DNS Records and Troubleshooting

Introduction

When you set up a website or email for a domain, you edit DNS records. When something breaks, you need a systematic way to find out where. This lesson covers both.

Record types

A domain's DNS settings are a list of records. The common types:

Type	Purpose	Example
A	Name to IPv4 address	`example.com` to `93.184.216.34`
AAAA	Name to IPv6 address	`example.com` to an IPv6 address
CNAME	An alias pointing to another name	`www.example.com` to `example.com`
MX	Where email for the domain goes	`mail.example.com` with a priority
TXT	Free text, used to prove ownership and for email security	SPF and domain verification values
NS	Which servers are authoritative for the domain	`ns1.provider.com`

A CNAME cannot sit on the bare domain name (the "apex") together with other records, so providers offer special alias features for that case.

Quick quiz

Which DNS record type tells the world where to deliver email for your domain?

TTL and caching

Each record has a TTL (time to live), in seconds, saying how long resolvers may remember it. A TTL of 3600 means up to an hour. Long TTLs reduce load and speed things up, but changes take longer to reach everyone. Before a planned change, lower the TTL a day ahead, make the change, then raise it again. This is why "DNS propagation" sometimes feels slow: it is mostly caches expiring.

Querying DNS

dig (Linux and macOS) and nslookup (everywhere) ask DNS questions:

Terminal

dig example.com A
dig example.com MX +short
dig @8.8.8.8 example.com         # ask a specific resolver
nslookup example.com

Look at the answer section, the TTL and which server answered. Asking different resolvers can reveal caching or misconfiguration.

A troubleshooting routine

When "the internet is not working" or "the site will not load", move from near to far:

Is my device connected? Check Wi-Fi or cable.
Can I reach the local router? ping 192.168.1.1 (use your gateway address).
Can I reach the internet by address? ping 1.1.1.1 or ping 8.8.8.8. If this works but names do not, the problem is DNS.
Does DNS work? nslookup example.com. Try another resolver.
Can I reach the site? curl -I https://example.com shows the status and headers, or an error.
Where does the path break? traceroute example.com (Linux and macOS) or tracert example.com (Windows) lists each router hop and its delay. A stall at one hop shows where to look, though some routers simply do not answer.
Is it everyone or just me? Test from another device or network, or an online status checker.

Reading results:

Timeouts often mean a firewall or no route.
"Connection refused" means the host is reachable but nothing is listening on that port.
Certificate errors mean a TLS problem, such as an expired or mismatched certificate.
Very high or varying ping times suggest congestion or poor Wi-Fi.

Safe use of tools

Use these tools only on networks and systems you own or are allowed to test. Port scanning other people's systems can be illegal.

Try it yourself

Use dig or nslookup to find the MX and NS records for a domain you use. Then run traceroute or tracert to a website and count the hops.

Summary

DNS records include A, AAAA, CNAME, MX, TXT and NS, and TTL controls how long they are cached.
dig and nslookup show what DNS says, and lowering TTL before changes speeds them up.
Troubleshoot from near to far: device, router, internet by address, DNS, site, path.