Pull a full snapshot of the domain's DNS
Free, no sign-up — results in seconds.
1. Is the domain registered and active?
An expired or suspended domain stops resolving even if the zone is perfect. Check the registration and expiry date with a WHOIS lookup, and confirm with the registrar that the domain isn't on hold.
2. Is the delegation correct?
Check the NS records. They must list the nameservers of the provider you're actually managing DNS with. Then confirm every listed nameserver answers. With dig:
dig NS example.co.za +short
dig @ns1.provider.com example.co.za SOA +short
dig +trace example.co.za+trace walks from the root servers down and shows exactly where the chain breaks.
3. Do the nameservers agree?
Ask each authoritative nameserver for the SOA record. If the serial numbers differ, a secondary isn't syncing and different users may get different answers.
4. Are the records right?
Use the All DNS Records lookup and check:
- A/AAAA for the root and
wwwpoint to the current server. - No CNAME at the root domain (it can't coexist with SOA and NS records).
- MX records point to hostnames that have A/AAAA records — not to IPs and not to CNAMEs.
- Only one SPF record exists.
- No stray AAAA record pointing to an old IPv6 address — IPv6-capable visitors will try it first.
5. Is DNSSEC valid?
If a DS record exists at the registry, the zone must be signed with a matching key. A mismatch causes SERVFAIL on validating resolvers — the domain works for some people and not others. Look for DS and DNSKEY records in the All DNS lookup.
6. Is email DNS healthy?
Run the Email Deliverability Checker for SPF, DKIM, DMARC and MX, and the Blacklist Checker for your mail server IP.
7. Is it just caching?
If authoritative nameservers return the correct value but some users see old data, it's caching. Check propagation with the DNS checker and wait out the old TTL. See fixing DNS resolution problems for the user-side fixes.
Keep a record
Export the zone with the All DNS Records tool whenever it's working correctly. Having a known-good snapshot makes the next incident much faster to resolve.
Frequently asked questions
What does SERVFAIL mean?
The resolver couldn't get a usable answer — commonly broken DNSSEC, unreachable nameservers or a lame delegation (NS records pointing at servers that don't host the zone).
What is a lame delegation?
When the NS records list a nameserver that doesn't actually have the zone. Remove it from the NS list or add the zone to that server.
Why do some users see the site and others don't?
Different resolvers have different cached data, nameservers disagree, or DNSSEC is failing only on validating resolvers.
Need a hand with a website that keeps misbehaving? HostFaddy web development can help, and VPS hosting gives you full control of your server.