How to check DNS records (and what each one means)

Most "the website is down" and "email isn't arriving" problems come down to one DNS record. Knowing which record to look at, and why a change hasn't shown up yet, gets you most of the way.

By NoFrillzApps · 3 min read

The records you'll actually look at

Type	Holds	Check it when…
`A`	IPv4 address of the name	a site points to the wrong server or doesn't load
`AAAA`	IPv6 address	some users (often mobile) can't reach the site
`CNAME`	an alias to another name	a subdomain should point at a hosting provider
`MX`	mail servers, with priorities	email isn't being received
`TXT`	free text: SPF, DKIM, DMARC, verification codes	email lands in spam, or a service says "domain not verified"
`NS`	the authoritative name servers	changes at your DNS provider have no effect
`SOA`	zone metadata: primary server, serial, timers	diagnosing which version of the zone is live

The DNS Lookup tool queries any of these from your browser.

Reading the answer

An answer has a name, a type, a TTL and the data. Example output (the addresses are reserved documentation addresses, not a real site):

example.com.   3600   IN   A    192.0.2.10
example.com.   3600   IN   MX   10 mail1.example.com.
example.com.   3600   IN   MX   20 mail2.example.com.

For MX records, the lower number is tried first: mail goes to mail1 and falls back to mail2. The TTL (3600 seconds here) is how long resolvers may cache the answer.

"I changed the record but nothing happened"

DNS changes don't propagate by being pushed out; old answers expire from caches. After a change, a resolver that cached the old record keeps serving it for up to the old TTL. So:

Check the NS records first. If the domain's name servers aren't the provider where you edited the record, your edit isn't live anywhere.
Compare the answer from a public resolver (like the lookup tool, which uses Cloudflare's 1.1.1.1 over HTTPS) with your own computer's answer. If they differ, your local resolver or OS is still caching.
Planning a migration? Lower the TTL (e.g. to 300 seconds) a day before, make the change, then raise it again.

Email troubleshooting with TXT and MX

No mail at all: check that MX records exist and point to names that themselves have A/AAAA records. An MX must not point to a CNAME or a bare IP address.
Mail goes to spam: check the SPF record, a TXT starting with v=spf1. A domain must have only one SPF record; two of them make SPF fail.
DKIM: a TXT at <selector>._domainkey.yourdomain; your email provider tells you the selector.
DMARC: a TXT at _dmarc.yourdomain starting with v=DMARC1.

Common CNAME mistakes

A name that has a CNAME can't have any other records. That's why you can't put a CNAME on the bare domain (example.com), which always needs NS and SOA records. Many DNS providers offer a workaround (called CNAME flattening, ALIAS or ANAME) that behaves like a CNAME at the apex. Also check for a trailing dot: in zone files, a target without one is relative to the zone, so target.host.com can silently become target.host.com.example.com.

From the command line

# dig (macOS, Linux)
dig example.com A
dig example.com MX +short
dig @1.1.1.1 example.com TXT      # ask a specific resolver

# nslookup (Windows, macOS, Linux)
nslookup -type=MX example.com

Asking a specific resolver (@1.1.1.1) is the quickest way to tell a caching problem from a configuration problem.

Common questions

How long does DNS propagation take?

Changes become visible as cached answers expire, which takes up to the record's previous TTL, often an hour and sometimes a day. Lower the TTL before planned changes.

Why can't I add a CNAME to my root domain?

A name with a CNAME can't hold any other records, and the root domain must have NS and SOA records. Many providers offer CNAME flattening, ALIAS or ANAME records as a workaround.

What does the number in an MX record mean?

It's the priority. Mail servers try the lowest number first and fall back to higher numbers if it's unavailable.

Can a domain have two SPF records?

No. A domain must publish exactly one TXT record starting with v=spf1; with two, SPF evaluation returns an error and mail may be rejected or marked as spam.

Try it: DNS Lookup — runs in your browser, nothing uploaded.