DNS lookup

What a DNS lookup shows

Every domain publishes records that tell the internet where its website, mail and services live. A lookup asks a DNS server for one type of record and shows the answer exactly as it came back: the values, the time to live (TTL) and the response flags.

• A and AAAA: the IPv4 and IPv6 addresses of a name.
• CNAME: an alias that points one name at another.
• MX: the servers that accept mail for the domain. The lowest preference number is tried first.
• TXT: free text, used for SPF, DKIM, DMARC and ownership verification.
• NS and SOA: which nameservers are authoritative for the zone, and the zone's serial number and timers.
• CAA: which certificate authorities may issue certificates for the domain.
• DS, DNSKEY, TLSA: DNSSEC signing and DANE certificate pinning.

Resolver or authoritative: which answer to trust

A public resolver such as Cloudflare (1.1.1.1), Google (8.8.8.8), Quad9 or OpenDNS answers from its cache. If a record changed recently, the resolver keeps serving the old value until its TTL runs out, which is what people call "DNS propagation".

Choose "Authoritative nameserver" to skip every cache and ask the domain's own nameservers. That is what the zone publishes right now. If the authoritative answer is right but a resolver is still wrong, the change is made and you are only waiting for caches to expire.

Reading the result

• TTL: how many seconds a resolver may cache the answer. A resolver counts it down, so a low number means the cached copy is about to refresh.
• NXDOMAIN: the name doesn't exist at all. Check the spelling and that the record was created in the right zone.
• No answer with NOERROR: the name exists but has no record of that type, for example a domain with a website but no MX.
• AD flag: the resolver validated the answer with DNSSEC.
• SERVFAIL: the resolver couldn't get a valid answer, often because of broken DNSSEC or unreachable nameservers.

Common DNS mistakes this finds

• Two SPF records: a domain may have only one TXT record starting v=spf1. Two of them make SPF fail with a permanent error, so merge them into one.
• MX pointing at a CNAME: an MX target must be a name with its own A or AAAA records. Some mail servers refuse to deliver to an alias.
• Missing www: the root domain works but www.example.com has no record, or the other way round. Add both, then redirect one to the other.
• Lame delegation: the nameservers set at the registrar don't match the NS records inside the zone, or one of them doesn't answer. Compare the NS answer from a resolver with the authoritative one.
• A CAA record that blocks your CA: if CAA exists, only the listed authorities may issue certificates, so renewals from an unlisted CA fail.

Questions

How long does a DNS change take to show up?

Up to the TTL of the old record, which was cached before you changed it. A brand-new name that was looked up before it existed can be cached as "doesn't exist" for the negative-caching time in the zone's SOA record. Lower the TTL a day before a planned change to make the switch quick.

Why can't I put a CNAME on my root domain?

A CNAME can't sit alongside other records, and the root of a zone always has NS and SOA records. Use your DNS provider's ALIAS, ANAME or "CNAME flattening" feature, or point A and AAAA records at the service's addresses.

Why do two resolvers give different answers?

They cached the record at different times, or the domain uses geographic or load-balanced DNS that answers differently by location. Compare with the authoritative answer to see what is actually published.

How do I check DNSSEC?

Switch on "DNSSEC records" to request signatures, and look for the AD flag in a resolver's answer. A DS record in the parent zone with no matching DNSKEY is the most common cause of DNSSEC failures.