DNS Troubleshooting: How to Fix Common DNS Problems

DNS problems are frustrating because they are invisible. Your code is fine, your server is running, your configuration looks correct, but nothing works. The issue is buried somewhere in the chain between a domain name and an IP address. This guide provides a systematic approach to diagnosing and fixing the most common DNS problems.

The DNS Troubleshooting Methodology

Before diving into specific problems, establish a consistent diagnostic process. DNS issues have a limited number of root causes, and a methodical approach finds them faster than guessing.

Problem: Website Not Loading

The most common DNS symptom. Users cannot reach your website, and the browser shows a "DNS could not resolve" error.

Diagnostic Steps

# Check if the domain resolves at all
dig example.com A +short

# If no result, check the nameservers
dig example.com NS +short

# Query the authoritative nameserver directly
dig @ns1.your-provider.com example.com A +short

# Check if it's a local caching issue
dig @8.8.8.8 example.com A +short
dig @1.1.1.1 example.com A +short

Common Causes

Problem: Email Not Working

Email failures can manifest as bounced messages, delayed delivery, or complete inability to send or receive.

Diagnostic Steps

# Check MX records
dig example.com MX +short

# Verify each MX hostname resolves
dig mail.example.com A +short

# Check SPF record
dig example.com TXT +short | grep spf

# Check DMARC record
dig _dmarc.example.com TXT +short

# Test SMTP connectivity to the mail server

Common Causes

• Missing or incorrect MX records: The MX records point to a server that does not exist or does not accept email for your domain
• Stale MX records from old provider: Records from a previous email service are still present and receiving some email
• SPF record too restrictive or missing: Outgoing email fails authentication checks and is rejected by recipients
• DKIM misconfiguration: Keys have expired, selectors are wrong, or the DNS record was accidentally deleted

Problem: DNS Propagation Delays

You made a change but the old value persists, either everywhere or in some locations.

Diagnostic Steps

# Verify the change at the authoritative nameserver
dig @ns1.your-provider.com example.com A +short

# Check what public resolvers see
dig @8.8.8.8 example.com A +short
dig @1.1.1.1 example.com A +short

# Check the TTL of the cached record
dig @8.8.8.8 example.com A | grep -A1 "ANSWER SECTION"

The Fix

If the authoritative nameserver shows the correct new value but public resolvers show the old value, this is normal propagation behavior. The remaining TTL on cached records determines how long you wait.

If the authoritative nameserver shows the old value, the change was not saved correctly. Re-apply it at your DNS provider.

Problem: Wrong IP Address Resolving

Your domain resolves, but to the wrong IP address.

Diagnostic Steps

# Check what IP is being returned
dig example.com A +short

# Compare against your expected IP
# If wrong, check the authoritative source
dig @ns1.your-provider.com example.com A +short

# Check if there are multiple A records
dig example.com A

Common Causes

• Record pointing to old server: After a server migration, the A record was not updated
• Multiple A records: More than one A record exists, and some point to decommissioned servers. DNS round-robins between them, causing intermittent failures
• CDN or proxy misconfiguration: If using Cloudflare or a similar service, the proxied IP is expected. Check whether the issue is actually at the CDN layer, not DNS
• DNS hijacking: The record was changed without authorization. Check your DNS provider's audit log

Problem: NXDOMAIN Errors

NXDOMAIN means "Non-Existent Domain." The DNS system is explicitly stating that the name does not exist.

Diagnostic Steps for NXDOMAIN

# Check if the name exists at all
dig example.com ANY

# Check if nameservers are responding
dig example.com NS +short

# Query the authoritative nameserver
dig @ns1.your-provider.com example.com A

# Check if this is a subdomain issue
dig subdomain.example.com A
dig example.com A

If the root domain resolves but a subdomain returns NXDOMAIN, the subdomain record is simply missing. If the root domain itself returns NXDOMAIN, the nameserver delegation or the zone itself is broken.

Problem: SERVFAIL Errors

SERVFAIL is a generic server error that typically indicates a problem with DNSSEC validation or a broken delegation chain.

Common Causes

Diagnostic Steps for SERVFAIL

# Try querying with DNSSEC validation disabled
dig example.com A +cd

# If +cd returns a result but without it returns SERVFAIL,
# the problem is DNSSEC

# Check DNSSEC chain
dig example.com DNSKEY +short
dig example.com DS +short

# Check the parent zone's DS record
dig example.com DS @a.gtld-servers.net +short

Problem: Intermittent Resolution Failures

The domain works sometimes and fails other times. This is often the hardest type of DNS problem to diagnose.

Common Causes

• Multiple A records with one stale entry: DNS round-robins between good and bad IPs
• One of multiple nameservers is misconfigured: Some queries hit the working server, others hit the broken one
• Flapping DNSSEC: Signature expiration causing intermittent validation failures
• Rate limiting: Your DNS provider is rate-limiting queries and dropping some

Diagnostic Approach

Query each nameserver individually:

# Get all nameservers
dig example.com NS +short

# Query each one separately
dig @ns1.provider.com example.com A +short
dig @ns2.provider.com example.com A +short
dig @ns3.provider.com example.com A +short

If one returns a different result or fails entirely, you have found the problem.

Essential DNS Troubleshooting Tools

| Tool | Platform | Best For | |------|----------|----------| | dig | Linux, macOS, WSL | Detailed DNS queries with full response data | | nslookup | All platforms | Quick lookups without installing anything | | host | Linux, macOS | Simple, clean reverse and forward lookups | | whois | All platforms | Checking domain registration and registrar info | | Web DNS checkers | Browser | Global propagation and multi-location testing | | DNS monitoring | SaaS | Continuous automated checking and alerting |

DNS troubleshooting follows a consistent pattern: verify the authoritative source, check what resolvers see, compare the two, and trace the discrepancy. Most problems come down to missing records, stale caches, broken delegation, or DNSSEC issues. A systematic approach finds the answer faster than random troubleshooting.