Troubleshooting DNS problems
A systematic method for "the site will not load" and "email is not arriving".
DNS problems are diagnosable. Work from the authoritative source outward.
Step 1: Is the name resolving at all?
dig example.com +shortNo output → the record does not exist, or is not where you think. Go to step 2.
An IP → DNS works; the problem is elsewhere (firewall, web server, application).
Step 2: What does the authoritative server say?
dig NS example.com +short # which nameservers are we asking?
dig example.com @ns1.authoritative.example # ask the source of truthIf the authoritative answer is correct but public resolvers disagree, you are waiting on a cache — see DNS propagation.
If the authoritative answer is wrong or missing, fix the zone. Common causes: the record was added to an old provider's zone; a typo in the name; the wrong record type.
Step 3: Check each record type you expect
dig example.com A +short # web
dig www.example.com A +short # the www variant — a very common miss
dig example.com MX +short # mail
dig example.com TXT +short # SPF, verification, DKIM at selector._domainkey
dig example.com CAA +short # certificate issuanceStep 4: Rule out the client
dig @1.1.1.1 example.com +short # bypass your own resolverThen flush local caches (see the propagation article) and try a private browser window.
Frequent culprits
| Symptom | Likely cause |
|---|---|
| Site works for some people, not others | Different caches/TTLs, or two conflicting records |
www broken, apex fine (or vice versa) | Only one of the two was created |
| Email stopped right after a DNS change | MX or SPF/DKIM/DMARC records not recreated |
| Certificate will not issue | Domain does not resolve here, or CAA blocks the CA, or port 80 blocked |
| Subdomain resolves to nothing | Missing record; or a wildcard being shadowed |
| Changed record, no effect at all | Editing the wrong zone, or apex change caching on the old TTL |
Hands-on tools
The DNS lookup, DNS propagation, reverse DNS and SPF/DMARC checker tools do most of this from a browser, from multiple vantage points.
When to ask us
If the authoritative nameserver shows the correct answer and the world still cannot see it after the TLD TTL has passed, open a ticket with:
the domain and record,
the exact
digoutput from the authoritative server,and the time you made the change.
Related reading