Skip to content

Guide

Troubleshoot a DNS answer

A DNS answer depends on the name, record type, resolver and time. Record all four before calling it propagation.

Ask the exact question

A DNS query asks for a name and a record type. A and AAAA carry IPv4 and IPv6 addresses, MX names mail exchangers, TXT often carries policy text, and NS describes delegation. A CNAME can redirect a name to another owner name; follow the chain before interpreting the final address. A result for A does not answer whether AAAA exists.

Compare the right servers

A recursive resolver may return cached data, while an authoritative server answers from the zone it serves. The TTL tells a cache how long it may keep a positive record before asking again; the remaining TTL seen at a resolver can be lower than the value published in the zone. A low TTL does not push updates instantly to caches that already hold an older answer. Check the delegated authoritative servers, then the resolver your client actually uses. Different authoritative servers giving different answers points to a zone or synchronization issue; an authoritative answer differing from one recursive cache can be an ordinary cache delay.

Distinguish absence from failure

NXDOMAIN means the queried name does not exist. NOERROR with no record of the requested type is often called NODATA: the name exists, but that type has no data. Both can be cached as negative answers, with an SOA record supplying the negative TTL. SERVFAIL is different: the resolver could not complete a useful answer, potentially because of upstream or DNSSEC validation trouble. Modern resolvers may cache failures briefly too, so repeated queries are not always fresh attempts.

When a zone uses DNSSEC, a validating resolver can authenticate records and denial of existence, but a validation failure should be investigated through the delegation and signing chain rather than treated as proof that the name is absent. Save the full response code, answer, authority and resolver address. The planned DNS diagnostic tools on this site are not live yet; these steps work with any standard DNS query client.

Sources