DNS quietly powers almost everything you do online — until something breaks.
When it’s misconfigured, websites go down, email stops working, and services become unreachable.
The tricky part is that many DNS issues are caused by a few common mistakes that we see over and over again.
The good news: once you know the red flags, most of them are quick to fix.
Check if your A/AAAA records point to the correct IP
One of the most common issues is a hostname pointing to the wrong IP address or an outdated server.
This leads to websites being unreachable or hostnames showing as offline.
Always verify your current server IP and make sure your A (IPv4) and AAAA (IPv6) records match it.
Use a lower TTL during migrations so changes propagate faster.
Avoid mixing CNAME with other record types on the same hostname
A CNAME record cannot coexist with A, MX, TXT or other records on the same hostname.
When this happens, you may see email routing issues, SSL/ACME validation failures, or inconsistent resolution.
If you need multiple record types, replace the CNAME with A/AAAA records or move the CNAME to a different hostname.
Make sure MX records point to valid mail servers
Misconfigured MX records often point to hostnames that don’t exist or don’t have A/AAAA records.
This results in bounced emails and “mail server not found” errors.
Confirm that each MX hostname resolves correctly and that priorities are set properly
(lower numbers mean higher priority). Avoid pointing MX directly to IP addresses.
Validate your SPF record and keep it within the lookup limit
SPF records that are malformed or that exceed the 10‑lookup limit can cause legitimate emails to be rejected.
Make sure the syntax is correct and that all legitimate sending services are included.
Consolidate mechanisms where possible to stay under the limit and regularly test your SPF record using online tools.
Publish DKIM keys exactly as provided by your mail server
DKIM failures often come from TXT records that are missing characters, have extra spaces,
or use the wrong selector name.
Always copy the DKIM value exactly as given by your mail system and double‑check the selector.
Even a small formatting error can cause “dkim=fail” in your email authentication results.
Use DMARC policies carefully — don’t start with “reject”
Setting a DMARC policy of p=reject before SPF and DKIM are stable can block legitimate email.
Start with p=none to collect reports and understand how your domain is being used.
Once you’re confident SPF and DKIM are correctly aligned, move to quarantine and only then consider reject.
Update NS records after registrar or DNS provider changes
After transferring a domain, it’s easy to forget to update the nameservers.
This leaves your domain pointing to old DNS zones and prevents new changes from taking effect.
Make sure your registrar’s NS records point to the correct DNS provider and verify that the zone is active and up to date.
Configure PTR (reverse DNS) for mail servers
Many mail providers check reverse DNS to verify that an IP address matches the sending hostname.
If PTR is missing or points to an unrelated name, your email may be rejected or flagged as suspicious.
Ensure the PTR record matches your mail server’s hostname and that this hostname has a valid A record.
You may need to work with your ISP or VPS provider to set PTR correctly.
Use appropriate TTL values, especially during changes
Very high TTL values (such as 24 hours or more) can slow down propagation when you update records.
During migrations or major changes, use a lower TTL (for example, 300–600 seconds)
so that resolvers pick up new values quickly.
Once everything is stable, you can increase TTL again to reduce DNS query load.
Clean up duplicate or overlapping records
Over time, DNS zones can accumulate duplicate MX, TXT, or other records that conflict with each other.
This can lead to unpredictable behavior and intermittent issues that are hard to diagnose.
Review your zone regularly, remove duplicates, and keep only the records you actively use.
A clean DNS zone is easier to manage and far more reliable.
Top 10 DNS misconfigurati...