DNS and Domain Tools
Free diagnostic tools and related guides for checking DNS and Domain issues in one place.
What should I check first for DNS and Domain issues?
For DNS and Domain issues, start with DNS Health Check to capture the current state, then use DNS Propagation Checker to narrow the cause. If the result is unclear, read the related guide and open the next tool before changing settings.
Recommended Check Order
Open the tools in this order to narrow the issue before you change DNS, email, security, privacy, or network settings.
Check the current state: DNS Health Check
Audit A/AAAA, NS, MX, SPF, DMARC, and CAA records with a simple score to spot DNS and mail configuration gaps quickly.
Narrow the cause: DNS Propagation Checker
Compare DNS answers across public resolvers to see whether A, AAAA, MX, TXT, and other records have propagated consistently.
Cross-check the result: DNS Records Lookup
Lookup A, AAAA, CNAME, MX, NS, TXT, CAA, and SOA records in one DNS snapshot for a domain.
Common Symptoms
Common problem patterns grouped by tool. If a symptom matches, start with that check.
The website loads, but DNS health score is low.
A/AAAA can work while MX, SPF, DMARC, CAA, NS, or DNSSEC settings are missing.
Open DNSSEC, MX, and DMARC checks to prioritize operational risk.
The result does not match expectations.
Confirm that the input, network, browser conditions, and cache state match the previous test.
Cross-check the same target with related tools and retest after changing one condition at a time.
The result does not match expectations.
Confirm that the input, network, browser conditions, and cache state match the previous test.
Cross-check the same target with related tools and retest after changing one condition at a time.
The domain fails only on some networks.
Validating resolvers may reject stale DS records or DNSKEY mismatches even when non-validating resolvers still answer.
Compare DNSSEC and DNS health results, then align registrar DS records with the current DNSKEY set.
The same target behaves differently on another network.
ISP, DNS cache, CDN routing, VPN, firewall, and NAT paths can change lookup and latency results.
Compare current IP, ASN, and trace results to locate where the path changes.
Inbound mail is missing or intermittent.
Compare MX hosts, priorities, A/AAAA reachability, and the mail provider recommended values.
Run MX lookup, then DNS health and deliverability checks to separate inbound routing from sender-auth issues.
Which tool should I open first?
Use this matrix to match the symptom to the right tool, the signal to check, and the next action.
DNS Health Check
Audit A/AAAA, NS, MX, SPF, DMARC, and CAA records with a simple score to spot DNS and mail configuration gaps quickly.
Use the DNS Health Check result to narrow DNS and Domain issues.
After reviewing the result, cross-check it with a related tool or guide.
DNS Propagation Checker
Compare DNS answers across public resolvers to see whether A, AAAA, MX, TXT, and other records have propagated consistently.
Use the DNS Propagation Checker result to narrow DNS and Domain issues.
After reviewing the result, cross-check it with a related tool or guide.
DNS Records Lookup
Lookup A, AAAA, CNAME, MX, NS, TXT, CAA, and SOA records in one DNS snapshot for a domain.
Use the DNS Records Lookup result to narrow DNS and Domain issues.
After reviewing the result, cross-check it with a related tool or guide.
DNSSEC Checker
Check whether a domain publishes DNSKEY and DS records, whether the chain of trust looks complete, and whether a resolver reports DNSSEC validation.
Use the DNSSEC Checker result to narrow DNS and Domain issues.
After reviewing the result, cross-check it with a related tool or guide.
WHOIS / DNS Lookup
Look up WHOIS ownership data and core DNS records.
Use the WHOIS / DNS Lookup result to narrow DNS and Domain issues.
After reviewing the result, cross-check it with a related tool or guide.
MX Record Lookup (Mail Routing)
Inspect MX priorities, target mail exchangers, and TTL to troubleshoot inbound mail routing.
Use the MX Record Lookup (Mail Routing) result to narrow DNS and Domain issues.
After reviewing the result, cross-check it with a related tool or guide.
How To Choose The Right Tool
ERR_NAME_NOT_RESOLVED: Causes and Fixes
ERR_NAME_NOT_RESOLVED appears when the browser cannot resolve the hostname to an IP address. Misspelled domains, missing DNS records, nameserver propagation, corporate DNS, VPN DNS, and browser cache can all create the same visitor-facing error.
DNSSEC Checker
Check whether a domain publishes DNSKEY and DS records, whether the chain of trust looks complete, and whether a resolver reports DNSSEC validation.
Frequently Asked Questions
DNS and Domain: what should I check first?
For DNS and Domain issues, start with DNS Health Check to capture the current state, then use DNS Propagation Checker to narrow the cause. If the result is unclear, read the related guide and open the next tool before changing settings.
Which tools should I run first?
Run DNS Health Check, DNS Propagation Checker, DNS Records Lookup in that order to separate current state, likely cause, and cross-check signals.
What should I read if the result is unclear?
If the result is unclear, open ERR_NAME_NOT_RESOLVED: Causes and Fixes and review the same problem as a checklist.
Tools To Run
DNS Health Check
Audit A/AAAA, NS, MX, SPF, DMARC, and CAA records with a simple score to spot DNS and mail configuration gaps quickly.
DNS Propagation Checker
Compare DNS answers across public resolvers to see whether A, AAAA, MX, TXT, and other records have propagated consistently.
DNS Records Lookup
Lookup A, AAAA, CNAME, MX, NS, TXT, CAA, and SOA records in one DNS snapshot for a domain.
DNSSEC Checker
Check whether a domain publishes DNSKEY and DS records, whether the chain of trust looks complete, and whether a resolver reports DNSSEC validation.
WHOIS / DNS Lookup
Look up WHOIS ownership data and core DNS records.
MX Record Lookup (Mail Routing)
Inspect MX priorities, target mail exchangers, and TTL to troubleshoot inbound mail routing.
SPF Record Checker (Sender Policy Framework)
Parse SPF TXT policy to verify authorized senders, include chains, and fail/softfail behavior.
DMARC Policy Checker (Domain Protection)
Analyze DMARC tags (p, rua, ruf, adkim, aspf) to validate anti-spoofing enforcement.
DKIM Record Checker (Email Signature)
Query DKIM selector records (TXT/CNAME) to troubleshoot email signature verification issues.
Reverse DNS Lookup
Resolve reverse DNS PTR records for an IP address.
Guides To Read
ERR_NAME_NOT_RESOLVED: Causes and Fixes
ERR_NAME_NOT_RESOLVED appears when the browser cannot resolve the hostname to an IP address. Misspelled domains, missing DNS records, nameserver propagation, corporate DNS, VPN DNS, and browser cache can all create the same visitor-facing error.
Server IP Address Could Not Be Found: Causes and Fixes
“Server IP address could not be found” means the browser could not translate the hostname into an IP address. Typos, missing www records, deleted DNS records, nameserver propagation, expired domains, and local DNS cache can all cause it.
Cloudflare 1016 Origin DNS Error: Causes and Fixes
Cloudflare 1016 appears when Cloudflare cannot resolve the hostname configured as the origin. Missing A or AAAA records, deleted CNAME targets, wrong origin names, private DNS names, DNSSEC issues, and nameserver delegation should be checked first.
DNS_PROBE_FINISHED_NXDOMAIN: Causes and Fixes
DNS_PROBE_FINISHED_NXDOMAIN means the browser could not find an IP address for the hostname. Typos, expired domains, nameserver changes, missing DNS records, propagation delay, and local DNS cache can all cause the same browser error.
DNS_PROBE_FINISHED_BAD_CONFIG: Causes and Fixes
DNS_PROBE_FINISHED_BAD_CONFIG appears when the DNS configuration used by the browser is broken or unstable. Router DNS, operating-system DNS, browser Secure DNS, VPN DNS, corporate DNS, and DNS cache should be separated before changing site records.
DNS Server Not Responding: Causes and Fixes
“DNS server not responding” means the browser or operating system could not get a usable response from the resolver that turns names into IP addresses. Router DNS, ISP resolver outages, VPN DNS, Secure DNS, and broken domain records should be separated.
DNS_PROBE_FINISHED_NO_INTERNET: Causes and Fixes
DNS_PROBE_FINISHED_NO_INTERNET appears when the browser cannot use DNS or an internet route reliably. Real internet disconnection, DNS resolver failure, VPN kill switches, proxies, router problems, and ISP outages should be separated.
DNS over HTTPS Looks Like a VPN DNS Leak
DNS over HTTPS lets a browser or operating system send DNS queries through HTTPS. If a browser DoH resolver is active while a VPN expects to use its own DNS path, DNS leak test results can look different from the VPN exit IP.
DDNS Not Updating to the Current Public IP
Dynamic DNS maps a changing public IP to a hostname, but it can point to a stale address when the client reports the wrong IP, DNS TTL keeps old records visible, or the router WAN IP differs from the real public IP.
DNS TTL, Cache, and Propagation Delays
DNS changes do not appear everywhere at once because TTL, recursive resolver cache, authoritative nameserver updates, browser cache, operating system cache, and CDN cache can overlap. Compare several resolvers before deciding a change failed.
DNS Basics and Record Types
DNS is the directory that connects a domain name to the right service endpoint. Once you understand what A, AAAA, CNAME, MX, and TXT records do, WHOIS, DNS health, and mail-routing results become much easier to interpret.
DNS Propagation and TTL
DNS changes do not appear everywhere at once because authoritative answers, recursive caches, and TTL expiry all update on different schedules.
DNSSEC and the Chain of Trust
DNSSEC helps prove that DNS answers were not modified in transit. A domain can publish DNSKEY records and still fail validation if the matching DS record is missing at the parent zone or registrar layer.
DNS Migration and Nameserver Change Checklist
When moving DNS providers or nameservers, A/AAAA, MX, SPF, DKIM, DMARC, CAA, and DNSSEC must move together. A website may still load while mail, certificate issuance, or crawler signals break.
FAQ
DNS and Domain: what should I check first?
Which tools should I run first?
What should I read if the result is unclear?
Data Handling & Privacy
ipnawa is a diagnostics service. Inputs are used to produce results and are not intended for account-based profiling.
- Server-side tools (WHOIS, SSL, DNS, header checks) send your input domain/IP to our server for lookup.
- Browser-side tools (fingerprint, cookies, JavaScript) run primarily in your browser when supported.
- Standard web/server security logs may include IP address, timestamp, and User-Agent.
- Some checks call external providers such as ipinfo.io and bigdatacloud.net.
- Ads and non-essential cookies are loaded only after your consent choice.
External Processors
- ipinfo.io (IP/ASN/location lookups)
- bigdatacloud.net (reverse geocoding)
- Advertising partners (only after ad-consent acceptance)
You can review or change cookie/ad consent at any time.