DNS: troubleshooting

In this guide: DNS: troubleshooting. resolvectl/dig.

Debug networking issues layer by layer: DNS, routing, firewall, then the application. First confirm the server is reachable, then move to service-level checks.

If something goes wrong: check the service is running, listening on the expected port, and that your firewall allows the connection. For web services, `nginx -t` and `journalctl -u nginx` are good starting points. If DNS breaks after reboot, check who manages it (`systemd-resolved`, NetworkManager) and what’s in `/etc/resolv.conf`.

After completing the steps below, verify the result: service status, logs, and network reachability. This saves hours when an issue shows up later.

Below you’ll find a quick checklist, verification commands, and common pitfalls. This helps you not only “do it”, but also confirm what a correct outcome looks like.

Quick checklist

• Split the problem: DNS → routing → firewall → application.
• First verify server reachability (ping/ssh), then services.
• Save command outputs so you can compare before/after.
• Make one small change at a time and verify the result immediately.
• Keep notes of what you changed (file/command/time).

Verify the result

# Verify / sanity checks
ip r
ping -c 1 1.1.1.1 || true
resolvectl status 2>/dev/null | head -n 50 || true
getent hosts example.com || true

Common pitfalls

• Debugging from the app layer instead of DNS/routing first.
• Ignoring IPv6 (ports may be open on IPv6).

getent hosts google.com
resolvectl status 2>/dev/null || cat /etc/resolv.conf

dig +short A google.com @1.1.1.1