting: Sources and Further Reading
Platform requirements and recommended practices change. These primary sources were checked when this guide was reviewed.
- Cloudflare DNS troubleshooting — primary documentation consulted for this guide.
- ICANN DNS basics — primary documentation consulted for this guide.