DNS Troubleshooting

@amitmund July 09, 2026

DNS Troubleshooting Cheat Sheet

Diagnose → Analyze → Resolve

DNS Troubleshooting Flow

        ┌──────────────────────┐
        │ DNS Issue Detected   │
        └──────────┬───────────┘
                   │
                   ▼
      1. Check Network Connectivity
                   │
                   ▼
      2. Verify DNS Configuration
                   │
                   ▼
      3. Test DNS Resolution
                   │
                   ▼
      4. Test External Resolution
                   │
                   ▼
      5. Check Firewall / Security
                   │
                   ▼
      6. Verify DNS Service Status
                   │
                   ▼
      7. Analyze Logs & Resolve

Step 1 — Check Network Connectivity

First verify the machine has network connectivity.

Commands

ping google.com

ping 8.8.8.8

ip addr

ip route

nmcli device status

hostname -I

Verify

Network Interface is UP
Default Gateway exists
Internet connectivity works
VPN isn't interfering

Step 2 — Check DNS Configuration

Check Resolver Configuration

cat /etc/resolv.conf

Example

nameserver 8.8.8.8
nameserver 1.1.1.1

search company.local

Check systemd-resolved

resolvectl status

systemd-resolve --status

Shows

DNS Servers
Search Domains
DNSSEC
Current Resolver

View Active DNS Servers

resolvectl dns

Step 3 — Test DNS Resolution

Using dig

dig google.com

Useful sections

QUESTION SECTION
ANSWER SECTION
TTL
Query Time
SERVER

Using nslookup

nslookup google.com

Using host

host google.com

Using drill

drill google.com

Step 4 — Test External DNS

Query specific public DNS servers.

Google DNS

dig @8.8.8.8 google.com

Cloudflare

dig @1.1.1.1 google.com

OpenDNS

dig @208.67.222.222 google.com

Step 5 — Check Firewall

Linux

iptables -L -n

iptables -L -n | grep 53

Firewalld

firewall-cmd --list-all

UFW

ufw status

DNS uses

UDP 53
TCP 53

Both should be allowed.

Step 6 — Verify DNS Service

For systemd

systemctl status systemd-resolved

Restart

sudo systemctl restart systemd-resolved

Enable

sudo systemctl enable systemd-resolved

If using BIND

systemctl status named

If using dnsmasq

systemctl status dnsmasq

Step 7 — Analyze Logs

systemd

journalctl -u systemd-resolved

BIND

journalctl -u named

dnsmasq

journalctl -u dnsmasq

General logs

journalctl -xe

Important DNS Commands

Command	Purpose
`cat /etc/resolv.conf`	View configured DNS servers
`resolvectl status`	Display resolver configuration
`resolvectl dns`	Show DNS servers
`resolvectl query google.com`	Query DNS
`dig google.com`	Advanced DNS lookup
`dig @8.8.8.8 google.com`	Query specific DNS server
`nslookup google.com`	Basic DNS lookup
`host google.com`	Simple DNS query
`ping google.com`	Verify hostname resolution
`ping 8.8.8.8`	Verify network connectivity
`systemctl status systemd-resolved`	Check resolver service
`iptables -L -n \| grep 53`	Verify DNS firewall rules

Important DNS Configuration Files

Resolver Configuration

/etc/resolv.conf

Contains

nameserver
search domain
options

NetworkManager

/etc/NetworkManager/NetworkManager.conf

systemd-resolved

/etc/systemd/resolved.conf

BIND Configuration

/etc/named.conf

/etc/bind/named.conf

dnsmasq

/etc/dnsmasq.conf

Common DNS Problems

Cannot Resolve Domain

Possible Causes

Wrong nameserver
No Internet
DNS server down
Firewall
Resolver misconfiguration

Check

cat /etc/resolv.conf

ping 8.8.8.8

dig google.com

Slow DNS

Possible Causes

Slow upstream DNS
Network latency
IPv6 issues
Timeout retries

Test

dig google.com

dig @1.1.1.1 google.com

Intermittent Resolution

Possible Causes

DNS cache corruption
Multiple DNS servers
DHCP issues

Flush cache

resolvectl flush-caches

NXDOMAIN

Meaning

Domain does not exist.

Check spelling.

Verify DNS zone.

SERVFAIL

Meaning

DNS server failed to answer.

Possible causes

Broken DNSSEC
Upstream failure
DNS recursion disabled

Timeout

Possible Causes

Firewall
UDP blocked
DNS server unreachable

DNS Cache

Flush cache

resolvectl flush-caches

Statistics

resolvectl statistics

Useful Tools

dig

Professional DNS diagnostics.

Examples

dig google.com

dig MX gmail.com

dig TXT google.com

dig ANY example.com

nslookup

Simple lookup.

nslookup google.com

host

Very lightweight lookup.

host google.com

tcpdump

Capture DNS traffic.

tcpdump port 53

Wireshark

Analyze

DNS packets
Retransmissions
Response codes
Latency

DNS Response Codes

Code	Meaning
NOERROR	Query successful
NXDOMAIN	Domain does not exist
SERVFAIL	Server failed
REFUSED	Server refused request
FORMERR	Invalid query format
NOTIMP	Operation not implemented

Quick Diagnosis Checklist

✓ Network connectivity

✓ Internet reachable

✓ Default Gateway

✓ Correct DNS Server

✓ Resolver Configuration

✓ DNS Service Running

✓ Firewall allows UDP/TCP 53

✓ DNS Cache Healthy

✓ Logs Checked

✓ External DNS Reachable

✓ Correct Domain Name

✓ Query Returns NOERROR

Best Practices

Use at least two DNS servers.
Prefer reliable providers (Cloudflare, Google, Quad9).
Enable DNSSEC where possible.
Monitor DNS latency.
Regularly flush corrupted caches.
Avoid mixing multiple DNS managers.
Secure DNS with DoT (DNS over TLS) or DoH (DNS over HTTPS) where appropriate.
Monitor resolver health using Prometheus and Grafana.

Example Quick Troubleshooting Session

# Check network
ping 8.8.8.8

# Verify resolver
cat /etc/resolv.conf

# Check DNS service
systemctl status systemd-resolved

# Query domain
dig google.com

# Query specific DNS server
dig @1.1.1.1 google.com

# Flush cache
resolvectl flush-caches

# Restart resolver
sudo systemctl restart systemd-resolved

# Capture DNS packets
sudo tcpdump port 53

Troubleshooting Decision Tree

DNS Failure
    │
    ├── Ping 8.8.8.8 Fails?
    │      │
    │      ├── Yes → Network Problem
    │      └── No
    │
    ├── dig google.com Works?
    │      │
    │      ├── Yes → Application Issue
    │      └── No
    │
    ├── dig @8.8.8.8 Works?
    │      │
    │      ├── Yes → Local Resolver Issue
    │      └── No → ISP / Firewall / External DNS Problem
    │
    └── Check Logs → Fix → Verify

Interview Questions

What is DNS, and how does name resolution work?
What is the difference between dig, host, and nslookup?
What is the purpose of /etc/resolv.conf?
How does systemd-resolved work?
What do NXDOMAIN and SERVFAIL indicate?
Why does DNS use both UDP and TCP on port 53?
How would you troubleshoot intermittent DNS failures?
What are DNSSEC, DoT, and DoH?
How do you flush the DNS cache on Linux?
How would you debug DNS traffic using tcpdump or Wireshark?

DNS Troubleshooting Cheat Sheet

DNS Troubleshooting Flow

Step 1 — Check Network Connectivity

Commands

Verify

Step 2 — Check DNS Configuration

Check Resolver Configuration

Check systemd-resolved

View Active DNS Servers

Step 3 — Test DNS Resolution

Using dig

Using nslookup

Using host

Using drill

Step 4 — Test External DNS

Step 5 — Check Firewall

Step 6 — Verify DNS Service

Step 7 — Analyze Logs

Important DNS Commands

Important DNS Configuration Files

Resolver Configuration

NetworkManager

systemd-resolved

BIND Configuration

dnsmasq

Common DNS Problems

Cannot Resolve Domain

Slow DNS

Intermittent Resolution

NXDOMAIN

SERVFAIL

Timeout

DNS Cache

Useful Tools

dig

nslookup

host

tcpdump

Wireshark

DNS Response Codes

Quick Diagnosis Checklist

Best Practices

Example Quick Troubleshooting Session

Troubleshooting Decision Tree

Interview Questions

Filters