DNS and domain lookup

Roughly a third of the time a site will not load, the servers are fine and one of these records is the reason - which is why this is the first thing to check after confirming the site is unreachable and before assuming an outage. A domain name is not a machine. It is an entry in a distributed database that tells the rest of the internet which machines to talk to, and for what. When a site is unreachable, roughly a third of the time the servers are fine and one of these records is the reason.

A and AAAA - Where the name points

The address records. A holds an IPv4 address, AAAA an IPv6 one. If these are missing or wrong, nothing else matters: Browsers have nowhere to connect, and the failure looks identical to the server being switched off. A domain with several A records is usually behind a load balancer or a CDN, and your browser will try them in turn.

NS - Who is authoritative

The name servers that hold the real answers for this domain. Everything else in this list is served by them. If the NS records point somewhere that no longer answers - A cancelled hosting account, a lapsed DNS provider - The whole domain disappears from the internet even though the web server is untouched and still running.

MX - Where mail goes

Mail exchangers, in priority order, lowest number first. A domain with no MX records does not receive mail at all. This is worth checking separately from the website, because the two are frequently hosted by different companies: Mail can be broken while the site is perfectly healthy, and the reverse happens just as often.

TXT - Policies and proof of ownership

Free-text records used for things DNS was never designed for but now handles universally. The common ones are SPF (which servers are allowed to send mail claiming to be this domain), DMARC (what receiving servers should do with mail that fails those checks), DKIM (the public half of a mail-signing key), and a long tail of verification strings proving to Google, Microsoft, Stripe and others that someone controls the domain. A broken SPF or DMARC record is one of the most common reasons legitimate mail silently vanishes.

SOA - The zone’s own metadata

Start of Authority: The primary name server and a set of timers telling other resolvers how long to cache and when to give up. The serial number increments each time the zone changes, which makes it a quick way to see whether a change has actually been published or is still sitting in a control panel.

CNAME - An alias

Points one name at another name rather than at an address. Extremely common for subdomains handed to a hosted service. A CNAME pointing at a service that has been cancelled is the cause of the subdomain-takeover class of security problem, so a dangling one is worth noticing.

The registration block comes from RDAP, the protocol that replaced WHOIS. It is the registry’s own record of who sold the domain, when, and what state it is in.

The expiry date is the single most useful field on an otherwise healthy domain that suddenly stopped working. An expired domain does not fail gracefully - The registry pulls its name servers, and every record above vanishes at once. Sites disappear this way surprisingly often, usually because the renewal notice went to an inbox nobody reads any more.

The status flags are also worth reading. clientTransferProhibited and its siblings are normal and healthy: They are locks the owner has asked the registrar to apply. Anything containing hold is not normal, and means the registry or the registrar has suspended the name.

We deliberately do not show registrant names, email addresses or phone numbers, even where a registry still publishes them. Those belong to a person. They are dropped before anything is stored, so they are not in our cache to leak.