What is your first step when DNS suddenly stops working?

DNS problems can be deceptive because the application error often points somewhere else.

My first test is usually dig example.com. Then I query a known resolver directly, such as dig @1.1.1.1 example.com, to determine whether the problem is local or authoritative.

The response code is often the best clue:

• NXDOMAIN usually means the name does not exist.
• SERVFAIL may indicate an upstream, delegation or DNSSEC problem.
• A timeout points more toward connectivity, firewall or resolver availability.

If command-line resolution works but the application still fails, I check /etc/hosts, local caching, search domains and the application’s own DNS behavior.

The most important thing is to identify which layer is failing before changing nameservers or clearing every cache.

Which DNS issue has been the hardest for you to diagnose?