Live Authoritative DNS Checker
Query live DNS records directly from global root resolvers via encrypted DoH APIs. Bypass stale local ISP caches to verify propagation, MX email routing, and SPF/DKIM TXT records.
Troubleshooting Common DNS Failure Modes
If your domain returns NXDOMAIN (RCODE 3), review our comprehensive engineering guide on How to Fix DNS_PROBE_FINISHED_NXDOMAIN to diagnose missing zone files, registrar nameserver mismatches, and DNSSEC validation locks.
Step-by-Step Production Guide: Authoritative DNS Management & Troubleshooting
The Domain Name System (DNS) translates human-friendly hostnames into machine-routable IP addresses. A single DNS syntax error or propagation oversight can instantly take critical websites and corporate email offline. Follow this 5-step engineering runbook to configure, troubleshoot, and audit your domain's DNS architecture.
1 Trace the Recursive DNS Resolution Hierarchy
When a browser requests a domain, the lookup follows a 4-tier hierarchical chain:
- Local Stub Resolver: Checks the local operating system DNS cache and hosts file.
- Recursive Resolver: Your ISP or public DNS (e.g. 8.8.8.8, 1.1.1.1) queries root servers on your behalf.
- Root Nameservers: 13 global root server clusters direct the resolver to the appropriate Top-Level Domain (TLD) nameserver (e.g.
.com,.net,.org). - Authoritative Nameservers: The final authority hosting your domain's zone file (e.g. Cloudflare, AWS Route 53, or self-hosted BIND/PowerDNS), which returns the actual IP address or TXT record.
This tool queries recursive DoH resolvers directly from your client browser, bypassing ISP DNS tampering, transparent proxies, and stale local caches.
2 Configure the Core DNS Record Types Correctly
Every production web application requires precise record types configured with strict adherence to RFC specifications:
- A & AAAA Records: Direct IP mappings. Always configure both IPv4 (
A) and IPv6 (AAAA) for optimal global routing and search engine crawling. - CNAME Records (Canonical Name): Aliases pointing one hostname to another. Remember: under RFC 1912 Section 2.4, a CNAME cannot coexist with other record types at the zone apex (
@or naked domain). Modern DNS providers provide "CNAME flattening" or "ANAME" records to synthesize A records at the root. - MX Records: Point to inbound email servers. Always assign an explicit numerical priority (e.g., 10 for primary, 20 for backup).
- CAA Records (Certification Authority Authorization): Restrict which Certificate Authorities (e.g., Let's Encrypt, DigiCert) are allowed to issue SSL certificates for your domain, preventing fraudulent certificate issuance.
3 Deploy Email Security with SPF, DKIM, and DMARC TXT Records
To guarantee 100% email inbox delivery and block phishing spoofers from impersonating your brand, you must configure the email authentication triad as DNS TXT records:
- SPF (Sender Policy Framework): Defines authorized sending IPs. E.g.:
v=spf1 include:_spf.google.com ~all. Never create more than one SPF record per domain, or email validation will fail. - DKIM (DomainKeys Identified Mail): Stores your public cryptographic key under a subdomain selector (e.g.
google._domainkey.example.com) to cryptographically verify email message integrity. - DMARC: Directs receiving mail servers how to treat messages that fail SPF/DKIM verification. E.g.:
v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com. Major providers (Gmail, Yahoo, Microsoft) now reject emails from domains lacking valid DMARC policies.
4 Execute Zero-Downtime Server Migrations with TTL Pre-Reduction
The Time-To-Live (TTL) specifies how many seconds resolvers cache a record. The classic mistake during server migrations is changing the IP while the TTL is still set to 86400 (24 hours). This causes half of your visitors to hit the old server while others hit the new server, resulting in split-brain data desynchronization.
# 48 Hours Before Migration: Lower TTL to 300 seconds (5 minutes)
# Migration Day: Update A record to the new server IP
# 48 Hours After Migration: Restore TTL to 86400 seconds (24 hours) By lowering the TTL 48 hours prior, all upstream resolvers expire their caches within 5 minutes on cutover day, completing global migration in minutes with zero downtime.
5 Diagnostic Terminal Commands and DNS Cache Flushing
When troubleshooting DNS resolution on your workstation or server, use native terminal diagnostic utilities:
# Trace complete resolution chain from root servers:
dig example.com +trace
# Query authoritative nameserver directly:
dig @ns1.cloudflare.com example.com A
# Flush local workstation DNS cache:
# Windows: ipconfig /flushdns
# macOS: sudo killall -HUP mDNSResponder
# Linux: sudo resolvectl flush-caches If your local machine still shows old records after a change, flushing your OS resolver cache forces your machine to fetch fresh records.
DNS Record Types & Diagnostic Reference Matrix
The table below summarizes standard DNS resource records (RFC 1035), standard TTL recommendations, and frequent misconfigurations to avoid:
| Record Type | RFC Standard | Recommended TTL | Primary Function | Common Pitfall / Risk |
|---|---|---|---|---|
| A | RFC 1035 | 3600 – 86400s | Maps hostname to 32-bit IPv4 address | High TTL during emergency server migrations causes downtime. |
| AAAA | RFC 3596 | 3600 – 86400s | Maps hostname to 128-bit IPv6 address | Configuring broken IPv6 routes breaks connectivity for mobile users. |
| CNAME | RFC 1035 | 3600s | Aliases hostname to another domain name | Attempting to place CNAME on root zone apex (@) without flattening. |
| MX | RFC 1035 | 14400s | Routes incoming emails with priority weights | Pointing MX records directly to IP addresses instead of hostnames. |
| TXT | RFC 1464 | 3600s | Holds SPF, DKIM, DMARC, and domain verification strings | Creating multiple SPF TXT records breaks email deliverability. |
| NS | RFC 1035 | 86400s | Delegates DNS zone to authoritative nameservers | Mismatch between registrar nameservers and zone file NS records. |
| SOA | RFC 1035 | 86400s | Defines primary NS, admin contact, and zone serial number | Failing to increment the SOA serial number prevents secondary sync. |
| CAA | RFC 6844 | 86400s | Specifies authorized Certificate Authorities for SSL | Omitting Let's Encrypt in CAA blocks automated Certbot renewals. |
Frequently Asked Questions (FAQs)
How does this DNS checker perform real-time lookups without a backend? ▼
This tool uses modern DNS-over-HTTPS (DoH) REST APIs provided by Google Public DNS (dns.google) and Cloudflare (cloudflare-dns.com). Requests are executed directly from your browser over encrypted HTTPS, bypassing local ISP DNS caching to query live authoritative records.
What does an NXDOMAIN DNS status code mean? ▼
NXDOMAIN (Non-Existent Domain, DNS RCODE 3) means the authoritative nameservers for the domain confirmed that the requested domain name or subdomain does not exist, or its DNS zone file lacks an active record.
Why do changes to DNS records take time to propagate globally? ▼
DNS records are cached by recursive resolvers and ISPs worldwide according to their Time-To-Live (TTL) value. Until the TTL expires (e.g. 3600 seconds), downstream resolvers serve the cached old record instead of querying your authoritative nameservers.
What is the difference between an A record and a CNAME record? ▼
An A record maps a hostname directly to a physical 32-bit IPv4 address (e.g. 192.0.2.1). A CNAME (Canonical Name) record creates an alias pointing one hostname to another domain name (e.g. www pointing to example.com). Under RFC 1912, CNAME records cannot coexist with other records at the zone apex (@) unless using CNAME flattening.
How do SPF, DKIM, and DMARC TXT records stop email spoofing? ▼
SPF specifies which server IP addresses are permitted to send mail for your domain. DKIM provides a cryptographic signature verifying the email content was not altered in transit. DMARC instructs receiving mail servers how to treat messages that fail SPF/DKIM (e.g. reject or quarantine).
Migrating DNS Clusters or Web Hosts?
We engineer zero-downtime server and DNS cluster migrations with pre-propagation TTL reduction and live validation.