Walk me through troubleshooting name resolution with dig and nslookup.
Show the answer
Say this first
I query the resolver the client uses, then a different resolver, then the authoritative server.
dig name @resolver shows the status (NOERROR, NXDOMAIN, SERVFAIL, REFUSED), the answer, its remaining
TTL and which server replied. dig +trace name walks from the root down, which shows where a delegation
breaks. dig name @authoritative +norecurse shows the source of truth. Comparing the three tells me
whether the fault is the resolver, a cache, or the zone itself.
Go deeper
A healthy answer
$ dig app.example.com @10.0.0.53
; <<>> DiG 9.18.28 <<>> app.example.com @10.0.0.53
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41872
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;app.example.com. IN A
;; ANSWER SECTION:
app.example.com. 247 IN A 203.0.113.40
;; Query time: 3 msec
;; SERVER: 10.0.0.53#53(10.0.0.53) (UDP)
;; MSG SIZE rcvd: 60Read the status, the flags (aa means an authoritative answer, ra means recursion is available), the
TTL (a cached answer counts down), and the SERVER line.
Statuses
| Status | Meaning |
|---|---|
| NOERROR with an answer | resolved |
| NOERROR with ANSWER: 0 | the name exists, but not with that record type |
| NXDOMAIN | the name does not exist |
| SERVFAIL | the resolver could not get an answer: upstream unreachable, broken delegation, DNSSEC failure |
| REFUSED | the server will not answer you, often recursion not allowed for your source |
connection timed out; no servers could be reached | the server is down or port 53 is blocked |
Useful options
dig +trace app.example.comfollows the delegation from the root and shows where it breaks.dig app.example.com @ns1.example.com +norecurseasks the authoritative server directly.dig -x 203.0.113.40for the PTR record,dig example.com MX,dig example.com SOA.dig +tcp app.example.comtests DNS over TCP 53.
nslookup equivalents
nslookup app.example.com 10.0.0.53 and nslookup -type=mx example.com. "Non-authoritative answer" only
means the answer came from a resolver's cache, not from the zone's own server.
They will ask next
nslookup prints "Server UnKnown". Is DNS broken?
No. nslookup does a reverse lookup on the DNS server's own address to show its name, and "UnKnown" only means that address has no PTR record. The answers can still be correct.
Why does a record change not show up for users?
Resolvers keep the old answer until its TTL expires, and clients and browsers cache too. Lower the TTL well before a planned change, then flush the caches you control.
Traps
- Reading "Non-authoritative answer" as an error.