DNS Lookup

A lookup answers one question at a time, so the skill is knowing which record to ask for and how to read the reply. This page explains each record, the command to run on your own machine, and what a failure code is telling you.

What a DNS lookup returns: record types

Each record type answers a different question. A single lookup of a busy domain can return a dozen rows, and only two or three of them usually matter for the problem in front of you.

Mail questions usually start with MX and end in TXT; website problems start with A and AAAA. The MX record lookup page covers the mail case in detail.

How to run a DNS lookup on Windows, macOS and Linux

The tools are already installed on every desktop. Windows ships nslookup; macOS and Linux ship dig and host. No download is needed for a one-off check.

1. Open Command Prompt on Windows, or Terminal on macOS and Linux.
2. Type nslookup example.com on Windows, or dig example.com on macOS and Linux, to get the default records.
3. Add the record type: nslookup -type=MX example.com, or dig -t TXT example.com.
4. To query a specific resolver, add it to the command, for example dig @1.1.1.1 example.com A.

Run the same query against the authoritative name server when you need the truth rather than a cached answer. Its name appears in the NS record, and any resolver can be asked to return it.

How to read DNS lookup output line by line

Read the answer section first. Each row carries a name, a TTL in seconds, a record type and a value, and the value is the part you compare with what you expected to publish.

• Status line — NOERROR means the query completed; NXDOMAIN and SERVFAIL do not.
• TTL — how long the answer may be cached, counted down from the value you published.
• A and AAAA rows — one row per address; several rows mean load balancing or failover.
• MX rows — read the preference number before the hostname; the lowest wins.
• CNAME rows — follow the alias until you reach an address, and expect one hop at most in normal setups.
• Authority section — the name servers that own the zone, useful when an answer looks stale.

If the answer section is empty but the status is NOERROR, the record type you asked for probably is not published. That is different from a broken zone, and it is the most common false alarm. The DNS records explained guide walks through a full zone example.

DNS propagation and TTL: why a change is not instant

Propagation is not a queue that your change joins. It is every resolver cache between your authoritative server and the visitor, each holding the old answer until its TTL expires.

Lower the TTL a day before a planned migration, then raise it again afterwards. A 300-second TTL means the old value clears in five minutes; a 86400-second TTL can keep visitors on the old server for a day.

On macOS you can clear the local cache with sudo dscacheutil -flushcache, and on Windows with ipconfig /flushdns. Flushing your own machine does nothing for anyone else's resolver, which is why a propagation check queries several public resolvers instead.

Common DNS lookup failures and what they mean

A failed lookup is a specific answer, not a vague outage. The status code tells you whether to edit the zone, wait, or call the registrar.

• NXDOMAIN — the name does not exist in the zone. Check the spelling and the host label first.
• SERVFAIL — a resolver could not complete the query, often a DNSSEC or delegation problem at the parent.
• REFUSED — the server you queried will not answer for that zone, usually because it is not authoritative for it.
• No A record — the name exists but only has other records, so the website has nothing to point at.
• Wrong name servers — the NS record names a different provider than the panel you are editing.
• CNAME at the root — a CNAME on the bare domain breaks MX and NS records that must also live there.

Two of these need the registrar rather than the hosting panel: wrong name servers and a delegation failure. The rest are zone edits inside the DNS panel.

Who needs a DNS lookup

Anyone whose site, mail or certificate stopped working without a code change can settle the question with one lookup. The record shows whether the service is looking at the right place, before anyone touches a configuration file.

• Site owners checking that a migration actually landed.
• Developers verifying records at a client handover.
• Teams whose verification TXT or SSL issuance keeps failing.

Why WebJi® for DNS questions

• Domain registration and hosting under one roof since 2005, with 12,000+ clients across India and overseas.
• DNS records explained in plain language, not only changed on request.
• 24/7 email support in Hindi and English, average first reply under 60 minutes.
• INR billing with a GST invoice when a fix turns into paid work.

If a lookup shows the record is right but the site still fails, send the domain and the output to support@webji.services through the contact page and we will read it with you.