How to troubleshoot DNS problems: is DNS making your internet look broken?

By Michael Obraitis, Managing Partner, and Michael Dale, CEO·Published August 12, 2026·Last reviewed August 2026·ADAM Pulse Knowledge Base

A user says:

“The internet is down.”

But when IT tests the connection, the firewall is reachable.

The WAN circuit is up.

Ping to a public IP works.

Yet websites and cloud applications still fail to load.

The problem may not be the internet connection.

It may be DNS.

DNS problems can make a healthy network appear broken because users rely on names such as:

zoom.us

microsoft.com

salesforce.com

rather than memorizing IP addresses.

When name resolution fails, users often describe the symptom simply as:

“Nothing works.”

This guide explains how to troubleshoot DNS problems, how to separate DNS failures from broader network outages, and why DNS should be included in a complete network monitoring strategy.

What Is DNS?

DNS stands for Domain Name System.

Its job is to translate human readable names into IP addresses.

For example:

example.com

must ultimately resolve to an IP address before a device can connect to the service.

Cisco describes DNS as fundamental to TCP/IP network performance and notes that misconfiguration can affect the performance of the broader network.

What Does a DNS Problem Look Like?

Users may report:

• Website will not load
• Application cannot connect
• Server cannot be found
• Internet is down
• Browser says name cannot be resolved
• One website works while another does not
• Application works by IP but not by hostname

Cloudflare documents common browser errors including ERR_NAME_NOT_RESOLVED, “can't find the server,” and DNS resolution errors when name resolution fails.

How Do You Know if DNS Is the Problem?

One of the fastest tests is comparing:

IP connectivity

with:

hostname connectivity

For example:

Can you reach a known external IP?

If yes:

Can you resolve a known hostname?

If the IP works but the hostname does not, DNS becomes a much stronger suspect.

DNS Troubleshooting Example

Imagine:

Local gateway: reachable

Firewall: reachable

Public IP: reachable

Website by hostname: fails

DNS query: fails

That is a very different problem from:

Local gateway: unreachable

The first scenario points toward DNS.

The second points toward a more fundamental network issue.

What Causes DNS Problems?

Common causes include:

• Incorrect DNS server configuration
• DNS server unavailable
• Missing DNS records
• Incorrect DNS records
• Stale records
• DNSSEC problems
• Firewall blocking DNS
• VPN DNS configuration
• Split DNS problems
• Resolver problems
• Cached incorrect information

Cloudflare's current troubleshooting guidance specifically lists incorrect or missing DNS records, upstream resolution issues, DNSSEC problems, and resolver related errors among common causes.

What Is DNS Resolution?

DNS resolution is the process of converting a hostname into an address.

The request may involve several DNS systems before the answer reaches the user.

If any required part of that process fails or responds slowly, application access can fail or appear sluggish.

What Tools Can You Use to Troubleshoot DNS?

Useful tools include:

• nslookup
• dig
• ping
• traceroute
• DNS monitoring
• Packet capture
• Application tests

The best tool depends on what you need to verify.

How Do You Use nslookup?

nslookup allows you to query DNS and inspect the returned answer.

It can help determine:

• Whether the hostname resolves
• Which DNS server responded
• Which IP address was returned

If the query times out or returns an unexpected result, DNS deserves further investigation.

How Do You Use dig?

dig provides more detailed DNS information and is especially useful on Linux and macOS.

It can show:

• DNS response
• Response code
• Answer records
• Query timing
• Resolver used

Cloudflare recommends comparing resolution against different resolvers when diagnosing resolver issues.

Should You Test More Than One DNS Resolver?

Yes, when appropriate.

For troubleshooting, comparing responses can help determine whether the problem is isolated to one resolver.

For example:

Corporate DNS: fails

Alternative authorized resolver: works

That difference is useful evidence.

Do not permanently change enterprise DNS settings without understanding organizational security and policy requirements.

What Does NXDOMAIN Mean?

NXDOMAIN indicates that DNS determined the requested domain does not exist.

Cloudflare explains that DNS_PROBE_FINISHED_NXDOMAIN means the DNS lookup completed and returned a non existent domain result.

This may occur because:

• Domain was typed incorrectly
• Required record is missing
• DNS configuration is incorrect
• Resolver has stale or incorrect information

What Does SERVFAIL Mean?

SERVFAIL means the DNS server could not successfully complete the request.

The basic error does not always explain the cause.

Cloudflare notes that Extended DNS Error Codes can provide more detailed information about why a DNS request failed.

Can DNS Make the Internet Feel Slow?

Yes.

DNS does not necessarily have to fail completely.

Slow resolution can cause users to experience delays before applications or websites begin loading.

That is why Cisco specifically includes DNS response time as an important network performance measurement.

Can the Firewall Cause DNS Problems?

Yes.

Potential causes include:

• DNS traffic blocked
• DNS filtering
• Incorrect policies
• NAT problems
• Security inspection
• DNS proxy behavior
• VPN policies

Review firewall logs at the time the failure occurs.

Can a VPN Cause DNS Problems?

Yes.

VPNs often influence:

• Which DNS server is used
• Which domains resolve internally
• Split DNS
• Search domains
• Routing toward DNS servers

A user may experience DNS problems only while connected to the VPN.

That distinction can dramatically narrow troubleshooting.

What Is Split DNS?

Split DNS means the same or related names may resolve differently depending on whether the user is inside or outside the corporate network.

This can be useful for internal applications but can also create confusion if the configuration is inconsistent.

What Is DNS Caching?

DNS answers are commonly cached to improve performance.

Caching can also temporarily preserve outdated information.

After DNS changes, one user may see the new answer while another continues seeing an older cached result.

Why Does One User Have a DNS Problem but Everyone Else Works?

Investigate the endpoint.

Possible causes include:

• Local DNS cache
• Incorrect DNS configuration
• VPN
• Security software
• Hosts file
• Device network settings

If only one endpoint is affected, a global DNS outage becomes less likely.

Why Does One Location Have DNS Problems?

Look for shared infrastructure.

Potential causes include:

• Site DNS server
• Firewall configuration
• VPN
• WAN routing
• Local DHCP settings

Again, scope helps isolate the failure domain.

How Do You Troubleshoot DNS Step by Step?

Step 1: Determine Scope

One user?

One site?

Multiple sites?

One domain?

Every domain?

Step 2: Test Basic IP Connectivity

Can the device reach:

• Local gateway
• Firewall
• External IP

If not, DNS may not be the primary problem.

Step 3: Query DNS

Use:

• nslookup
• dig

Check whether the expected answer is returned.

Step 4: Compare Resolvers

Where authorized, compare the response from another resolver.

Step 5: Check Firewall and VPN

Look for:

• DNS policies
• Routing
• VPN DNS
• Filtering

Step 6: Review DNS Response Time

Slow resolution can create performance problems even when queries eventually succeed.

Step 7: Check Historical Behavior

Did DNS problems occur at the same time as broader WAN problems?

Why Should DNS Be Monitored?

Because DNS is an application dependency.

A circuit can be:

UP

while DNS is:

DOWN

From the user's perspective, the network may still appear unusable.

Monitoring DNS can help distinguish:

Internet outage

from:

Name resolution outage

What Should DNS Monitoring Include?

Depending on the environment:

• Resolver availability
• Query success
• Response time
• Important domains
• Internal DNS
• External DNS

The exact strategy depends on business applications.

How Does DNS Fit into Network Fault Isolation?

The ADAM Pulse fault isolation model can be extended as:

Scope → Gateway → Firewall → Carrier → Internet → DNS → Application → History

DNS comes after basic connectivity because it depends on the network beneath it.

If the network is healthy but applications still fail, DNS becomes an important next test.

What Is the ADAM Pulse Approach to DNS Troubleshooting?

ADAM Pulse should treat DNS as one part of a broader troubleshooting picture.

The questions are:

Is the site online?

Is the gateway reachable?

Is the firewall reachable?

Is the carrier path healthy?

Can external IP addresses be reached?

Can DNS names be resolved?

Is DNS response time abnormal?

Was there a related WAN event at the same time?

That context prevents misdiagnosing DNS failures as ISP outages.

Stop Calling Every Name Resolution Failure an Internet Outage

If:

IP connectivity works

and:

DNS does not

then the internet connection may not be the real problem.

The fastest troubleshooting process separates:

Connectivity

from:

Resolution

from:

Application availability

ADAM Pulse provides managed network monitoring designed to help USA Telecom customers isolate network conditions across gateways, firewalls, internet circuits, DNS and cloud applications.

Know what is reachable.

Know what resolves.

Know where the failure begins.

Learn more about ADAM Pulse and talk with USA Telecom about proactive network monitoring and fault isolation.

Frequently asked questions

Sources

• IETF — RFC 1034: Domain Names - Concepts and Facilities (November 1987, Internet Standard, STD 13). The base DNS resolution model.
• IETF — RFC 1035: Domain Names - Implementation and Specification (November 1987, Internet Standard, STD 13).
• IETF — RFC 2308: Negative Caching of DNS Queries (DNS NCACHE) (March 1998). Why a stale or negative answer can outlive the fix.
• IETF — RFC 9499: DNS Terminology (March 2024, BCP 219). Obsoletes RFC 8499; the current authority on DNS vocabulary.
• IETF — RFC 792: Internet Control Message Protocol (September 1981, Internet Standard, STD 5). Why devices may rate-limit or deprioritise the ICMP that ping and traceroute depend on.
• Cisco — What Is Network Latency?

ADAM Pulse monitors name resolution alongside the circuit, so a DNS failure is not escalated to the carrier as an internet outage.

← More from the ADAM Pulse Knowledge Base

Prepared by ADAM Pulse (USA Telecom Consulting LLC) — managed AI governance, network, and NOC services. Support: (888) 989-4872 · support@adampulse.us