Tutorials · Troubleshooting
How to Troubleshoot DNS Problems With dig and nslookup
'The Internet is down' is often DNS. Learn to check which DNS server a device uses, query records directly, compare answers and clear caches.
Before you start
- dig (Linux/macOS; part of bind9-dnsutils) or nslookup / Resolve-DnsName on Windows
- The name that does not resolve and the device's DNS server address
Step by step
Check which DNS server the device uses
A wrong or unreachable DNS server breaks everything by name while IP addresses still work.
resolvectl status # Linux (systemd) scutil --dns | grep nameserver # macOS ipconfig /all # Windows
Query a name
Look at the status (NOERROR, NXDOMAIN, SERVFAIL), the answer and the query time.
dig www.example.com nslookup www.example.com Resolve-DnsName www.example.com # PowerShell
Ask a specific server
Compare your internal DNS with another resolver. Different answers show where the problem is.
dig @10.1.10.1 portal.corp.example dig @9.9.9.9 www.example.com
Check the record types you need
Mail, services and IPv6 use different records.
dig example.com MX dig _sip._tcp.example.com SRV dig www.example.com AAAA dig -x 10.1.20.15 # reverse lookup (PTR)
Follow the delegation
+trace walks from the root servers down and shows where a public domain's resolution breaks, for example after changing name servers.
dig +trace www.example.comClear caches
After fixing a record, old answers can stay cached until the TTL expires.
ipconfig /flushdns # Windows sudo resolvectl flush-caches # Linux sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder # macOS
Fix the cause
Typical causes: DHCP hands out an old DNS server, the internal zone is missing a record, a firewall blocks UDP/TCP 53, or split DNS returns the internal address to outside users.
Commands are generic, industry-standard examples. Exact syntax and menu names vary by model and firmware; check your device's manual on the Documentation page.
Pro tips
- SERVFAIL often means DNSSEC validation failed or the upstream server is unreachable.
- Keep TTLs short (300 s) a day before planned changes, then raise them again.
- Give every network two DNS servers so one failure does not stop name resolution.
FAQ
Frequently asked questions
NXDOMAIN or SERVFAIL: what is the difference?
NXDOMAIN means the name does not exist. SERVFAIL means the server could not get an answer, for example because of a broken upstream or DNSSEC problem.
Why does a name work on one PC but not another?
They use different DNS servers, or one has an old cached answer or a hosts-file entry.
Keep learning
Related guides
Configure DHCP scopes and options
Read more →Block malware with DNS filtering
Read more →Capture traffic with Wireshark
Read more →How to Troubleshoot Network Problems With Ping, Traceroute and MTR
Find where a connection breaks or slows down in minutes. Use ping for reachability and loss, traceroute for the path, and MTR to see loss and latency on every hop at once.
Read more →How to Capture and Read Network Traffic With Wireshark and tcpdump
When logs are not enough, look at the packets. Capture traffic with tcpdump or Wireshark, filter it down to the problem, and spot retransmissions, DNS failures, DHCP issues and TLS errors.
Read more →How to Test Network Speed Between Two Points With iperf3
Internet speed tests do not tell you how fast your LAN, Wi-Fi or site-to-site link really is. iperf3 measures throughput, loss and jitter between two machines you control.
Read more →Stuck on a step?
Ask Navijin technical support or an authorised partner for help with your configuration.