Networking

Common DNS Errors and How to Fix Them

DNS errors are the #1 cause of 'site is broken' tickets that aren't actually about the site. Here's how to identify each error code, what causes it, and the exact fix.

The errors you'll actually see

DNS_PROBE_FINISHED_NXDOMAIN — domain doesn't exist (or nameservers aren't answering). Verify spelling, registration status, and NS records.
DNS_PROBE_FINISHED_NO_INTERNET — your local network can't reach any DNS server. Restart router; try a public resolver like 1.1.1.1.
SERVFAIL — the authoritative server returned an error. Check DNSSEC, NS configuration, and registrar status.
NXDOMAIN intermittent — usually one of multiple NS servers is misconfigured. Query each NS individually.
Propagation delay — the change worked, but cached resolvers haven't caught up. Wait the TTL.

Configuration mistakes that bite later

Setting TTL to 86400 (24h) before a planned migration. Lower to 300 days in advance.
Forgetting to add `www` as a separate A record or CNAME.
Mixing CNAME and other records on the same name (RFC violation).
Using DNS round-robin as a load balancer — clients don't actually load-balance well.
Letting domain registration auto-renew fail because the credit card expired.

How to verify a DNS change actually worked

Don't trust your local browser. Query a public resolver directly (the tool above uses Cloudflare 1.1.1.1 over DoH). If the answer matches your intent there, the authoritative side is correct — anything different downstream is just caching, and it'll resolve within the TTL.

Recommended next steps

Diagnostic workflow

1
Lookup the failing record
Query the specific record type the error mentions (A, MX, NS).
DNS Lookup
2
Verify nameservers respond
Query the NS record to confirm the domain's authoritative servers are alive.
Check NS
3
Test resolution speed
If lookups are slow, switch to a faster public resolver.
DNS Speed Test
4
Confirm the resolved IP responds
DNS may resolve fine but the destination server is down.
Server Status

Frequently asked questions

What does DNS_PROBE_FINISHED_NXDOMAIN mean?

Your resolver couldn't find the domain at all. Either the domain is misspelled, expired, or its nameservers aren't responding.

Why does my DNS change take so long to propagate?

Resolvers cache records for the duration of their TTL. Lower the TTL to 300 seconds at least 24 hours before any planned change so propagation is fast.

What's the difference between SERVFAIL and NXDOMAIN?

NXDOMAIN means the domain definitively doesn't exist. SERVFAIL means the resolver tried but couldn't get a usable answer (often due to DNSSEC validation failure or unreachable nameservers).

Why does dig show different results than my browser?

Different resolvers cache differently. Browsers also have their own DNS cache. Test with a public resolver (1.1.1.1, 8.8.8.8) to see authoritative-fresh results.

Should I use my ISP's DNS or a public one?

Public DNS resolvers (Cloudflare 1.1.1.1, Google 8.8.8.8, Quad9) are typically faster, more reliable, and don't log your queries the way some ISPs do.