Dig DNS Investigation Tool Checklist for System Admins
dig helps system admins inspect DNS records directly. DNS issues can make a healthy server look broken, especially during domain migration, Cloudflare setup, SSL issuance or server IP changes.
Core principle
DNS answers the question: where should this name go? Before debugging Nginx or WordPress, prove that the domain resolves to the expected place.
Checklist
- Check A record for root domain.
- Check www record.
- Check nameservers.
- Check CNAME records if used.
- Query multiple public resolvers.
- Check TTL when planning migration.
- Compare DNS result with VPS IP.
- Check whether Cloudflare proxy changes visible IP.
- Test DNS before SSL issuance.
- Document authoritative DNS provider.
Reusable lesson
dig applies to website migrations, SSL errors, CDN setup, email records, API subdomains, staging environments and cloud architecture troubleshooting.
When to Use This Checklist
Use this checklist when debugging domain pointing, DNS propagation, SSL issuance, Cloudflare behavior or website migration problems.
Required Tools
Terminal access, dig, domain name, expected VPS IP, DNS provider access, Cloudflare access if used
Before You Start
Know which DNS provider is authoritative before editing records. Editing the wrong DNS panel changes nothing.
Structured Checklist Steps
- Check root A record.
- Check www record.
- Check nameservers.
- Check CNAME.
- Query Google DNS.
- Query Cloudflare DNS.
- Compare with VPS IP.
- Review TTL.
- Check proxy behavior.
- Document DNS owner.
Verification Steps
- Domain resolves to expected target.
- Nameservers are correct.
- www behavior is understood.
- TTL is known.
- DNS layer is confirmed before server debugging.
Rollback Plan
If DNS points to the wrong IP, restore or update the record at the authoritative DNS provider and avoid unrelated server changes while propagation completes.
Common Mistakes
- Editing DNS at the wrong provider.
- Testing only one resolver.
- Confusing Cloudflare proxy IP with origin IP.
- Installing SSL before DNS is correct.
- Ignoring www records.
Related Commands
dig example.com
dig www.example.com
dig NS example.com
dig @8.8.8.8 example.com
dig @1.1.1.1 example.com
dig CNAME www.example.com