- Use NS to see the domain’s published nameservers and compare them with the registrar’s delegation. Edit the zone at the active DNS host, which may differ from the registrar or web host.
- Check the exact name and type: A/AAAA for addresses, CNAME for aliases, MX for incoming mail, TXT for verification and mail policy, SRV for provider service discovery, SOA for zone metadata, and CAA for permitted certificate issuers.
- Watch for editors that append the domain automatically. Names such as
_dmarcorselector._domainkeyare usually entered relative to the zone, but interfaces vary. - Save the old values before editing. Change only the records your provider identifies. Replacing an entire zone can break websites, verification and other services.
- Allow the previous TTL to expire. A resolver can cache old values or negative answers; reducing the TTL after a change does not erase old caches.
NXDOMAIN means the queried name was reported nonexistent. An empty answer means the requested type was not returned. A resolver failure is inconclusive; it can involve DNSSEC or nameserver problems and is not proof that a record is absent.
This tool shows Google Public DNS’s view, not a global propagation map. A DNSSEC validation indicator is useful context, not a security verdict about the domain.
References: resolver response fields and SRV records.