DNS Troubleshooting: Diagnosing Propagation & Resolution Errors

Common DNS Error Codes & Diagnostics

When debugging website downtime or email failure, DNS is frequently the root cause. Here is how to diagnose and resolve the most common issues:

1. NXDOMAIN (Non-Existent Domain)

• Symptom: Browser reports "This site can't be reached" or `DNS_PROBE_FINISHED_NXDOMAIN`.
• Causes: Typo in domain name, missing A/CNAME record in zone file, or domain expired at registrar.
• Remedy: Query authoritative nameservers directly with DNS Lookup to check if the record exists in the active zone.

2. SERVFAIL (Server Failure)

• Symptom: Queries intermittently fail across specific public resolvers.
• Causes: Broken DNSSEC chain of trust (mismatched DS record at registrar), or authoritative nameservers unreachable.
• Remedy: Verify DNSSEC key synchronization and inspect nameserver responsiveness with WHOIS / RDAP Lookup.

3. Stale Cache / Propagation Delays

• Symptom: Some users see the new server while others are routed to the old server.
• Causes: High TTL on previous records cached across recursive ISPs.
• Remedy: Flush local DNS cache (`ipconfig /flushdns` on Windows, `dscacheutil -flushcache` on macOS) and use multiple Anycast resolvers to observe live propagation state.

4. Broken Email Delivery (SPF / DMARC Failures)

• Symptom: Inbound emails bounce with "550 5.7.1 SPF check failed".
• Causes: Outbound mail server IP not included in `v=spf1` TXT record, or multiple SPF records published (violating RFC 7208).
• Remedy: Use our DNS Lookup Tool to inspect and validate SPF and DMARC syntax.

Example: Reading an NXDOMAIN Response (Illustrative)

;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 41291
;; QUESTION SECTION:
;typo-domain.com.              IN      A
;; AUTHORITY SECTION:
com.                    900     IN      SOA     a.gtld-servers.net.

The `status: NXDOMAIN` line, not an empty answer section, is the actual signal — DNS distinguishes "this name doesn't exist" (NXDOMAIN) from "this name exists but has no records of the requested type" (NOERROR with an empty ANSWER section), and the two point to very different fixes: a typo or missing registration versus a missing record in an otherwise-valid zone.