Start with the question the client asked
Filter for DNS, identify the client and resolver, and confirm the queried name. If no query appears, check the capture location, cached answers, and encrypted DNS before blaming the endpoint. If a request has no visible response, check the capture scope, path, and resolver. A valid response shifts attention to what the client does next.
Read the answer—not just the packet count
Check the response code, returned records, TTL, and response time. NXDOMAIN, SERVFAIL, an unexpected address, and a slow but successful response represent different problems and should lead to different tests.
Follow resolution into the connection
After a successful answer, filter on the returned address and inspect the TCP or TLS session. This separates a DNS problem from a service, routing, firewall, or certificate problem—and keeps troubleshooting grounded in evidence.