When DNS stops working

Every connection you make starts with a question: What address does this name have? That question goes to a resolver, and if the resolver does not answer, nothing else happens. Your connection is perfect. Your router is fine. Your ISP is delivering packets flawlessly. And nothing loads, because nothing knows where to send anything.

This is the single most common cause of the experience people describe as "the whole internet is down", and it is also one of the fastest things to fix once identified.

Confirming it in ten seconds

Open https://1.1.1.1. That is a numeric address and needs no resolution.

If a page appears, your connectivity is fine and DNS is broken. If nothing appears, you have a genuine connectivity problem and DNS is not your issue.

With a terminal, the more precise version:

nslookup example.com
nslookup example.com 1.1.1.1

The first uses your configured resolver, the second bypasses it. If the second works and the first does not, you have isolated the fault exactly.

Where it breaks

Your resolver is down

ISP resolvers are unglamorous infrastructure and they do fail. When they do, every customer of that ISP experiences a total internet outage while their connection is entirely healthy.

Public resolvers fail too, and the blast radius is larger because they are configured on routers worldwide. A 1.1.1.1 or 8.8.8.8 incident produces a sudden global flood of unrelated outage reports from people who have no idea their router is even using one.

A stale cache

Answers are cached at every level: Your browser, your operating system, your router, your ISP's resolver. When a site moves, an old answer somewhere in that chain keeps sending you to an address that no longer serves it.

Negative answers are cached too, which is the part that surprises people. If you tried a domain just before its records became valid, you may hold the "does not exist" answer for hours. Clearing caches is the fix, and you can only clear the ones you control.

The domain's own nameservers

If a domain's authoritative servers are unreachable, nothing can resolve it. This affects everyone and there is nothing you can do - And it is the mechanism behind the most complete outages there are. When Meta withdrew its routes in 2021, its nameservers disappeared from the internet and every Meta hostname stopped resolving globally.

Filtering

Ad blockers at the router level, parental controls, corporate DNS policies and some ISP-level blocking all work by returning false answers. A blocked domain typically returns NXDOMAIN or an address pointing at a block page, which is indistinguishable from a real failure unless you know the filtering is there.

A VPN

VPNs push their own resolvers. A misconfigured client can leave you with a resolver that is unreachable over the tunnel, or one that answers with internal addresses. Disconnecting is an instant test.

Fixing it

1. Flush your local caches - Operating system, then browser. Exact commands per platform.
2. Restart the router. One of the few problems where this genuinely helps, because routers cache DNS and some cache aggressively.
3. Switch resolver. The most reliable fix. Set your device or router to a public resolver and the whole class of ISP-resolver problems disappears.
4. Disconnect the VPN for one test.
5. Check the hosts file. An entry there overrides DNS entirely. Some software adds entries without asking.

Which resolver

Set it on the router and every device on the network benefits. Set it on one device to test without affecting anyone else. Step-by-step instructions for every platform, and how to choose between them.

The resolver you choose sees everything

Worth saying plainly: Your resolver can see every domain you visit, even though it cannot see the pages. That is a meaningful amount of information, and it is why resolver privacy policies matter and why DNS over HTTPS exists.

DoH encrypts the query so your network cannot read or tamper with it. Browsers increasingly enable it by default, which has a practical side effect worth knowing: It bypasses router-level ad blocking and parental controls, because those work by intercepting exactly the queries DoH hides. If your Pi-hole suddenly stopped working, this is usually why.

When it is not DNS

DNS gets blamed for a lot that is not its fault. If nslookup returns an address and the site still will not load, resolution worked and the problem is further along - A connection failure, a certificate error, or the site being genuinely down. The connection errors guide covers what happens after the name resolves.