What DNS is and how to check DNS resolution

Every time you open a website, your device first has to turn a name like example.com into a numeric IP address. That translation is the Domain Name System, and when it misbehaves, the whole internet can feel broken even though your connection is fine.

DNS in one paragraph

Computers route traffic using IP addresses, but people remember names. DNS is the distributed directory that maps one to the other. It is not a single database: responsibility is split across many servers worldwide, each authoritative for its own slice of the namespace. That design is why DNS scales, and also why a change you make to a domain does not appear everywhere at the same instant.

What happens during a lookup

When you visit a site, the request usually goes through these steps:

Local caches. Your browser and operating system check whether they already know the answer from a recent lookup.
Recursive resolver. If not, the query goes to a resolver, typically run by your internet provider, or a public one you chose such as Cloudflare (1.1.1.1), Google (8.8.8.8) or Quad9 (9.9.9.9).
Root and TLD servers. If the resolver has no cached answer, it asks a root server where to find the servers for the top-level domain (for example .com), then asks those where to find the domain's own nameservers.
Authoritative nameserver. Finally it asks the domain's authoritative nameserver, which returns the actual record. The resolver caches the answer and hands it back to you.

All of this normally takes a fraction of a second, and most of the time the answer comes straight from a cache.

The records you will see most

A maps a name to an IPv4 address.
AAAA maps a name to an IPv6 address.
CNAME makes one name an alias of another name.
MX lists the mail servers that accept email for the domain.
NS names the authoritative nameservers for the domain.
TXT holds free-form text, commonly used for email authentication (SPF, DKIM, DMARC) and domain verification.

TTL and the myth of "propagation"

Every record carries a TTL (time to live), measured in seconds. It tells resolvers how long they may cache the answer before asking again. A TTL of 3600 means an answer can be reused for up to an hour.

When people say a DNS change is "propagating", what is really happening is that cached copies are expiring at different times in different resolvers. If you plan to move a site to a new server, lowering the TTL a day or so in advance shortens that window. After the move is stable, you can raise it again.

How to check DNS resolution yourself

You do not need special software. Every major operating system ships with a lookup tool:

nslookup example.com works on Windows, macOS and Linux and shows which resolver answered.
dig example.com A (macOS and Linux) gives more detail, including the TTL. Add +short for just the answer.
dig @1.1.1.1 example.com or nslookup example.com 8.8.8.8 asks a specific resolver, which is the quickest way to tell whether your usual resolver is the problem.

Comparing answers from two different resolvers is the single most useful DNS test. If a public resolver returns an address and your default one does not, the problem is with your resolver, not the website.

Reading common errors

NXDOMAIN means the name does not exist. Check for typos, or confirm the domain has not expired.
SERVFAIL means the resolver could not get a valid answer. This can point to a problem with the domain's nameservers or with DNSSEC validation.
Timeouts usually mean the resolver itself is unreachable, which often comes down to local network or router issues.

Clearing a stale cache

If a site moved and your device still goes to the old address, flush the local cache:

Windows: ipconfig /flushdns
macOS: sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder
Linux with systemd-resolved: resolvectl flush-caches

Browsers keep their own cache too, so restarting the browser helps. Your router may also cache answers; restarting it clears that layer.

A note on privacy

Traditional DNS queries are sent unencrypted, so anyone on the network path can see which names you look up. DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt those queries between you and the resolver. Most modern browsers and operating systems support at least one of them, usually in their network or privacy settings. Encryption hides queries from the network in between, but the resolver you choose still sees them, so pick one whose privacy policy you are comfortable with.