Stage 3 · Build
DNS: The Phone Book of the Internet
Debugging DNS
dig, nslookup, systemd-resolve — trace resolution failures in production.
dig Deep Dive
dig is the most powerful DNS debugging tool. It queries DNS servers directly and shows detailed response information including the query, answer, authority, and additional sections.
# Basic lookup
dig example.com
# Short output (just the answer)
dig +short example.com
# Query a specific nameserver
dig @8.8.8.8 example.com
# Query a specific record type
dig MX example.com
dig TXT example.com
dig AAAA example.com
# Trace the full resolution chain
dig +trace example.com
# Check TTL
dig example.com | grep -A1 "ANSWER SECTION"The +short flag gives you just the IP address. The @ syntax lets you query a specific resolver to test if a record is published correctly at the authoritative source.
nslookup and host
nslookup is available everywhere but gives less detail than dig. host is a simpler alternative common on Linux. Use dig when you have a choice — it gives more information.
# nslookup (available on all platforms)
nslookup example.com
nslookup -type=MX example.com
# host (simpler output)
host example.com
host -t MX example.com
# systemd-resolved status (Linux with systemd)
resolvectl status
resolvectl query example.comnslookup is deprecated in favor of dig on many distributions. If you are writing scripts, use dig +short for easy parsing. host is good for quick checks.
Tracing the Full Chain
# Full trace showing each delegation step
dig +trace example.com
# Trace only the final authoritative answer
dig +trace +nodnssec example.com
# Compare what different resolvers return
dig @8.8.8.8 example.com A +short
dig @1.1.1.1 example.com A +short
dig @ns1.example.com example.com A +shortThe +trace output shows each delegation step. You will see the root server referral, the TLD referral, and the final authoritative answer. This helps identify where in the chain a problem occurs.
After changing a DNS record, query the authoritative nameserver directly (dig @ns1.example.com) to verify the record is correct, then query public resolvers (8.8.8.8, 1.1.1.1) to check if they have the updated record. Differences indicate caching.
Common DNS Failures
| Error | Meaning | Likely Cause |
|---|---|---|
| SERVFAIL | Server failed to answer | Authoritative NS down or misconfigured |
| NXDOMAIN | Domain does not exist | Typo or record not created |
| REFUSED | Server refused the query | DNS server does not have the zone |
| TIMEOUT | No response | Firewall blocking DNS port 53 |
| NOERROR but empty | Query succeeded, no records | Record deleted or not propagated |
# SERVFAIL - check if authoritative NS is reachable
dig @ns1.example.com example.com
# If this also fails, the nameserver has a problem
# NXDOMAIN - verify the record exists at the source
dig @ns1.example.com www.example.com A
# REFUSED - check if you are querying the right server
dig @ns1.example.com example.com NS
# TIMEOUT - check if port 53 is open
nc -zuv 8.8.8.8 53
sudo tcpdump -i eth0 port 53When dig returns SERVFAIL, the recursive resolver could not get an answer. Query the authoritative server directly to isolate whether the problem is with the resolver or the authoritative server.
Production DNS Debugging
# 1. Check what the system resolver sees
resolvectl query example.com # Linux
scutil --dns | grep example # macOS
# 2. Check what the authoritative server says
dig @ns1.example.com example.com +short
# 3. Check if the record was recently changed (TTL)
dig example.com | grep -E '^[^;]' | head -5
# 4. Check for CNAME chains
dig www.example.com
# 5. Check DNSSEC validation
dig example.com +dnssec
delv example.com # DNSSEC validation tool
# 6. Capture DNS traffic
sudo tcpdump -i eth0 port 53 -nn -c 20The key insight is comparing what your local resolver sees vs what the authoritative server says. If they differ, the problem is caching. If they agree but the answer is wrong, the record is misconfigured at the source.
Many DNS issues start with the wrong resolver configured. Check /etc/resolv.conf (Linux) or system preferences (macOS). If you are pointing at a resolver that does not exist or is unreachable, nothing else matters.
Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.