How to Fix NXDOMAIN and SERVFAIL Errors

What the errors actually mean

NXDOMAIN — NXDOMAIN (Non-Existent Domain) is an authoritative answer: the nameserver responsible for the zone replied that the name does not exist. The lookup worked — there is simply no such record.

SERVFAIL — SERVFAIL is different: the resolver could not complete the lookup at all. Something between your resolver and the authoritative nameservers is broken — unreachable servers, a lame delegation, or a failed DNSSEC validation.

$ dig missing.example.com
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 21744

$ dig broken-dnssec.example.net
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 31921

Common causes of NXDOMAIN

• A typo in the domain or hostname (www vs. no-www, missing subdomain record)
• The record was never created — e.g. a CNAME for a subdomain is missing
• The domain has expired and was removed from the TLD zone
• The change has not propagated yet and an old negative answer is cached

Common causes of SERVFAIL

• All authoritative nameservers are down or unreachable
• Lame delegation — the NS records point to servers that do not host the zone
• DNSSEC validation failure — expired or mismatched signatures (very common after a migration)
• The zone was transferred to a new provider but the old NS records still linger at the registrar

Diagnose it in three steps

1. Check what the authoritative servers say

Run a lookup with the resolver set to “Authoritative NS”. If the authoritative answer is correct but public resolvers disagree, you are looking at caching or propagation, not a broken zone. → DNS Lookup

2. Compare resolvers worldwide

A propagation check across 18 resolvers tells you instantly whether the problem is global (zone broken) or partial (caches still expiring). → DNS Propagation

3. Verify the delegation chain and DNSSEC

DNS Trace walks from the root servers through the TLD down to your zone and shows where the chain breaks. If your domain is signed, a DNSSEC check will catch expired or missing signatures — the classic silent cause of SERVFAIL. → DNS Trace · → DNSSEC Check

Typical fixes

• Expired domain → renew it at the registrar; expect up to 24–48 h for the TLD zone to update
• Missing record → add it at your DNS provider and keep the TTL at 300–3600 s
• Lame delegation → make the NS records at the registrar match the servers that actually host the zone
• DNSSEC failure → re-sign the zone or update the DS record at the registrar; if you migrated providers, remove the stale DS first
• Stale negative cache → wait out the SOA minimum TTL, or query a different resolver to confirm the fix is live