How do you tell a DNS problem from a network problem?
Show the answer
Say this first
I test by address and by name separately. If ping 198.51.100.10 works but the same test by name fails,
the path is fine and resolution is broken. Then I run nslookup against the configured resolver and
against another known-good one. If the other one answers, the configured resolver is the problem. If none
answer, I check reachability to port 53. I also check that the name resolves to the right address,
because a wrong answer looks exactly like a network outage.
Go deeper
The split
| Test | If it works | If it fails |
|---|---|---|
ping 198.51.100.10 | the IP path is fine | a network problem: routing, filtering |
ping app.example.com | resolution and path are fine | DNS, or the name points at a wrong address |
nslookup app.example.com | shows the server used and the answer | timed out: server unreachable; NXDOMAIN: name does not exist there; SERVFAIL: the resolver could not get an answer |
Common DNS faults
- Clients point at a wrong or dead resolver, from a bad DHCP option 6 or a static setting.
- A firewall allows UDP 53 but blocks TCP 53, so large answers fail. Resolvers retry over TCP when a UDP answer is truncated, and zone transfers always use TCP.
- Split DNS: an internal name resolves to the external address, or VPN users get the wrong view.
- Stale records after a migration, cached for the record's TTL.
- Negative caching: an NXDOMAIN stays cached for the zone's negative TTL after a record was briefly missing.
- Search suffixes: a short name like
crmresolves only when the suffix list is right.
Host-side checks
Windows: ipconfig /all for the DNS servers in use, ipconfig /flushdns, Resolve-DnsName. Linux:
resolvectl status with systemd-resolved, /etc/resolv.conf, and dig.
They will ask next
The name resolves and ping by name fails, but ping to the server's real IP works. What is wrong?
The name resolves to the wrong address: a stale record, a cached old answer, a hosts file entry, or split DNS returning the external address. Compare the answer with the expected address and check the TTL and the hosts file.
Traps
- Saying DNS only uses UDP. Truncated answers retry over TCP 53, and blocking it breaks large responses.