DNS and dig Cheat Sheet: Records, Lookups, TTL and Cache Flushing

DNS turns names like example.com into the addresses and settings that make a website and its email work. When a site “disappears” after a move, email stops arriving or an SSL certificate refuses to issue, DNS is often involved. This sheet covers what each record type does and the rules that trip people up, how to query DNS with dig and read the answer, what TTL and “propagation” really mean, and how to clear stale answers from your own computer.

Placeholders: DOMAIN is your domain (for example example.com). HOST is a full host name (for example www.example.com). IP is an IPv4 or IPv6 address. NS_SERVER is a name server for the domain (for example ns1.example-dns.net). RESOLVER is a recursive resolver such as 1.1.1.1 or 8.8.8.8. SELECTOR is a DKIM selector name given by your email provider.

Record types

Type	Purpose	Example (zone file style)	Rules and notes
A	Name to IPv4 address	example.com. 3600 IN A 192.0.2.10	Several A records on one name are allowed (round robin). Points the site at its server.
AAAA	Name to IPv6 address	example.com. 3600 IN AAAA 2001:db8::10	A stale AAAA after a server move sends IPv6 visitors to the old host while IPv4 visitors see the new one.
CNAME	Alias: this name is another name	www.example.com. 3600 IN CNAME example.com.	A CNAME cannot sit alongside any other record at the same name (RFC 1034, RFC 2181). That is why it cannot be used at the zone apex, which must hold SOA and NS records.
ALIAS / ANAME / CNAME flattening	Apex alias that the DNS provider resolves and serves as A and AAAA	Provider-specific; set in the dashboard	Not a standard record type. Cloudflare calls it CNAME flattening; other providers use ALIAS, ANAME or “alias records”. Lets example.com follow a host name such as a load balancer.
MX	Mail servers for the domain	example.com. 3600 IN MX 10 mail.example.com.	Lower preference number is tried first. The target must be a host name with A or AAAA records, never an IP and never a CNAME (RFC 2181). A null MX, MX 0 ., says the domain accepts no mail (RFC 7505).
TXT	Free text, used for SPF, DKIM, DMARC and ownership verification	example.com. 3600 IN TXT "v=spf1 include:_spf.example.net -all"	Each string is at most 255 characters; long values (DKIM keys) are split into several quoted strings that are joined. Only one v=spf1 record per name. DKIM lives at SELECTOR._domainkey.DOMAIN, DMARC at _dmarc.DOMAIN.
NS	Name servers authoritative for the zone	example.com. 172800 IN NS ns1.example-dns.net.	Set in two places: at the registrar (the delegation in the parent zone) and inside the zone. They should match. The registrar copy is the one that decides who answers.
SOA	Start of authority: zone metadata	example.com. 3600 IN SOA ns1.example-dns.net. hostmaster.example.com. 2026110701 7200 3600 1209600 3600	Exactly one per zone, at the apex. Fields explained in the next table.
CAA	Which certificate authorities may issue certificates	example.com. 3600 IN CAA 0 issue "letsencrypt.org"	If any CAA record exists, a CA not listed must refuse to issue. Tags below.
SRV	Location of a service (host and port)	_sip._tcp.example.com. 3600 IN SRV 10 60 5060 sip.example.com.	Format: _SERVICE._PROTOCOL.NAME TTL IN SRV PRIORITY WEIGHT PORT TARGET. Lower priority first; weight shares load among equal priorities. A target of . means the service is not offered.
PTR	Reverse DNS: address to name	10.2.0.192.in-addr.arpa. 3600 IN PTR mail.example.com.	Controlled by whoever owns the IP block (your host), not your DNS provider. Mail servers check it; it should match a name that resolves back to the same IP.
DS	DNSSEC: hash of the zone’s key, stored in the parent zone	example.com. 86400 IN DS 12345 13 2 ABCD...	Added at the registrar. A DS that no longer matches the zone’s DNSKEY breaks the domain for validating resolvers (SERVFAIL).
DNSKEY	DNSSEC: the zone’s public keys	example.com. 3600 IN DNSKEY 257 3 13 (key data)	Published by the DNS provider. 257 marks a key signing key, 256 a zone signing key.
HTTPS / SVCB	Service binding: tells clients how to connect (ALPN protocols such as HTTP/3, alternative endpoints, IP hints)	example.com. 3600 IN HTTPS 1 . alpn="h2,h3"	Defined in RFC 9460. Priority 0 is alias mode, which can alias an apex name. Some providers add HTTPS records automatically for proxied sites.

SOA fields

Field	Example	Meaning
MNAME	ns1.example-dns.net.	Primary name server for the zone.
RNAME	hostmaster.example.com.	Administrator email with the first dot standing for @ (hostmaster@example.com).
SERIAL	2026110701	Zone version. Must increase on every change for secondary servers to pick it up. YYYYMMDDNN is a common convention.
REFRESH	7200	Seconds between secondary servers checking for a new serial.
RETRY	3600	Seconds a secondary waits to retry after a failed refresh.
EXPIRE	1209600	Seconds a secondary keeps answering without reaching the primary before it stops.
MINIMUM	3600	Today this sets negative caching: resolvers cache “this name does not exist” for the smaller of this value and the SOA record’s own TTL (RFC 2308).

CAA tags

Tag	Example	Meaning
issue	0 issue "letsencrypt.org"	This CA may issue certificates for the name. 0 issue ";" forbids all issuance.
issuewild	0 issuewild "sectigo.com"	Applies to wildcard certificates and overrides issue for them.
iodef	0 iodef "mailto:security@example.com"	Where a CA may report refused requests.
Parameters	0 issue "letsencrypt.org; validationmethods=dns-01"	RFC 8657 adds accounturi and validationmethods to lock issuance to one ACME account or challenge type.
Flag 128	128 issue "letsencrypt.org"	Critical flag: a CA that does not understand the tag must refuse. Normally use 0.

CAs check CAA on the exact name and then climb parent by parent (toward the TLD) until they find a CAA set, so a CAA on example.com covers www.example.com unless the subdomain has its own.

dig basics

dig ships with BIND utilities (dnsutils or bind-utils on Linux, built into macOS). Syntax: dig [@RESOLVER] NAME [TYPE] [+options]. Type defaults to A.

Command	What it does	Example	Notes
dig DOMAIN	A record lookup with full output	dig example.com	Uses the resolver from your system settings.
dig DOMAIN TYPE	Lookup of a specific type	dig example.com MX	Types: A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, SRV, PTR, DS, DNSKEY, HTTPS.
+short	Prints only the answer data	dig example.com A +short	Best for scripts and quick checks.
+noall +answer	Prints only the answer section, with TTLs	dig example.com TXT +noall +answer	Shows remaining cache time, unlike +short.
@RESOLVER	Asks a specific server	dig @1.1.1.1 example.com	Compare @1.1.1.1, @8.8.8.8 and @9.9.9.9 to see different caches.
@NS_SERVER	Asks the authoritative server directly	dig @ns1.example-dns.net example.com A +norecurse	Shows the true current value, no caching. Look for the aa flag.
+trace	Follows delegation from the root servers down	dig example.com +trace	Does the iteration itself, bypassing your resolver’s cache. Shows which name servers the registry really delegates to.
-x IP	Reverse lookup (PTR)	dig -x 192.0.2.10 +short	Builds the in-addr.arpa or ip6.arpa name for you.
+dnssec	Requests DNSSEC records (RRSIG) with the answer	dig example.com +dnssec	The ad flag in the reply means the resolver validated the answer.
+cd	Checking disabled: asks the resolver to skip DNSSEC validation	dig @8.8.8.8 example.com +cd	If a SERVFAIL disappears with +cd, DNSSEC is broken.
+tcp	Uses TCP instead of UDP	dig example.com TXT +tcp	Tests large answers and firewalls that block TCP port 53.
+multiline	Prints long records (SOA, DNSKEY) with comments	dig example.com SOA +multiline	Labels each SOA field.
+nssearch	Asks every authoritative server for the SOA	dig example.com +nssearch	Quick way to spot servers with different serials.
-4 / -6	Forces IPv4 or IPv6 transport	dig -6 example.com AAAA	Tests IPv6 reachability of the resolver.
-p PORT	Queries a non-standard port	dig @127.0.0.1 -p 5353 example.com	Local test resolvers.
ANY	Asks for all record types	Avoid	Deprecated in practice. RFC 8482 lets servers return a minimal answer, and many do (Cloudflare’s authoritative servers answer with a synthesized HINFO record; behavior varies by provider and resolver). Query each type separately.

Reading dig output

; <<>> DiG 9.18 <<>> example.com A
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4242
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232

;; QUESTION SECTION:
;example.com.                   IN      A

;; ANSWER SECTION:
example.com.            1742    IN      A       192.0.2.10

;; Query time: 12 msec
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
;; MSG SIZE  rcvd: 56

Part	What to read
status	NOERROR success (check the answer count), NXDOMAIN the name does not exist, SERVFAIL the resolver could not get a valid answer (broken delegation, DNSSEC failure, unreachable servers), REFUSED the server will not answer you (not authoritative or not open), FORMERR malformed query.
NODATA	NOERROR with ANSWER: 0: the name exists but has no record of that type. Different from NXDOMAIN.
flags	qr this is a response, aa authoritative answer, rd recursion desired, ra recursion available, ad DNSSEC validated, cd checking disabled, tc truncated (retry over TCP).
QUESTION	What you asked. Confirm the name and type.
ANSWER	Name, remaining TTL in seconds, class, type, data. From a resolver, TTL counts down as the cached copy ages.
AUTHORITY	Name servers for the zone, or the SOA on negative answers (its values set how long the “no” is cached).
ADDITIONAL	Extra helpful records, such as addresses of name servers, plus the EDNS OPT pseudo record.
SERVER	Which server answered. Check it is the one you meant.

TTL and “propagation”, accurately

Fact	What it means in practice
DNS changes are not pushed anywhere.	“Propagation” is resolvers around the world letting their cached copies expire and asking again.
TTL is set per record by the zone owner.	A resolver may cache an answer for up to the TTL. Some resolvers cap or raise TTLs, so treat it as a guide, not a guarantee.
The old TTL is the one that matters.	Lowering a TTL from 86400 to 300 only takes effect once caches holding the 86400 copy expire. Lower it at least one old TTL before the move.
Negative answers are cached too.	If someone looked up a name before you created it, the NXDOMAIN is cached for the smaller of the SOA MINIMUM and the SOA TTL.
Name server changes are slower.	Changing name servers at the registrar updates the parent zone, and those NS records often carry long TTLs (for .com, 172800 seconds, which is two days). Resolvers with the old delegation cached keep asking the old provider.
Browsers and operating systems cache too.	After the resolvers update, your own machine may still hold the old answer. Flush it (see below).
Keep the old server running.	Leave the old host serving the site and accepting mail until traffic stops arriving there.

nslookup and PowerShell equivalents

Task	dig	nslookup	PowerShell
A record	dig DOMAIN +short	nslookup DOMAIN	Resolve-DnsName DOMAIN -Type A
MX	dig DOMAIN MX +short	nslookup -type=mx DOMAIN	Resolve-DnsName DOMAIN -Type MX
TXT	dig DOMAIN TXT +short	nslookup -type=txt DOMAIN	Resolve-DnsName DOMAIN -Type TXT
Specific resolver	dig @8.8.8.8 DOMAIN	nslookup DOMAIN 8.8.8.8	Resolve-DnsName DOMAIN -Server 8.8.8.8
Name servers	dig DOMAIN NS +short	nslookup -type=ns DOMAIN	Resolve-DnsName DOMAIN -Type NS
SOA	dig DOMAIN SOA +multiline	nslookup -type=soa DOMAIN	Resolve-DnsName DOMAIN -Type SOA
Reverse	dig -x IP +short	nslookup IP	Resolve-DnsName IP
DNS only, skip hosts file and cache	dig never reads the hosts file	nslookup queries the server directly	Resolve-DnsName DOMAIN -DnsOnly -NoHostsFile
DNSSEC records	dig DOMAIN +dnssec	Limited	Resolve-DnsName DOMAIN -DnssecOk

nslookup labels cached results “Non-authoritative answer”. That is normal and only means the reply came from a resolver rather than the zone’s own server.

Flushing DNS caches

Where	Command or action	Notes
Windows	ipconfig /flushdns	Or in PowerShell: Clear-DnsClientCache. View the cache with Get-DnsClientCache.
macOS (current versions)	sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder	Prompts for your password. No confirmation is printed.
Linux with systemd-resolved	resolvectl flush-caches	Older systems: sudo systemd-resolve --flush-caches. Check with resolvectl statistics.
Linux with nscd	sudo nscd -i hosts	Only if nscd is installed and running.
Linux with dnsmasq	sudo systemctl restart dnsmasq	Restarting clears its cache.
Chrome	chrome://net-internals/#dns, then “Clear host cache”	Also chrome://net-internals/#sockets, “Flush socket pools”, to drop open connections to the old IP.
Edge	edge://net-internals/#dns, then “Clear host cache”	Same engine as Chrome.
Firefox	about:networking#dns, then “Clear DNS Cache”	Firefox may use DNS over HTTPS, which bypasses the operating system resolver.
Hosts file	Linux and macOS /etc/hosts; Windows C:\Windows\System32\drivers\etc\hosts	Entries here override DNS completely. Remove test entries when you are done.
Your router	Restart it	Many home routers run a small caching resolver.
Public resolvers	Google Public DNS and Cloudflare 1.1.1.1 both offer a web form to purge a cached name	Useful when visitors on one resolver still see the old site.

Common recipes

Is the new DNS live yet?

dig DOMAIN NS +short                      # who should answer
dig @NS_SERVER DOMAIN A +noall +answer    # the true value at the source
dig @1.1.1.1 DOMAIN A +noall +answer      # what one cache holds, with TTL left
dig @8.8.8.8 DOMAIN A +noall +answer      # and another

If the authoritative answer is right, everything else is caching. The TTL column tells you the maximum wait for that resolver.

Did the name server change at the registrar take?

dig DOMAIN +trace | grep -E '\sNS\s'
whois DOMAIN | grep -i 'name server'

The NS records handed out by the TLD servers in the trace are what the world uses, whatever the zone itself says.

Email DNS health check

dig DOMAIN MX +short
dig DOMAIN TXT +short | grep spf1
dig SELECTOR._domainkey.DOMAIN TXT +short
dig _dmarc.DOMAIN TXT +short
dig -x MAIL_SERVER_IP +short

MAIL_SERVER_IP is the IP your outgoing mail leaves from. Check there is exactly one SPF record and that the PTR name resolves back to the same IP.

Certificate will not issue

dig DOMAIN CAA +short
dig www.DOMAIN CAA +short
dig DOMAIN A +short
dig DOMAIN AAAA +short
dig _acme-challenge.DOMAIN TXT +short     # DNS-01 challenges

A CAA that omits your CA, or a stale AAAA pointing at an old server, are common causes.

SERVFAIL everywhere: check DNSSEC

dig @8.8.8.8 DOMAIN A                     # SERVFAIL?
dig @8.8.8.8 DOMAIN A +cd                 # works with checking disabled?
dig DOMAIN DS +short                      # what the parent publishes
dig @NS_SERVER DOMAIN DNSKEY +multiline   # what the zone publishes

If the query works with +cd, the DS at the registrar no longer matches the zone’s keys, often after moving DNS providers. Remove or update the DS at the registrar.

Preview a site on a new server before switching DNS

curl -sI https://DOMAIN/ --resolve DOMAIN:443:NEW_IP

NEW_IP is the new server’s address. Or add a temporary line to your hosts file: NEW_IP DOMAIN www.DOMAIN.

Gotchas

• The trailing dot. In zone files, mail.example.com. is absolute. Without the dot many editors append the zone, giving mail.example.com.example.com. Web dashboards usually handle this, but check what they saved.
• Two SPF records. More than one v=spf1 TXT record on a name is a permanent SPF error. Merge them into one.
• CNAME on a name with other records. Many providers refuse it; some accept it and behave unpredictably. Mail breaks if a CNAME replaces a name that also needs MX or TXT records.
• Forgotten AAAA records. Moving the A record but not the AAAA splits visitors between servers. Check both.
• Proxied records hide the origin. With a CDN proxy on, dig returns the CDN’s addresses. Check the origin IP in the provider’s dashboard, not with dig.
• Editing the wrong zone. Changes at a DNS provider that is not the one in the NS delegation do nothing. Confirm with dig DOMAIN NS +short first.
• Your resolver is not the world. Office networks, VPNs and ISPs may run their own caches. Always test against an authoritative server and two public resolvers.
• Wildcards do not cover everything. A *.example.com record does not answer for names that exist with other record types, and does not cover the apex.
• Registrar lock and expiry. An expired domain or a registry hold stops resolution no matter how correct the zone is. whois DOMAIN shows status and expiry.