How do you troubleshoot DNS errors?

A browser’s “DNS error” describes a symptom, not a single root cause. A name might be mistyped, an authoritative server unreachable, a resolver might hold an older answer, or DNSSEC validation might fail. Identify the failing stage before changing a configuration.

Distinguish the responses

NXDOMAIN means the queried name does not exist according to the DNS server providing the answer. NODATA is a common term for a name that exists but has no record of the requested type: it may have A but no AAAA. SERVFAIL means the server could not complete the query; it is not evidence that the name is absent. A timeout means no answer arrived in time and calls for a reachability check.

Additional details may accompany a response. RFC 8914 defines Extended DNS Errors, which can explain some SERVFAIL cases without changing the original response code. Not every tool displays them.

Follow the resolution path

Check the exact name and record type first. Identify the domain’s authoritative nameservers and query one directly. If it times out or reports an error, investigate delegation, reachability and zone configuration. If the authoritative answer is correct but a recursive answer differs, compare its cache and selected resolver with the DNS configuration checker.

Compare A and AAAA: a site can work over IPv4 and fail over IPv6. For mail, check MX and then the address records of the selected mail host. An HTTP 404 or TLS warning occurs after name resolution and needs a separate investigation. Do not switch DNS settings blindly because a browser displayed a broad error message.

Check caches and devices

Try the same query through another recursive resolver and from another device. A failure on only one device points towards its connection, system resolver, browser DoH setting or local cache. If resolvers consistently return NXDOMAIN, confirm registration, delegation and the presence of the record in the active zone.

A negative answer can stay cached after a record is created. RFC 2308 explains caching of NXDOMAIN and NODATA. Record the relevant TTL and time of change instead of repeatedly editing a correct zone.

Give support useful evidence

Before contacting support, note the full name, record type, query time, resolver address and response code. Include answers from an authoritative and a recursive server without disclosing passwords or tokens. This evidence separates incorrect DNS data from a network failure or an application problem and allows a focused repair.