A systematic approach to diagnosing DNS problems. Whether records are missing, propagation is stuck, or mail authentication is failing, this guide walks through each diagnostic step with tools to verify at each stage.
Open the DNS Lookup tool, enter the domain, and check for A and AAAA records. If no records are returned, the domain may not have DNS configured, or the nameservers may be wrong. An NXDOMAIN response means the domain does not exist in DNS at all. A NOERROR response with zero records means the domain exists but has no records of that type.
Check NS records in the DNS tool. Then use Domain Health to verify the nameservers match what the registrar has configured. Mismatched NS records between the registrar and the zone file is one of the most common causes of "domain not resolving." This happens when you change DNS providers but forget to update the registrar, or vice versa.
Use the DNS tool's multi-resolver view to compare results from Cloudflare (1.1.1.1), Google (8.8.8.8), and Quad9 (9.9.9.9). If results differ between resolvers, propagation is still in progress. Check the TTL value on the old record to estimate when caches will expire. A TTL of 3600 means resolvers may serve stale data for up to one hour after you make a change.
Check SPF, DKIM, and DMARC records using the DNS tool's mail authentication tab. Common issues include: SPF record missing an include: directive for a mail provider, DKIM selector not published as a DNS record, and DMARC policy left at p=none indefinitely. Each of these will show as a warning in the tool output.
Use the Probe tool to verify the domain's web server is actually responding. A domain can resolve correctly in DNS but still have web server issues. Common causes: the A record points to the wrong IP, a firewall is blocking port 443, the TLS certificate does not match the domain, or the server is returning 5xx errors.
If the domain uses DNSSEC, use Domain Health to verify the chain of trust is intact. Expired DNSSEC signatures or missing DS records at the registrar can cause resolution failures that look like "domain doesn't exist" (SERVFAIL). This is especially tricky because DNSSEC failures only affect validating resolvers, so the domain may work on some networks but not others.