When a domain has moved to a new server or email is not working, the first question is always the same: what does DNS actually return? dig and nslookup answer in minutes, independent of the browser cache and the control panel.
This guide shows how to query A, MX, TXT and NS records, how to compare the answers of the authoritative name server and public resolvers, and what TTL means.
Which tool should you use?
| Tool | Where is it available? | When is it useful? |
|---|---|---|
| dig | Built in on macOS and Linux; installed separately on Windows | Detailed, easily filtered output. |
| nslookup | Windows, macOS and Linux | A quick check on any machine. |
| Resolve-DnsName | Windows PowerShell | Scriptable in Windows environments. |
Basic queries with dig
Replace pelda.hu with your own domain. The +short switch shows only the value.
dig +short A pelda.hu
dig +short AAAA pelda.hu
dig +short MX pelda.hu
dig +short TXT pelda.hu
dig +short NS pelda.hu
dig +short CNAME www.pelda.huQuerying with nslookup (Windows)
On Windows nslookup is available on every machine. Use the -type switch to choose the record type you want to query.
nslookup -type=A pelda.hu
nslookup -type=MX pelda.hu
nslookup -type=TXT pelda.hu
nslookup -type=NS pelda.huDo not rely on a single answer
Because of caching, different resolvers can return different answers. Query the authoritative name server and a few public resolvers too.
- Look up the domain’s name servers: dig +short NS pelda.hu
- Ask one of them directly: dig @ns1.provider.example A pelda.hu
- Ask public resolvers: dig @1.1.1.1 A pelda.hu and dig @8.8.8.8 A pelda.hu
- Compare the results and interpret any difference with the table.
| Result | What it means |
|---|---|
| The authoritative server returns the new value, public resolvers still the old one | Caches keep the old value until the TTL expires; wait. |
| The old value comes back everywhere | The change was not made on the actual name server, or was not saved. |
| NXDOMAIN | The name does not exist; a typo or missing record. |
| SERVFAIL | A server or delegation error, often a DNSSEC or name-server problem. |
| Empty answer with no error | The name exists, but there is no record of that type. |
TTL and “propagation”
TTL states in seconds how long a resolver may keep an answer. “DNS propagation” is really the gradual expiry of caches, not one global process. Before a migration it is worth lowering the TTL (for example to 300 seconds) and restoring it after the change.
Common findings
- The domain has more than one SPF record; there must be only a single merged SPF rule.
- A CNAME sits on the root domain where an A record or ALIAS-type solution is needed.
- The MX record points to a CNAME instead of a direct host name.
- The registrar and the DNS provider list different name servers; you made the change in the wrong place.
- An old AAAA (IPv6) record remained and IPv6 visitors reach the old server.
