A practical DNS troubleshooting checklist

Capture the actual name

Record the full hostname, failing client, network, and error. Compare the apex domain with www rather than assuming they resolve identically. The examples use example.com; substitute the affected hostname. dig is commonly provided by dnsutils or bind-utils.

dig example.com A
dig example.com AAAA
dig example.com CNAME

Compare recursive and authoritative answers

Inspect the returned TTL and resolver address. Find the authoritative nameservers, then query one directly. A recursive resolver can legitimately return an older answer until its cached TTL expires.

dig example.com NS
# Replace ns1.example.net with an actual authoritative nameserver
dig @ns1.example.net example.com A +norecurse

Check the path beyond DNS

A correct DNS answer does not establish that HTTPS works. Check the HTTP response and certificate using the hostname so that TLS SNI and virtual hosting are exercised. HEAD may behave differently from GET on some applications.

curl -I --connect-timeout 10 https://example.com/

Change one layer at a time

Save the existing records before editing them. Do not delete MX or verification records while changing web hosting. Recheck authoritative answers after a DNS edit, then allow recursive caches to expire. Purging an HTTP cache does not clear a DNS resolver cache.