Turn the Symptom Into a Precise Query
Record the full hostname, record type, expected value, observed value, resolver and time. The apex domain, www host, mail exchanger and verification record are different queries and may have different owners.
| Symptom | First checks |
|---|---|
| Domain does not resolve anywhere | Registration status, parent delegation, authoritative nameserver reachability and DNSSEC validation. |
| Some networks see the old value | Authoritative answer, prior TTL, recursive cache and whether all authoritative servers agree. |
| www works but the root does not | Query the apex and www separately; compare A/AAAA/CNAME or flattening behaviour. |
| Email stopped after a change | MX targets, their address records, SPF/DKIM/DMARC, mail-provider verification and accidental proxying. |
| DNS answer is correct but the site fails | TLS certificate, virtual host, proxy/CDN mode, firewall and origin application. |
DNS Troubleshooting Sequence
- Freeze and document changes. Record the zone before editing more records and identify the last known-good state.
- Confirm registration and delegation. Verify the domain is active and the registry points to the intended nameservers.
- Trace the chain. Follow root, TLD and authoritative referrals; include DNSSEC validation where enabled.
- Query each authority directly. All authoritative servers should return the intended record and serial state.
- Compare recursive resolvers. Check whether the difference is caching, location or validation behaviour.
- Inspect record interactions. Look for CNAME conflicts, duplicate names, wrong targets, proxied records and missing target addresses.
- Test the service behind DNS. A correct IP does not prove the web server, certificate or mail service is healthy.
- Make one controlled correction. Preserve the old value, note TTL and verify both authoritative and application results.
What DNS Propagation Really Means
Authoritative changes can be immediate at the provider while recursive resolvers continue serving a previously cached answer until its TTL expires. That differs from inconsistent authoritative servers, broken delegation or a cached negative answer. Record which resolver returned which value rather than waiting without evidence.
DNS often carries website, email, verification and security records owned by different systems. Export or record the full zone and identify dependencies before destructive changes.
DNS Mistakes That Extend Outages
- Editing several records while different resolvers still show different cached states.
- Testing only the root domain when users visit www or another hostname.
- Creating a CNAME where another record type already exists at that name.
- Pointing MX to a hostname that has no usable address record.
- Confusing a web proxy or certificate failure with DNS resolution.
- Disabling DNSSEC at one layer but not the delegation chain.
Sources and Further Reading
Platform requirements and recommended practices change. These primary sources were checked when this guide was reviewed.
- Cloudflare DNS troubleshooting — primary documentation consulted for this guide.
- ICANN DNS basics — primary documentation consulted for this guide.