Lesson 3 of 3
Debugging DNS problems
2 min
Most "DNS is broken" reports are really one of a handful of problems. Work through them in order.
1. Ask the authoritative servers directly
dig NS yourcompany.com +short
dig @ns1.yourprovider.com yourcompany.com AIf the authoritative answer is wrong, the fix is in your zone. If it's right, the problem is caching or delegation.
2. Follow the delegation
dig +trace yourcompany.comThis shows each step from the root. A broken step usually means the registrar lists nameservers that don't actually serve your zone (a "lame delegation").
3. Check what users' resolvers see
Compare public resolvers (@8.8.8.8, @1.1.1.1, @9.9.9.9). Different answers mean old cached data. Wait for the TTL, or reduce it next time.
4. Remember negative caching
If someone looked up a name before it existed, resolvers cache the "doesn't exist" answer for the zone's negative TTL (from the SOA record). New records can appear "missing" for a while.
Write down the exact command and resolver for every test. "It works for me" is useless without knowing which resolver answered.
5. Common culprits
- A trailing-dot mistake:
mail.yourcompany.com.yourcompany.com - A CNAME at the zone apex, which isn't allowed
- Two conflicting records after a migration