DNS is the first thing that breaks and the last thing people check. The site "isn't deployed", the email "doesn't arrive", the API "doesn't resolve" — and nine times out of ten, dig or its web equivalent answers in under a second.
The DNS Lookup tool returns every record family for a domain in one call. This guide is the decoder ring for its output.
A and AAAA: where the site actually lives
"A": [{ "address": "93.184.216.34", "ttl": 300 }],
"AAAA": [{ "address": "2606:2800:220:1:248:1893:25c8:1946", "ttl": 300 }]
- A — IPv4. If it's missing, the domain has no IPv4 host and roughly half the internet can't reach it.
- AAAA — IPv6. Absence is normal for small sites; presence with a broken path is worse than absence.
Debugging move: if A resolves but the site still times out, the problem is not DNS — it's routing, firewall, or the server itself.
CNAME: the redirect of DNS
"CNAME": ["www.yourdomain.com."]
A CNAME points a name at another name — the resolver follows it until it reaches A/AAAA records. Debugging move: a CNAME loop (a → b → a) is a classic misconfiguration that produces "server not found" errors that look like the internet is broken.
MX: where mail goes
"MX": [{ "priority": 10, "exchange": "mx1.yourdomain.com." }]
Lower priority wins. Debugging move: when mail "disappears", check MX first — then check that the exchange hosts have A records (a mail server pointing at an unresolvable hostname is a silent black hole).
TXT: the record that's actually a database
"TXT": ["v=spf1 include:_spf.google.com ~all", "google-site-verification=..."]
TXT carries everything that isn't addressing: SPF policies, DKIM keys, domain verification tokens, DMARC policies, MTA-STS announcements. Debugging move: long TXT values come back split into multiple quoted strings — when you paste them into your DNS provider, make sure you're pasting the concatenated value, not one fragment.
NS and SOA: who's authoritative
"NS": ["ns1.yourdomain.com.", "ns2.yourdomain.com."],
"SOA": ["ns1.yourdomain.com. hostmaster.yourdomain.com. serial=2026080801"]
NS lists the authoritative nameservers. SOA carries the serial number — the version counter of your zone. Debugging move: if a change "didn't propagate", check whether the SOA serial actually incremented. If it didn't, secondary nameservers will never pick up your update, no matter how long you wait.
Reading TTLs like an operator
Every answer carries a TTL — the number of seconds resolvers are allowed to cache it:
- TTL 60–300: deliberately volatile (failover DNS, record you're about to change).
- TTL 3600+: stable records. Changes to them take up to the TTL to propagate everywhere.
Debugging move: before changing a record you'll need to move fast, lower its TTL a day in advance. Change the TTL before the content, wait, then change the content.
One call for everything
curl -X POST https://yas.sh/api/v1/tools/dns-lookup -d '{"input":"yourdomain.com"}'
returns A, AAAA, MX, TXT, NS, CNAME and SOA in one JSON response — the same data a stack of dig commands gives you, in a shape scripts can parse. DNS is the most reliable debugging tool on the internet. The trick is asking it the right questions.