DNS_PROBE_FINISHED_NXDOMAIN: Causes and How to Fix It

DNS_PROBE_FINISHED_NXDOMAIN means that the DNS query finished with the conclusion that the requested name does not exist. The cause may lie in the visitor's device, the network resolver, or the authoritative configuration of the domain. Before changing any records, find out if the error affects one person or everyone.

Direct Response

Test the domain on another network and check its records with nslookup or dig. If only one device fails, review the typed name, VPN, proxy, hosts file, and DNS cache. If all fail, confirm the domain's expiration, nameservers at the registrar, A/AAAA/CNAME records, and DNSSEC. Then wait for the caches respecting the TTL.

Step 1: Determine the Scope

Ask:

• Does the entire domain fail or just www?
• Does it work on 4G and fail on Wi-Fi?
• Did it start after changing hosting or DNS?
• Do other people and regions reproduce the issue?
• Is the domain active at the registrar?

If only one machine fails, do not start by changing nameservers. If public queries return NXDOMAIN, clearing the local browser will not fix the domain.

Step 2: Query the DNS

On Windows:

nslookup exemplo.com
nslookup www.exemplo.com 1.1.1.1

On Linux or macOS:

dig exemplo.com A
dig www.exemplo.com CNAME
dig exemplo.com NS
dig +trace exemplo.com

Compare resolvers. NXDOMAIN indicates a non-existent name; SERVFAIL often points to validation failure or server issues; timeout indicates no response was received. Do not treat all as the same problem.

Step 3: Device Fixes

Confirm the date and time, temporarily disable the authorized VPN or proxy, and test another browser. Check the hosts file for an old entry. On Windows, clear the cache:

ipconfig /flushdns

Restart the browser. Changing the resolver to a public service can serve as a test, but respect the company's policy. Do not disable security permanently.

Step 4: Domain Owner Fixes

At the registrar, confirm status and expiration. The delegated nameservers need to be exactly those provided by the DNS provider. In the zone, create the expected records for the root domain and subdomains.

Do not create a CNAME at the root domain if the provider does not support flattening. Avoid two conflicting records and remove incorrect IPv6 addresses when the server does not accept IPv6.

Step 5: Investigate DNSSEC

An inconsistent DNSSEC signature can produce SERVFAIL, not necessarily NXDOMAIN. If the DNS provider changed, confirm that the DS record at the registrar matches the new zone. Do not disable DNSSEC as a trial without recording the previous configuration and understanding the impact.

Propagation and TTL

DNS does not "propagate" by a single clock. Resolvers store responses until the TTL, including negative responses. After the fix, some visitors may continue to see the error until the cache expires. Reducing TTL before a planned migration helps; reducing it afterward does not clear existing caches.

Domain Checklist

• active and non-expired domain;
• correct nameservers at the registrar;
• zone marked as active at the provider;
• root domain and www records present;
• destinations matching those provided by hosting;
• coherent DNSSEC;
• queries in different resolvers returning the expected IP;
• HTTPS tested only after DNS resolves.

After restoring the domain, check the site speed and monitor API errors.

Frequently Asked Questions

How long does it take to come back?

It depends on the TTL and previous caches. The fix may appear in minutes for some resolvers and later for others.

Does formatting the computer solve it?

It is not a proportional measure. Perform cache, network, and DNS tests before any invasive action.

Primary Sources

• Cloudflare DNS: DNS_PROBE_FINISHED_NXDOMAIN
• ICANN: how DNS works
• Google Public DNS: troubleshooting