Troubleshooting DNS problems

This is a practical guide to diagnosing and fixing the most common DNS problems in cPanel.

Diagnostic method

When you have a DNS problem, follow a systematic approach:

1. Identify the symptom — what exactly is not working
2. Isolate the problem — is it DNS, the web server or something else?
3. Gather information — logs and test commands
4. Test your hypotheses — from the simple to the complex
5. Apply the fix — correct the problem
6. Check the result — make sure it works
7. Document it — write down the solution for the future

Diagnostic tools

Command line

dig (recommended)

# Basic query
dig example.com

# A specific record type
dig example.com A
dig example.com MX
dig example.com TXT
dig example.com NS

# Short answer (the IP only)
dig example.com +short

# Trace (full path)
dig example.com +trace

# Reverse DNS
dig -x 192.0.2.1

# Query a specific DNS server
dig @8.8.8.8 example.com
dig @1.1.1.1 example.com
dig @ns1.example.com example.com

# All records
dig example.com ANY +noall +answer

nslookup

# Simple query
nslookup example.com

# A specific type
nslookup -type=mx example.com
nslookup -type=txt example.com
nslookup -type=ns example.com

# Via a specific DNS server
nslookup example.com 8.8.8.8

host

# Quick check
host example.com

# Detailed information
host -a example.com

# A specific type
host -t mx example.com
host -t txt example.com

Online tools

• WhatsMyDNS.net — global DNS check
• MXToolbox.com — comprehensive DNS, MX and blocklist checks
• DNSChecker.org — DNS propagation check
• IntoDNS.com — detailed analysis of your DNS configuration
• DNS Lookup Tool — multiple queries
• ViewDNS.info — reverse DNS, DNS history

In cPanel

• Track DNS — check DNS records
• Zone Editor — view and edit the zone
• Email Deliverability — check SPF/DKIM/DMARC
• SSL/TLS Status — check SSL and DNS

Problem 1: The domain does not open

Symptoms

• The browser shows “This site can’t be reached”
• “DNS_PROBE_FINISHED_NXDOMAIN”
• “ERR_NAME_NOT_RESOLVED”
• A timeout when trying to open the website

Diagnosis

# Step 1: Check DNS resolution
dig example.com +short

# If nothing is returned - it is a DNS problem
# If an IP is returned - the problem is not DNS

Cause 1.1: The A record is missing

Check:

dig example.com A +short
# Empty, or NXDOMAIN

Fix:

1. Log in to cPanel → Zone Editor
2. Click Manage next to the domain
3. Look for the A record for the domain
4. If it is missing, add it:
   • Name: @ or example.com.
   • Type: A
   • Address: your server’s IP address
5. Click Add Record

Also add one for www:

www.example.com.  14400  IN  A  192.0.2.1

Cause 1.2: The NS records are wrong

Check:

# Check the NS records
dig example.com NS +short

# Compare with the NS at your registrar
whois example.com | grep "Name Server"

Fix:

1. Log in to your domain registrar’s control panel
2. Find the Nameservers / DNS section
3. Make sure the NS records point to the right servers
4. Typical for cPanel:

ns10.hosting-telecom.uk
ns11.hosting-telecom.uk

1. Save the changes
2. Wait for propagation: 24–48 hours

Cause 1.3: The DNS cache

Check:

# Check via different DNS servers
dig @8.8.8.8 example.com +short  # Google DNS
dig @1.1.1.1 example.com +short  # Cloudflare DNS
dig @your-isp-dns example.com +short  # Your ISP

If Google/Cloudflare show the right IP but your ISP does not, the problem is in your ISP’s cache.

Fix:

# Clear the local DNS cache

# Windows
ipconfig /flushdns

# macOS
sudo dscacheutil -flushcache
sudo killall -HUP mDNSResponder

# Linux (systemd)
sudo systemd-resolve --flush-caches

# Linux (nscd)
sudo /etc/init.d/nscd restart

# Browser (Chrome)
# Open: chrome://net-internals/#dns
# Click "Clear host cache"

Cause 1.4: The domain is not registered or has expired

Check:

whois example.com | grep -i "expir"
# or
whois example.com | head -20

Fix:

• Renew the domain registration with your registrar
• After payment, the domain is restored within 24–72 hours

Problem 2: Email is not working

Symptoms

• You are not receiving incoming email
• Sent messages are not arriving
• “User unknown” errors
• Messages are going to spam

Diagnosing incoming email

Step 1: Check the MX records

# Check MX
dig example.com MX +short

# It should show:
# 0 mail.example.com.

If there are no MX records:

1. cPanel → Zone Editor → Manage
2. Add an MX record:

example.com.  14400  IN  MX  0  mail.example.com.

1. Add an A record for mail:

mail.example.com.  14400  IN  A  192.0.2.1

Step 2: Check that the mail server is reachable

# Check the ports
telnet mail.example.com 25    # SMTP
telnet mail.example.com 587   # Submission
telnet mail.example.com 993   # IMAPS
telnet mail.example.com 995   # POP3S

# Or with nc
nc -zv mail.example.com 25
nc -zv mail.example.com 993

# If you see "Connection refused" - the server is not listening

If the ports are closed:

• Contact your hosting provider
• Check your firewall settings
• Make sure the mail server is running

Step 3: Check the email accounts

1. cPanel → Email Accounts
2. Make sure the account exists
3. Check the quota (is the mailbox full?)

Step 4: Check Email Routing

1. cPanel → Email Routing
2. Select the domain
3. Make sure the following is selected:
   • Automatically Detect Configuration (recommended)
   • or Local Mail Exchanger (if the mail is on this server)

Diagnosing outgoing email

Checking the SPF record

# Check SPF
dig example.com TXT +short | grep spf

# It should look something like:
# "v=spf1 a mx ~all"

If SPF is missing:

1. cPanel → Zone Editor → Manage
2. Add a TXT record:

example.com.  14400  IN  TXT  "v=spf1 a mx ip4:192.0.2.1 ~all"

Tuning SPF:

• ~all — soft fail (recommended)
• -all — hard fail (strict, and may block legitimate email)
• include: — add external services (Gmail, Office 365)

Checking DKIM

# Check DKIM
dig default._domainkey.example.com TXT +short

If DKIM is missing:

1. cPanel → Email Deliverability
2. Click Manage next to the domain
3. In the DKIM section, click Install the DKIM Keys
4. The keys are created automatically

Checking DMARC

# Check DMARC
dig _dmarc.example.com TXT +short

If DMARC is missing:

1. cPanel → Zone Editor → Manage
2. Add a TXT record:

_dmarc.example.com.  14400  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

Checking blocklists

Use the MXToolbox Blacklist Check:

1. Enter the IP address of your mail server
2. Check the blocklists
3. If you are listed, submit a removal request

Typical blocklists:

• Spamhaus
• SpamCop
• SORBS
• Barracuda

Email is going to spam

Checklist:

• The SPF record is set up correctly
• DKIM is enabled and working
• A DMARC policy is set
• Reverse DNS (PTR) is set up
• The IP is not on a blocklist
• The From address matches the domain
• No spam words in the subject
• The ratio of text to images is reasonable
• There is a way to unsubscribe

Checking email with Mail Tester:

1. Go to Mail-Tester.com
2. Send a test message to the address it gives you
3. Review the score and recommendations

Problem 3: A subdomain is not working

Symptoms

• blog.example.com does not open
• “DNS_PROBE_FINISHED_NXDOMAIN”

Diagnosis

# Check the subdomain's A record
dig blog.example.com A +short

# If it is empty - the A record is missing

Fix

1. cPanel → Domains
2. Make sure the subdomain has been created
3. Or create a new one:
   1. Click Create A New Domain
   2. Enter: blog.example.com
   3. Specify the Document Root
   4. Click Submit

1. Check the DNS record:
   1. Zone Editor → Manage
   2. Make sure there is an A record:

blog.example.com.  14400  IN  A  192.0.2.1

Problem 4: Slow DNS resolution

Symptoms

• The website loads slowly
• The first visit is slow, and later ones are fast
• dig shows a large Query time

Diagnosis

# Check the DNS response time
dig example.com | grep "Query time"

# Normal: 10-50ms
# Slow: 100-500ms
# Very slow: >500ms

Causes and fixes

A high TTL on NS records

Check:

dig example.com NS
# Look at the TTL of the NS records

Fix:

• NS records usually have a TTL of 48–72 hours (this is normal)
• Do not lower the NS TTL unless you need to

Slow DNS servers at your host

Fix:

• Use an external DNS service (Cloudflare, Route 53)
• Switch to managed DNS

DNS servers that are geographically far away

Fix:

• Use DNS with Anycast (Cloudflare, Google Cloud DNS)
• Or a CDN with DNS

Problems on your ISP’s side

Temporary fix: Use public DNS servers:

• Google: 8.8.8.8, 8.8.4.4
• Cloudflare: 1.1.1.1, 1.0.0.1
• Quad9: 9.9.9.9

On Windows:

1. Control Panel → Network and Internet
2. Network and Sharing Center
3. Change adapter settings
4. Properties → Internet Protocol Version 4 (TCP/IPv4)
5. Use the following DNS server addresses

On macOS:

1. System Preferences → Network
2. Advanced → DNS
3. Add the DNS servers

On Linux: Edit /etc/resolv.conf:

nameserver 1.1.1.1
nameserver 8.8.8.8

Problem 5: SERVFAIL error

Symptoms

• dig returns SERVFAIL
• The domain resolves intermittently

Diagnosis

# Check with detailed output
dig example.com

# In the HEADER, look at status: SERVFAIL

Causes and fixes

DNSSEC is set up incorrectly

Check:

# Check DNSSEC
dig example.com +dnssec

# If it shows SERVFAIL - the problem is DNSSEC

Fix:

1. If you do not use DNSSEC, turn it off at your registrar
2. If you do use it, check the DS records at your registrar
3. cPanel → Zone Editor → Advanced → DNSSEC
4. Make sure the DS records match

A circular CNAME dependency

An example of a faulty configuration:

www.example.com.  IN  CNAME  blog.example.com.
blog.example.com. IN  CNAME  www.example.com.

Fix:

• Correct the CNAME chain
• A CNAME must point to an A record, not to another CNAME

A problem with the NS servers

Check:

# Check that the NS servers are reachable
dig @ns10.hosting-telecom.uk example.com
dig @ns11.hosting-telecom.uk example.com

If an NS server is unreachable:

• Get in touch with our support team through the contact form

The SOA record is missing

Check:

dig example.com SOA

Fix:

• The SOA is created automatically by cPanel
• If it is missing, re-create the zone through WHM (this needs root access)

Problem 6: A wildcard SSL certificate is not working

Symptoms

• SSL works for the main domain
• SSL does not work for subdomains
• A “Certificate name mismatch” error

Diagnosis

# Check the certificate
openssl s_client -connect blog.example.com:443 -servername blog.example.com | openssl x509 -noout -text | grep DNS

# Look at the Subject Alternative Name

Causes and fixes

A wildcard A record instead of specific ones

The faulty configuration:

*.example.com.  IN  A  192.0.2.1

AutoSSL cannot validate wildcard domains with the HTTP-01 challenge.

Fix: Create a specific A record for each subdomain:

blog.example.com.  14400  IN  A  192.0.2.1
shop.example.com.  14400  IN  A  192.0.2.1
api.example.com.   14400  IN  A  192.0.2.1

You need a wildcard certificate

Fix:

• Buy a wildcard SSL certificate
• Or use the Let’s Encrypt DNS-01 challenge (this needs API access to your DNS)

Problem 7: DNS changes are not taking effect

Symptoms

• You changed the A record, but the website still opens from the old server
• dig shows the old IP

Diagnosis

# Check on different DNS servers
dig @8.8.8.8 example.com +short
dig @1.1.1.1 example.com +short
dig @ns10.hosting-telecom.uk example.com +short

# If ns10.hosting-telecom.uk shows the new IP
# and Google DNS shows the old one, the problem is the TTL/cache

Causes and fixes

The old TTL has not expired yet

Check:

# Check the TTL
dig example.com | grep -A1 "ANSWER SECTION"

# Look at the number after the domain (the TTL in seconds)

Fix:

• Wait for the old TTL to expire
• Next time, lower the TTL in advance (48–72 hours beforehand)

Working out how long to wait:

• TTL 14400 = 4 hours
• TTL 3600 = 1 hour
• TTL 300 = 5 minutes

Your ISP’s DNS cache

Fix:

1. Use a different DNS server (8.8.8.8, 1.1.1.1)
2. Or wait for the cache to expire
3. Clear your local DNS cache (see above)

The changes were made in the wrong place

Check:

# Check the NS servers
dig example.com NS +short

Make sure that:

• You are changing DNS on the correct NS servers
• The NS records in the zone match the NS at your registrar
• If the NS differ, make the change in the right place

Propagation has not finished yet

Check with WhatsMyDNS:

1. Open WhatsMyDNS.net
2. Enter the domain
3. Select the record type (A)
4. See how far the change has spread around the world

Typically:

• 50% in 2–4 hours
• 90% in 12–24 hours
• 100% in 48–72 hours

Problem 8: A CNAME is not working

Symptoms

• The CNAME record has been created, but does not resolve
• dig shows NXDOMAIN

Diagnosis

# Check the CNAME
dig www.example.com CNAME +short

# Check the chain
dig www.example.com +trace

Causes and fixes

A CNAME on the domain root (@)

The problem:

example.com.  IN  CNAME  other-domain.com.  # WRONG!

Fix: A CNAME cannot be used on the domain root. Use an A record:

example.com.  14400  IN  A  192.0.2.1

A CNAME conflicts with other records

The problem:

www.example.com.  IN  A      192.0.2.1
www.example.com.  IN  CNAME  other.com.  # CONFLICT!

Fix:

• Delete the A record and keep only the CNAME
• Or delete the CNAME and keep the A record

A CNAME points to a domain that does not exist

Check:

# If the CNAME points to target.com
dig target.com A +short

# If it is empty - target.com does not exist

Fix:

• Correct the CNAME to point to the right domain
• Or use an A record directly

A CNAME chain that is too long

The problem:

www.example.com.   IN  CNAME  cdn.example.com.
cdn.example.com.   IN  CNAME  cdn2.example.com.
cdn2.example.com.  IN  CNAME  cdn3.example.com.
... (10+ levels)

Fix:

• The maximum is 10–16 levels of CNAME (depending on the resolver)
• Simplify the chain
• Use a direct A record where possible

Problem 9: CAA is blocking SSL

Symptoms

• Let’s Encrypt cannot issue a certificate
• A “CAA records forbid issuance” error

Diagnosis

# Check the CAA records
dig example.com CAA +short

Fixes

CAA forbids Let’s Encrypt

Check:

dig example.com CAA
# Look at the issue and issuewild tags

Fix:

1. cPanel → Zone Editor → Manage
2. Find the CAA records
3. Add Let’s Encrypt:

example.com.  14400  IN  CAA  0  issue  "letsencrypt.org"
example.com.  14400  IN  CAA  0  issuewild  "letsencrypt.org"

CAA is set on the parent domain

Check:

# CAA is checked up the tree
dig subdomain.example.com CAA
dig example.com CAA

Fix:

• Add a CAA record at the level where it is blocking
• Or delete the restrictive CAA records

CAA with an empty value (a total ban)

The problem:

example.com.  IN  CAA  0  issue  ";"

This forbids ANY certificate from being issued.

Fix:

• Delete this CAA record
• Or replace it with a permissive one:

example.com.  IN  CAA  0  issue  "letsencrypt.org"

Problem 10: External DNS is not syncing

Symptoms

• You use Cloudflare, Route 53 or another DNS service
• Changes in cPanel are not taking effect

Fix

If you use external DNS (not cPanel):

1. Do NOT change DNS in the cPanel Zone Editor
2. Make all changes in:
   • The Cloudflare Dashboard
   • The AWS Route 53 Console
   • Google Cloud DNS
   • And so on

If the NS point to Cloudflare:

• All DNS is managed through Cloudflare
• The cPanel Zone Editor has no effect

Check the NS:

dig example.com NS +short

If it shows cloudflare.com or awsdns.com, you are using external DNS.

Problem 11: IPv6 (AAAA) is not working

Symptoms

• IPv4 works, IPv6 does not
• Some users cannot open the website

Diagnosis

# Check the AAAA record
dig example.com AAAA +short

# Check reachability over IPv6
ping6 example.com
curl -6 https://example.com

Fixes

The AAAA record is missing

Fix:

1. Find out the server’s IPv6 address
2. cPanel → Zone Editor → Manage
3. Add an AAAA record:

example.com.  14400  IN  AAAA  2001:db8:85a3::8a2e:370:7334

IPv6 is turned off on the server

Check:

# SSH to the server
ip -6 addr show

Fix:

• Get in touch with our support team through the contact form to have IPv6 enabled

The firewall is blocking IPv6

Fix:

• Check the firewall rules for IPv6
• Make sure ports 80/443 are open for IPv6

Useful diagnostic commands

A full domain check

#!/bin/bash
# A script for a full DNS check

DOMAIN="example.com"

echo "=== NS Records ==="
dig $DOMAIN NS +short

echo -e "\n=== A Records ==="
dig $DOMAIN A +short

echo -e "\n=== AAAA Records ==="
dig $DOMAIN AAAA +short

echo -e "\n=== MX Records ==="
dig $DOMAIN MX +short

echo -e "\n=== TXT Records (SPF/DKIM/DMARC) ==="
dig $DOMAIN TXT +short
dig default._domainkey.$DOMAIN TXT +short
dig _dmarc.$DOMAIN TXT +short

echo -e "\n=== CAA Records ==="
dig $DOMAIN CAA +short

echo -e "\n=== Query Time ==="
dig $DOMAIN | grep "Query time"

echo -e "\n=== Trace ==="
dig $DOMAIN +trace | tail -20

Monitoring DNS changes

# Monitor propagation every 5 minutes
while true; do
  clear
  echo "=== $(date) ==="
  dig example.com A +short
  dig @8.8.8.8 example.com A +short
  dig @1.1.1.1 example.com A +short
  sleep 300
done

Checking all subdomains

#!/bin/bash
# Check a list of subdomains

DOMAIN="example.com"
SUBDOMAINS=("www" "mail" "ftp" "blog" "shop" "api")

for sub in "${SUBDOMAINS[@]}"; do
  echo "=== $sub.$DOMAIN ==="
  dig $sub.$DOMAIN A +short
  echo ""
done

Diagnostic checklist

Use this checklist when you run into problems:

Basic checks

• The domain is registered and has not expired
• The NS records are correct
• The A record exists and points to the right IP
• The local DNS cache has been cleared
• Checked via different DNS servers (8.8.8.8, 1.1.1.1)

Email checks

• The MX records are set up
• The mail server is reachable (ports 25, 587, 993, 995)
• An SPF record exists
• DKIM is enabled
• DMARC is set up
• The IP is not on a blocklist
• PTR (reverse DNS) is set up

SSL checks

• An A record for the domain exists
• An SSL certificate is installed
• No CAA records are blocking it
• For wildcard SSL, specific A records exist for the subdomains

Subdomain checks

• The subdomain has been created in cPanel
• An A record exists for the subdomain
• The Document Root is correct
• SSL is set up for the subdomain (if needed)

After DNS changes

• The changes were made on the correct NS servers
• The TTL has been taken into account (waiting for the old TTL)
• Checked via WhatsMyDNS.net
• Propagation is being monitored
• Functionality has been checked after full propagation

When to contact support

Get in touch with us through the contact form if:

• The NS servers are unreachable
• You need a PTR record (reverse DNS) set up
• There are problems with ports (25, 80, 443)
• The web server will not start
• You need root access to make changes
• You have DNSSEC problems
• You need IPv6 enabled
• You are migrating between servers
• You are recovering from a hack

Preventing problems

1. Document your changes — keep a DNS changelog
2. Lower the TTL before making changes — 48–72 hours in advance
3. Test before you apply — use the hosts file
4. Make backups — export the zone regularly
5. Monitor DNS — set up alerts for changes
6. Use uptime monitoring — UptimeRobot, Pingdom
7. Check the domain’s expiry date — set up reminders
8. Watch the blocklists — check your IP regularly

See also

• DNS records in detail
• DNS migration
• Setting up SPF/DKIM/DMARC
• Troubleshooting SSL problems

External links

• WhatsMyDNS — Global DNS Checker
• MXToolbox — DNS & Email Diagnostics
• IntoDNS — DNS Health Check
• DNS Checker — DNS Propagation
• Mail Tester — Email Deliverability