Diagnose DNS problems on Windows and Linux

Separate DNS, network and HTTPS faults using nslookup, Resolve-DnsName, dig, resolvectl and targeted checks.

Network before names

Inspect IP address, gateway and default route. Test the actual gateway and an external IP, remembering ICMP may be blocked. A working IP but failing name suggests resolution, not conclusive proof. Record exact hostname, A/AAAA type, time, network and error. A maps IPv4, AAAA IPv6, MX mail, NS delegation, CNAME alias, TXT text and PTR reverse names.

Windows resolvers

ipconfig /all identifies the active adapter, DNS servers and suffixes; VPN and Active Directory often use internal DNS or split routing. nslookup directly asks a DNS server but bypasses local cache, hosts and some client rules, so it may differ from the application. Resolve-DnsName provides targeted controls; -DnsOnly -NoHostsFile deliberately excludes hosts. Do not blindly swap corporate DNS for public resolvers.

ipconfig /all
nslookup www.example.com
nslookup -type=AAAA www.example.com
nslookup www.example.com 1.1.1.1
Resolve-DnsName www.example.com -Type A
Resolve-DnsName www.example.com -Server 1.1.1.1 -DnsOnly -NoHostsFile

Cache and hosts

Inspect ipconfig /displaydns or Get-DnsClientCache. Flushing with ipconfig /flushdns or Clear-DnsClientCache clears only this PC, not authoritative records or intermediate caches. Inspect C:\Windows\System32\drivers\etc\hosts and VPN rules without deleting intentional entries. Repeat and record server and result.

ipconfig /displaydns
ipconfig /flushdns
Get-DnsClientCache
Clear-DnsClientCache

Linux resolver

On systems using systemd-resolved, resolvectl status lists per-link servers and route-only domains; resolvectl query checks client resolution. Inspect /etc/resolv.conf, which may be managed by systemd-resolved, NetworkManager or DHCP. Change the configuration source instead of an auto-generated file.

ip address
ip route
resolvectl status
resolvectl query www.example.com
ls -l /etc/resolv.conf

Compare dig results

dig displays DNS status, ANSWER, TTL and server. Like nslookup, a direct DNS query may not match the application’s resolution path. Compare default and explicit resolvers, but do not use public DNS to judge a private zone. NOERROR with no answer can mean this record type is absent. +trace walks delegation but may be affected by blocked direct queries.

sudo apt update
sudo apt install dnsutils
dig www.example.com A
dig www.example.com AAAA
dig @1.1.1.1 www.example.com A
dig example.com NS
dig example.com SOA
dig +trace www.example.com

Errors and authoritative servers

NXDOMAIN means the queried view has no such name; SERVFAIL indicates resolution failure, possibly DNSSEC or authoritative issues; REFUSED is a refusal; timeout means no timely answer. Find the actual NS servers and query each with its real name, comparing A/AAAA and SOA serial. ns1.provider.example and ns2.provider.example are placeholders, not usable public servers.

dig example.com NS
dig @ns1.provider.example example.com SOA
dig @ns1.provider.example www.example.com A
dig @ns2.provider.example www.example.com A

TTL and negative cache

After a change, resolvers can legitimately return the old value until the previous TTL expires. NXDOMAIN can be cached too. Before saying propagation, query authoritative servers, compare resolvers and note TTL and time. A local flush cannot empty upstream caches.

Port 53 and the application

DNS normally uses UDP 53 and sometimes TCP 53. Test-NetConnection -Port 53 tests TCP, not UDP. Compare default dig and +tcp; a successful TCP connection alone does not prove application DNS works. Once A/AAAA are right, test port 443 and HTTPS: routing, firewall, service and TLS errors are distinct.

# PowerShell: tests TCP, not UDP
Test-NetConnection 1.1.1.1 -Port 53
Test-NetConnection www.example.com -Port 443
# Linux: compare default DNS transport and TCP
dig @1.1.1.1 example.com A
dig +tcp @1.1.1.1 example.com A
curl -I https://www.example.com

DNSSEC and summary

If only validating resolvers return SERVFAIL, inspect the DNSSEC chain with delv and check the system clock. Collect repeatable evidence before changing DNS or flushing caches; distinguish the client resolver, direct query, authoritative servers and final service.

delv example.com A
timedatectl status

Sources

Microsoft Resolve-DnsName: https://learn.microsoft.com/en-us/powershell/module/dnsclient/resolve-dnsname ; DNS troubleshooting: https://learn.microsoft.com/en-us/troubleshoot/azure/dns/troubleshoot-dns ; BIND DNSSEC: https://bind9.readthedocs.io/en/stable/dnssec-guide.html .