Start with the question and the reply status
A DNS reply is a structured response to a DNS query. Many lookup tools display four named sections: question, answer, authority, and additional. Before reading the records, check the reply status and the name and record type that were requested. Those details provide the context for everything else in the message.
The question section usually repeats the requested name, type, and class. For example, a query might ask for the A record of www.example.com in the IN class. A means an IPv4 address; IN is the class used for ordinary internet DNS lookups. If you expected an MX record or a different hostname, fix that mismatch before interpreting the rest of the reply. The reply status also matters: NOERROR means the query was processed without that kind of error, not necessarily that the requested record exists. NXDOMAIN means the queried name does not exist according to the response.
Read the answer section for records addressing the question
The answer section holds records presented as the response to the question. For an A query, it may contain an A record mapping the requested name to an IPv4 address. A lookup for www.example.com could, in a hypothetical example, return an A record with 192.0.2.10. The record also has a time to live, or TTL, which tells a caching resolver how long it may keep that record before asking again.
An answer is not always a single record of the requested type. A name may first have a CNAME record pointing to another name, followed by an address record for that target. Multiple address records may also appear. Read each record’s owner name and type rather than treating every address shown as a direct record for the original name. If the answer section is empty, keep reading: the reply may be a referral, or it may indicate that the name exists but has no record of the requested type.
Use the authority section to understand responsibility
The authority section provides information about which DNS servers are responsible for a zone or, in some negative replies, information that supports the absence of an answer. Its meaning depends on the kind of response. In a referral, an NS record in this section points toward the nameservers for a delegated zone. The server replying is effectively directing the lookup onward rather than supplying the final record.
An SOA record in the authority section often appears with a negative response, such as NXDOMAIN or a NOERROR response that has no record of the requested type. The SOA identifies the relevant zone and helps resolvers handle caching of negative answers. Do not read an NS or SOA record in this section as though it were the A, AAAA, or MX record you asked for. Also check whether a tool shows an authoritative-answer flag: a recursive resolver can return useful records it has obtained or cached without itself being authoritative for the name.
Treat the additional section as supporting information
The additional section can contain records that help a resolver use information elsewhere in the reply. Suppose a hypothetical parent zone refers a lookup to ns1.child.example.com for child.example.com. It might include an A record for ns1.child.example.com in the additional section, so the resolver has an address to try. In a delegation like this, such an address record is commonly called glue. It supports the referral; it is not an address answer for the original hostname being looked up.
You may also see an OPT entry in a lookup tool’s additional section. OPT is part of EDNS, which carries DNS protocol options; it is not a normal hostname record. The additional section is optional, and its contents are not automatically the requested answer. When troubleshooting, keep track of which name each record belongs to and why it might have been included.
Put the sections together when troubleshooting
A useful reading order is: confirm the question, check the status, inspect the answer, then use the authority and additional sections to explain what happened. If an A query has a matching A record in the answer section, you have an address response to examine. If the answer is empty but the authority section lists NS records for a delegated zone, you may be looking at a referral. If the status is NOERROR, the answer is empty, and the authority section contains an SOA, the name may exist without the type you requested. With NXDOMAIN, the issue is the queried name itself, not merely a missing A record.
Finally, remember that a reply is one view of a lookup. Results can differ depending on which server you ask, what it has cached, and whether you query a recursive resolver or an authoritative server. Comparing those responses can help locate a problem, but first identify what each section actually says. That simple habit prevents a supporting nameserver address, a delegation, or an empty answer from being mistaken for the final result.
