How do you troubleshoot a DNS problem?
Show the answer
Say this first
First I separate DNS from the network: does the name fail while the IP address works? Then I query
with dig and read the status. NXDOMAIN means the name does not exist where I asked. SERVFAIL means
the resolver could not get a valid answer, often DNSSEC or a broken delegation. REFUSED means the
server will not answer me. A timeout means nothing came back. Then I narrow it down: another
resolver, the authoritative server directly, and dig +trace to walk the delegation myself.
Go deeper
The toolkit
dig www.example.com # what my configured resolver says
dig @10.0.0.53 www.example.com # a specific resolver
dig @ns1.example.com www.example.com +norecurse # the source of truth, look for aa
dig +trace www.example.com # walk from the root myself
dig @ns1.example.com example.com SOA +short # compare serials on every NS
dig +cd www.example.com # skip DNSSEC checks: works now means DNSSEC is broken
resolvectl status # which resolver Linux is really usingReading the status
| Status | Meaning | Usual cause |
|---|---|---|
| NOERROR, answers | fine | if wrong, a stale cache or split DNS |
| NOERROR, no answers | NODATA, the name exists without that type | AAAA missing, for example |
| NXDOMAIN | name does not exist | typo, missing record, wrong search domain, negative cache |
| SERVFAIL | resolver failed | DNSSEC failure, lame delegation, unreachable authoritative servers |
| REFUSED | policy | resolver not allowing recursion for you |
| timeout | no reply | wrong resolver address, UDP or TCP 53 blocked |
Classic causes
Wrong resolver handed out by DHCP, VPN split DNS rules, a stale hosts file entry, a forgotten search domain, a secondary out of sync, expired DNSSEC signatures, TCP 53 blocked.
They will ask next
nslookup returns the right address but the application still fails. Why?
On Windows, nslookup talks to the DNS server directly and ignores the hosts file, the client cache and VPN name resolution policies. Applications use the system resolver. Test the way the app does with
Resolve-DnsNameon Windows orgetent hostson Linux.What is a lame delegation?
The parent zone lists a name server that is not authoritative for the child: it refuses, or answers without the
aaflag. Resolvers waste time on it and may return SERVFAIL.
Traps
- Trusting nslookup alone on Windows.
- Looking only for an answer and ignoring the status code.