菜单
Local DNS resolution troubleshooting with dig/resolvectl/whois. Investigate NXDOMAIN, wrong answers, records not taking effect, and resolver failures. Read-only; do not change DNS config. Also matches Chinese requests such as DNS 解析失败、域名解析不了、NXDOMAIN、解析不到.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/AI-Shell-Team/aish --skill dns-diagnose命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | dns-diagnose |
| version | 1.0.0 |
| description | Local DNS resolution troubleshooting with dig/resolvectl/whois. Investigate NXDOMAIN, wrong answers, records not taking effect, and resolver failures. Read-only; do not change DNS config. Also matches Chinese requests such as DNS 解析失败、域名解析不了、NXDOMAIN、解析不到. |
| author | aish |
| context | subagent |
| agent | troubleshoot |
| allowed-tools | ["bash","read_file","grep","glob"] |
| triggers | ["dns-diagnose","DNS diagnosis","DNS resolution failed","NXDOMAIN","cannot resolve domain","DNS not working","domain resolve","DNS 诊断","DNS 解析失败","域名解析不了","解析不到"] |
| platforms | ["linux"] |
| distributions | ["deepin","debian","ubuntu","uos"] |
Troubleshoot domain resolution failures, wrong answers, or “I changed the record but it still fails” on this host.
Out of scope: editing /etc/resolv.conf or NetworkManager by default, buying domains / changing authoritative DNS for the user, HTTP 5xx, or TLS certificate issues (ssl-cert-toolkit). Path quality after resolve succeeds belongs to network-path-diagnose.
dig; else host / nslookup / getent.+trace, or whois.Confirm domain & symptom → local resolver → local dig → optional external checks → answer
| Input | Notes |
|---|---|
| Domain | e.g. example.com or www.example.com |
| Symptom | total failure / wrong answer / recent change not visible / only on some networks |
| Record type | default A/AAAA; include MX if mail-related |
cat /etc/resolv.conf 2>/dev/null
resolvectl status 2>/dev/null || systemd-resolve --status 2>/dev/null || true
getent ahosts <domain> | head -10
grep '^hosts:' /etc/nsswitch.conf 2>/dev/null
grep -E "^\s*[0-9a-fA-F:.]+\s+.*\b<domain>\b" /etc/hosts 2>/dev/null || true
| Observation | Lean toward |
|---|---|
getent works, browser fails |
| App/proxy/DoH; not only system DNS |
Bad /etc/hosts entry | Local hijack |
| No nameserver / broken resolved | Local resolver config |
command -v dig
dig +noall +answer +stats <domain> A
dig +noall +answer <domain> AAAA
Without dig: host <domain> or nslookup <domain>.
| Status | Meaning |
|---|---|
| NXDOMAIN | Name/label missing (or not delegated) |
| NOERROR with empty answer | No records of that type |
| SERVFAIL / timeout | Upstream / network / firewall |
Stop here if this explains the symptom.
Use when still needed (after consent for sensitive/internal names):
dig @1.1.1.1 +noall +answer <domain> A
dig @8.8.8.8 +noall +answer <domain> A
dig +trace <domain> A | tail -40
dig NS <apex> +short
dig @<auth-ns> <domain> A +noall +answer
command -v whois && whois <apex> | head -60
| Status | Meaning |
|---|---|
| Different answers across resolvers | Cache / propagation / split-horizon (check TTL) |
| System resolver fails, public DNS works | Local upstream DNS problem |
No cloud DNS vendor APIs.
## Conclusion
1–2 sentences: local resolver / missing record / cache / upstream failure.
## Evidence
- Local nameserver / hosts / getent
- dig (or fallback) status and answers; system vs public DNS
- TTL / authority check if done
## Recommendations
- Action targets (change DNS, fix hosts, wait for TTL, update zone at registrar)
- Do not change config by default
Reply in the user's language.
| Case | Skill |
|---|---|
| Resolves but path is slow/lossy | network-path-diagnose |
| HTTPS certificate errors | ssl-cert-toolkit |
| Whole-host lag | diagnose_system_lag |
User: Browser cannot find xxx.com
getent + dig xxx.com A