DNS is the address book of the internet. When you type example.com into a browser, eight or nine systems work together to convert that name into the four numbers your computer actually needs to route a packet. Most of them are invisible — until one breaks.
The lookup, end to end
A typical lookup follows this path: your stub resolver (in the OS), your recursive resolver (your ISP, or 1.1.1.1, or a corporate caching server), the root nameservers (13 IPv4 + 13 IPv6 anycast clusters), the TLD authoritative (Verisign for .com, PIR for .org), and finally the authoritative nameservers for the domain itself (often run by the registrar or a managed-DNS provider like Cloudflare or Route 53). The recursive resolver caches the answer for the TTL specified by the authoritative; subsequent lookups skip everything above the cache layer.
When it breaks
Four common failure modes:
- Stale cache. A record was updated but the recursive resolver is serving the old answer until the TTL expires. Check propagation across multiple resolvers with our DNS Propagation Checker.
- NS records pointing nowhere. The NS records at the registrar say "use ns1.example.com" but example.com's authoritative refuses to answer queries for itself. DNS Lookup surfaces this.
- Missing SPF / DMARC. Mail bounces because receivers can't validate the sender. MX Lookup + DMARC Analyzer.
- Expired domain. The registrar lets the registration lapse. WHOIS shows the expiry date.
The fastest path to a fix
Start with the audit — paste the domain and read which section fails. Drill into the relevant standalone tool to inspect specific records.