DNS troubleshooting with dig and nslookup
For network and systems administrators and MSP technicians who already know the common record types and how a client resolves a name (see Running DNS servers and DNS from the client side), and now need to find out where a DNS answer goes wrong. You'll choose between dig and nslookup and between asking a resolver or an authoritative server, read response codes, flags and TTLs, tell NXDOMAIN, NODATA, SERVFAIL, REFUSED and timeouts apart, calculate negative caching from the SOA, trace a delegation to find where it breaks, and compare SOA serials to find a stale secondary. Grounded in RFC 1034, 1035 and 2308, the BIND 9 dig manual and Microsoft's DNS troubleshooting articles. Query only servers you run or have permission to test. Ends with a supervisor-graded log investigation.
- Level
- Intermediate
- Length
- About 95 minutes
- Contents
- 5 lessons · final exam
- Status
- Published · updated 10 Oct 2026
Skills you'll practise
- Choose the query tool (dig or nslookup) and the server to ask (the client's resolver or an authoritative server) for a DNS question
- Interpret dig and nslookup output: the response code, the aa, rd, ra and tc flags, TTLs and the answer and authority sections
- Distinguish NXDOMAIN, NODATA, SERVFAIL, REFUSED and timeouts, and calculate how long a negative answer may be cached
- Trace a delegation with dig +trace or non-recursive nslookup queries and identify where it is broken
- Compare SOA serial numbers and timers across a zone's name servers to find a stale secondary or a zone transfer problem
Course outline
- 1.Choose the query tool and the server to askLesson · 14 min
- 2.Interpret dig and nslookup output: status, flags, TTLs and sectionsLesson · 16 min
- 3.Distinguish NXDOMAIN, NODATA, SERVFAIL, REFUSED and timeoutsLesson · 16 min
- 4.Trace a delegation and find where it breaksLesson · 16 min
- 5.Compare SOA serials to find a stale secondary or a transfer problemLesson · 14 min
- 6.DNS troubleshooting with dig and nslookup: knowledge checkKnowledge check · 15 questions
- 7.DNS troubleshooting with dig and nslookup: practical exerciseKnowledge check · 1 question
- 8.Final exam10 questions · passing it completes the course, so people who already know the material can test out
Sources it draws on
The lessons and questions are written from these references, so learners can go back to the original.
- RFC 1034: Domain Names, Concepts and Facilities (delegation, glue, referrals, SOA serial and secondary refresh)
- RFC 1035: Domain Names, Implementation and Specification (header flags AA, TC, RD, RA; RCODEs; SOA fields)
- RFC 2308: Negative Caching of DNS Queries (NXDOMAIN and NODATA, negative TTL from the SOA)
- BIND 9 manual pages (stable, 9.20): dig, query options and return codes
- Microsoft Learn: nslookup command (modes, options, error messages)
- Microsoft Learn: Troubleshoot DNS clients (nslookup tests, suffixes, cached negative answers)
- Microsoft Learn: Troubleshoot DNS servers (server failure and timeouts, authoritative data, recursion, broken delegation test, zone transfers)
- Microsoft Learn: DNS troubleshooting guidance (checklist, forwarder delays, client-side caching support policy)
See it with your own jobs and topics
Tell us about your team and we'll walk you through setup, from choosing jobs to your first skills check.