Query the name you actually published

Write the fully qualified owner name and record type before running a command. SPF normally uses TXT at the applicable sending identity. A DKIM key uses TXT or a provider-directed CNAME at selector._domainkey.example.com. DMARC uses TXT at _dmarc.example.com. Guessing from the zone apex can produce a valid answer for the wrong question.

With dig, a concise recursive query looks like:

dig TXT _dmarc.example.com

Record the status, answer section, TTL, resolver address, flags, and UTC time. Do not paste an entire terminal transcript into a public ticket if it includes internal resolver names.

Ask the authoritative servers directly

First discover the NS records for the zone. Then query one authoritative server explicitly:

dig NS example.com
dig @ns1.example.net TXT _dmarc.example.com

Replace ns1.example.net with an actual authoritative server from the delegation. If the authoritative answer is wrong, fix publication or delegation. If it is correct but a recursive resolver shows the older value, caching may explain the difference until relevant TTLs expire. A low TTL set after the old answer was cached does not retroactively shorten that cache entry.

Check the complete response

NXDOMAIN means the queried name does not exist; NOERROR with no requested answer is different. SERVFAIL can indicate validation, delegation, or resolver trouble and must not be translated into “record missing.” A CNAME adds another name to follow. Split TXT character strings may be presented as multiple quoted pieces while representing one logical record; use a parser that understands DNS wire data rather than joining arbitrary lines.

Compare from more than one useful vantage point

Query the resolver used by the affected system when you can do so safely, plus a controlled recursive resolver for comparison. Public web tools can add a third view, but they are not automatically authoritative and may retain submitted domain data.

Document the previous and intended values, change time, TTL observed before the change, and rollback value. Finish by sending a fresh message and checking receiver evidence. DNS output proves what a resolver answered; it does not prove that a specific old message authenticated or that every resolver has converged.