The best free DNS tools for troubleshooting (and when to use each)

DNS problems look like "the site is down" or "email stopped working," but they are usually one of a handful of specific faults. These free tools pin down which one — in the order you should use them.

1. DNS lookup — what does the domain resolve to now?

The DNS lookup tool shows the A, AAAA, CNAME, MX, TXT, NS and other records for any name, queried live. Use it first, always:

• Site not loading → check A/AAAA. Wrong or missing IP is the fault found most often.

• Email failing → check MX and the TXT records for SPF/DKIM.

2. DNS propagation checker — has my change gone live?

The DNS propagation checker compares how multiple public resolvers answer. If some show the old value, that is caching, not a mistake — wait out the TTL. If all show the old value long after the change, something upstream is wrong.

3. Record analyzers — is the zone correct?

Specialised checkers each focus on one record type:

• MX record checker — mail routing.

• NS record checker — which nameservers are authoritative.

• TXT record checker — SPF, DKIM and verification records.

• CAA record checker — which certificate authorities may issue for you.

• SOA record checker — zone serial and refresh timings.

If you edit records, confirm in the right place by checking NS first — you cannot change a zone you do not control.

4. DNSSEC checker — is the chain of trust intact?

The DNSSEC checker verifies your zone is signed and the DS record at the registrar matches. A broken DNSSEC setup makes a domain fail to resolve entirely, which is worse than not having it — so check after any DNSSEC change.

5. Blacklist checks — is reputation the problem?

For mail specifically, the email blacklist checker and DNS blacklist checker reveal whether an IP or domain is listed. A listing causes silent rejection at many providers.

6. Latency and consistency

Finally, the DNS latency and DNS speed test tools show how quickly resolvers answer, useful when a DNS provider is slow rather than wrong.

The troubleshooting order

1. Lookup — is it resolving, and to what?

2. Propagation — has my change spread?

3. Record-specific checks — is the zone correct?

4. DNSSEC — is trust intact (after DNSSEC changes)?

5. Blacklists — for mail, is reputation the issue?

Run them top to bottom and the culprit surfaces fast. Deeper explanations are in DNS records explained and Troubleshoot DNS; if you would rather not run the zone yourself, our Managed DNS service does.