DNS problems: what to check first when something breaks

Most "DNS problems" are one of a handful of things: a record pointing at the wrong place, a change that is still propagating, nameservers pointing at a host you no longer use, or a registrar and host that disagree about who controls the domain. The good news is that you can check every one of them for free in a few minutes, using a public lookup tool and your registrar or host control panel - no support ticket, no waiting on hold. This page walks the usual culprits in the order they actually happen, so you can find which one you have before you change anything.

The usual DNS problems

DNS is just a lookup table: it turns your domain name into the addresses that browsers and mail servers connect to. When "DNS" breaks, it is almost always one of these five.

The site won't load - wrong or missing A record. The A record (and its modern IPv6 sibling, the AAAA record) is the line that says "this domain lives at this server address". If your site shows a blank page, a parked-domain holding page, or a different site entirely, the A record on your apex - the bare yourbusiness.com.au with no www - is usually pointing at the wrong address or has gone missing. The apex is the fussy one because of how DNS handles the root of a domain; if you are unsure what makes it different, here is what an apex record is.

Email stopped - MX or TXT records. Email routing is separate from web routing. Your MX records say which server receives mail for the domain; your SPF, DKIM and DMARC records (all stored as TXT records) tell other servers your mail is genuine. If outbound email suddenly bounces or inbound mail vanishes, an MX record has changed or a TXT record was edited or deleted - often during an unrelated "tidy-up" of the DNS zone. Web and email can break independently, which is why a working website does not prove email is fine.

A change "isn't working yet" - propagation. You edited a record correctly, saved it, and nothing changed. This is the most common false alarm. DNS answers are cached for a set time - the TTL (time to live) - so the old value can linger for minutes to hours after you change it. Lowering the TTL before a planned change shrinks this window; after the fact, there is nothing to do but wait it out and check from a tool rather than your own (cached) browser.

Nameservers pointing at the wrong host. This is the one that masquerades as everything else. Your nameservers decide which system holds your DNS records in the first place. If your nameservers still point at an old web host you have left, you are editing records on a server nobody is reading - every change you make is correct and completely ignored. The records you carefully set at your registrar do nothing because the registrar is not where the live records are. If "nameserver" is a fuzzy term, this is what a nameserver is.

The domain expired. The unglamorous one. A lapsed renewal pulls the domain out of the live zone entirely - the site dies, email dies, and no amount of record-checking helps because there are no records being served. This is why which Australian domain registrar to use and how it handles renewals matters more than the few dollars of price difference: the bad day is the expiry you did not see coming.

The median Australian small-business domain scores grade E on Red Bridge Cyber's DNS category^* - so if your DNS feels fragile, you are squarely in the normal range, not uniquely cursed.

How to check each one, free

You need exactly two things: a public DNS lookup tool to see what the rest of the internet sees, and your registrar or host control panel to see what you have set. The gap between those two answers is the whole diagnosis.

Step 1 - look up what the world sees. Run your domain through a public lookup such as MXToolbox or Google's Dig tool. These query DNS directly, bypassing your browser's cache, so they show the live answer rather than the stale one your own machine is holding. Check, in order:

• NS (nameserver) records - do they name the host you actually use today? If they point at an old provider, you have found the problem and step 2 changes.
• A / AAAA records - does the address match your current web host? Compare it to the address your host's documentation gives you.
• MX records - do they name your real mail provider (Microsoft 365, Google Workspace, or your host)?
• TXT records - is there one SPF record (it starts v=spf1), and your DMARC record at _dmarc.yourbusiness.com.au?

Step 2 - open the right control panel. Here is the trap: there are two panels, and you must edit the one your NS records actually point at. If your nameservers point at your registrar, you edit DNS in the registrar's panel. If they point at your web host (or Cloudflare, or a third party), the registrar's DNS panel is a decoy - you edit records at that host instead. Match the panel to the NS record from step 1, and nine times out of ten the fix becomes obvious: the live value is wrong, or it is missing, or you have been editing the wrong panel the whole time.

For expiry, you do not need a lookup tool - your registrar's dashboard shows the expiry date and renewal status on the front page. If it says expired or pending delete, that is your answer.

Common variations

You just migrated web host. Expect A/AAAA records to need updating to the new host's address, and watch the propagation window - sites in mid-migration often work for some visitors and not others for an hour or two as caches expire. Confirm the new address from a lookup tool, not from whether the site loads on your own machine.

You just changed registrar. A registrar transfer does not move your DNS records by default - it moves who you pay. If your records were managed at the old registrar, they may not have followed the domain. Check the NS records first: a transfer that reset your nameservers to the new registrar's defaults will have orphaned your real records. Picking the best Australian domain registrar is partly about which one makes this transition least painful.

It works sometimes, fails sometimes. Intermittent failures usually mean two records disagree - two A records with different addresses, or two MX records where one points at a dead server. DNS will hand out either answer, so the site or email works only when the lookup happens to return the good one. Look for duplicate or conflicting records and delete the wrong one.

The fixes that actually work

• Wrong A record - set the apex A/AAAA to your current host's exact address, in the panel your NS records point at. Delete any stray duplicate A records.
• Broken email - restore the correct MX records and re-check SPF/DMARC. If you have just changed mail providers, use their published setup values verbatim rather than guessing.
• Propagation - wait, and verify from a public lookup tool rather than your browser. If you control the change ahead of time, drop the TTL a day before so the new value takes hold faster.
• Wrong nameservers - repoint the NS records at the host that actually holds your live DNS, or move the records to where the NS records already point. Pick one home for your DNS and keep it consistent.
• Expiry - renew immediately; most names sit in a grace period before deletion. Then turn on auto-renew and put a calendar reminder a month before the date.

While you are in the zone, two settings are worth adding because almost no one has them: DNSSEC, which cryptographically signs your DNS answers so they cannot be quietly tampered with, and a CAA record, which limits which authorities may issue certificates for your domain - here is what a CAA record is. Both are free and explain a lot about why most Australian SMBs have no DNSSEC: not cost, just nobody turning them on.

When this isn't enough

Some problems look like DNS but aren't. A valid lookup that still won't load points at the server, not the records - the host is down, or a firewall or expired SSL certificate is blocking the connection. Email that authenticates correctly but lands in spam is a reputation and DMARC-policy issue, not a missing record. And if a lookup shows records you did not create, treat that seriously: unexpected DNS changes can mean a compromised registrar or host account, and the first move is to reset that password and turn on 2-factor authentication.

If you want the outside-visible half of all this checked in one pass - nameservers, A records, the MX and TXT records your email depends on, DNSSEC and CAA - run your domain through our scan. It reports the same things a manual lookup would, scored against the Australian small business baseline, so you can see not just whether a record is present but whether it is set the way a healthy domain sets it. auDA, the body that runs the .au namespace, publishes registrant guidance at auda.org.au if you need to confirm who actually controls a .au name before you start changing it.