Tutorials · Troubleshooting

How to Troubleshoot DNS Problems With dig and nslookup

'The Internet is down' is often DNS. Learn to check which DNS server a device uses, query records directly, compare answers and clear caches.

Beginner12 min7 steps

Before you start

dig (Linux/macOS; part of bind9-dnsutils) or nslookup / Resolve-DnsName on Windows
The name that does not resolve and the device's DNS server address

Step by step

Check which DNS server the device uses

A wrong or unreachable DNS server breaks everything by name while IP addresses still work.

resolvectl status            # Linux (systemd)
scutil --dns | grep nameserver  # macOS
ipconfig /all                 # Windows

Query a name

Look at the status (NOERROR, NXDOMAIN, SERVFAIL), the answer and the query time.

dig www.example.com
nslookup www.example.com
Resolve-DnsName www.example.com   # PowerShell

Ask a specific server
Compare your internal DNS with another resolver. Different answers show where the problem is.
```
dig @10.1.10.1 portal.corp.example
dig @9.9.9.9 www.example.com
```

Check the record types you need

Mail, services and IPv6 use different records.

dig example.com MX
dig _sip._tcp.example.com SRV
dig www.example.com AAAA
dig -x 10.1.20.15            # reverse lookup (PTR)

Follow the delegation
+trace walks from the root servers down and shows where a public domain's resolution breaks, for example after changing name servers.
```
dig +trace www.example.com
```

Clear caches

After fixing a record, old answers can stay cached until the TTL expires.

ipconfig /flushdns                          # Windows
sudo resolvectl flush-caches                # Linux
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder  # macOS

Fix the cause
Typical causes: DHCP hands out an old DNS server, the internal zone is missing a record, a firewall blocks UDP/TCP 53, or split DNS returns the internal address to outside users.

Commands are generic, industry-standard examples. Exact syntax and menu names vary by model and firmware; check your device's manual on the Documentation page.

Pro tips

SERVFAIL often means DNSSEC validation failed or the upstream server is unreachable.
Keep TTLs short (300 s) a day before planned changes, then raise them again.
Give every network two DNS servers so one failure does not stop name resolution.

FAQ

Frequently asked questions

NXDOMAIN or SERVFAIL: what is the difference?

NXDOMAIN means the name does not exist. SERVFAIL means the server could not get an answer, for example because of a broken upstream or DNSSEC problem.

Why does a name work on one PC but not another?

They use different DNS servers, or one has an old cached answer or a hosts-file entry.

Keep learning

Related guides

Configure DHCP scopes and options

Block malware with DNS filtering

Capture traffic with Wireshark

How to Troubleshoot Network Problems With Ping, Traceroute and MTR

Find where a connection breaks or slows down in minutes. Use ping for reachability and loss, traceroute for the path, and MTR to see loss and latency on every hop at once.

How to Capture and Read Network Traffic With Wireshark and tcpdump

When logs are not enough, look at the packets. Capture traffic with tcpdump or Wireshark, filter it down to the problem, and spot retransmissions, DNS failures, DHCP issues and TLS errors.

How to Test Network Speed Between Two Points With iperf3

Internet speed tests do not tell you how fast your LAN, Wi-Fi or site-to-site link really is. iperf3 measures throughput, loss and jitter between two machines you control.

Stuck on a step?

Ask Navijin technical support or an authorised partner for help with your configuration.

Contact technical support All tutorials