DNS Troubleshooting with dig: The Commands DevOps Engineers Actually Need
A surprising share of "the app is down" pages resolve to a name-resolution problem, not a broken service. The service is fine; the client can't turn a name into an address. dig is the precision tool for proving that in seconds instead of guessing. Think about it as a resolution chain, not "is DNS broken" When a name fails, work the chain: which resolver did the client ask, what did that resolver…
Many application issues stem from name resolution problems rather than service failures. A single command called dig can quickly diagnose the issue instead of guessing. Think of it as checking the resolution chain - the client's resolver, the resolver's response, and what authoritative DNS actually says. Most problems occur in the gap between these components.
To troubleshoot DNS issues, follow a systematic approach: observe the symptom, hypothesize where the break occurs in the chain, test with one query, read the evidence, fix the problem, then validate. The key habit is to query the name from the same host and resolver the application uses. Running dig from your laptop doesn't reflect what the pod or VM views.
There are several key record types to understand: A/AAAA converts names to IP addresses, CNAME is an alias, MX handles mail routing, TXT contains SPF/DKIM data, NS lists authoritative servers, SOA tracks serial and TTL, and PTR does reverse lookups.
The most frequently useful dig commands are:
+short to get just the IP address
A to query for an A record
-x for reverse lookups (PTR records)
+trace to follow delegation from root servers down
resolvectl status to see the actual resolvers and search domains used on a host
Common issues include wrong A records (old IP), stale cache/TTL, querying the wrong resolver, search-domain problems, and container DNS setups. Dig runs from the correct host against the right resolver turns guessing into evidence. Follow the steps in the DNS troubleshooting guide for end-to-end scenarios. Remember, only inspect DNS on systems you're authorized to assess.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
