Why DNS Returns NXDOMAIN
Users attempting to connect to a website receive "DNS_PROBE_FINISHED_NXDOMAIN" in Google Chrome or "Host not found" in terminal utilities. The authoritative server or recursive resolver responds with RCODE 3 (NXDOMAIN), asserting that the requested domain name does not exist.
DNS_PROBE_FINISHED_NXDOMAIN (RCODE 3: Non-Existent Domain).Why does Why DNS Returns NXDOMAIN occur?
Primary Root Cause
The DNS resolver followed the hierarchy from root (.) to TLD (.com) down to the authoritative nameserver, and received an authenticated response that the hostname has no record in the zone. If the root or TLD has no delegation records for the apex domain, the TLD itself returns NXDOMAIN.
When an authoritative server returns NXDOMAIN, it includes the zone’s SOA (Start of Authority) record. Resolvers cache this negative response for the duration specified in the SOA’s minimum TTL field (RFC 2308). Therefore, even after adding the missing record, clients remain blocked until the negative cache expires.
How to Confirm You Are Facing This Exact Issue
Chrome displays "DNS_PROBE_FINISHED_NXDOMAIN" with "This site can’t be reached".
Terminal command "dig example.com" shows "status: NXDOMAIN, id: ... flags: qr rd ra".
Outgoing emails bounce with "550 5.1.2 Host or domain name not found".
Subdomains (e.g., api.example.com or blog.example.com) fail while the apex domain works.
Explicit Diagnostic Reasoning
Follow these diagnostic checks to pinpoint why the domain cannot be found:
"If WHOIS lookup shows status "clientHold" or "serverHold""
Your domain registrar suspended the domain due to unverified ICANN registrant email or payment failure.
→ Log into your registrar dashboard, verify contact information, and resolve account flags.
"If the apex domain (example.com) works but a subdomain (api.example.com) returns NXDOMAIN"
You omitted the A or CNAME record for that specific subdomain in your DNS control panel.
→ Add an A record pointing to your server IP or a CNAME pointing to your service provider.
"If dig +cdflag returns the IP address, but standard dig returns SERVFAIL or NXDOMAIN"
DNSSEC validation has failed because the DS record at the registrar does not match the active DNSKEY in the zone.
→ Disable DNSSEC at your registrar temporarily or update the DS record with the new public key digest.
"If the domain was purchased within the last 2 hours"
TLD nameservers have not yet completed registry zone synchronization for your delegation records.
→ Wait 1 to 4 hours for registry-level zone file propagation.
Traces resolution from root servers down to your authoritative server step-by-step to detect exactly which hierarchy level returns NXDOMAIN.
Long-Term Engineering Solution
Ensure registrar active status, verify authoritative nameserver delegation, populate missing host records in the zone file, and purge negative resolver cache.
Architectural Pattern
Set reasonable SOA Negative Caching TTLs (e.g., 300 to 900 seconds) so accidental misconfigurations or newly provisioned subdomains do not get cached negatively for days.
How do you fix this step-by-step?
Inspect Domain Registration Status with WHOIS
Check if the domain is active, paid, and has valid registered nameservers.
whois example.com | grep -E "Domain Status|Name Server"Verify Zone Records at the Authoritative Server
Query the authoritative nameserver directly to see if the record exists in your DNS host provider.
# Replace ns1.yourdnsprovider.com with your real nameserver
dig @ns1.yourdnsprovider.com api.example.com AAdd Missing A or CNAME Record
In your DNS management dashboard (Cloudflare, AWS Route 53, Namecheap, etc.), create the missing record.
Type: A
Name: api (or api.example.com)
Value: 198.51.100.25
TTL: 300 (or Auto)
-- OR for PaaS/Vercel/Heroku --
Type: CNAME
Name: api
Value: cname.vercel-dns.com.
TTL: 300Flush Public DNS Negative Cache
Purge Cloudflare and Google public DNS caches so you do not have to wait for the SOA negative TTL to expire.
# Purge Cloudflare public cache via web:
# https://1.1.1.1/purge-cache/
# Purge Google public cache via web:
# https://dns.google/cacheWhat are common misconceptions and mistakes when fixing this?
Putting the full hostname "api.example.com" into a DNS dashboard that expects only "api".
Perché fallisce: Many registrars automatically append your domain name. Entering "api.example.com" creates a record for "api.example.com.example.com", leaving the intended subdomain nonexistent.
✓ Alternativa corretta: Enter only the subdomain prefix "api" in the host field unless explicitly asked for a fully qualified domain name (FQDN) ending in a dot.
Migrating DNS providers without updating or disabling the registrar’s DNSSEC DS record.
Perché fallisce: If the registrar still advertises old DS keys, validating resolvers reject all responses from the new provider as tampered, returning NXDOMAIN or SERVFAIL.
✓ Alternativa corretta: Delete DS records at your registrar before switching nameservers, and re-enable DNSSEC once the new zone is active.
Adding a CNAME record at the root apex domain (example.com).
Perché fallisce: RFC 1034 forbids a CNAME at the zone apex because CNAME cannot coexist with SOA and NS records.
✓ Alternativa corretta: Use an A/AAAA record or DNS providers that support CNAME flattening / ALIAS / ANAME records at the apex.
Can this fix introduce security vulnerabilities?
NXDOMAIN responses on known domains can signal DNS hijacking, registrar account compromises, or vulnerability to subdomain takeover.
Security Risks If Ignored
- •Subdomain Takeover: If a CNAME points to a decommissioned AWS S3 bucket or GitHub Pages site returning NXDOMAIN, an attacker can register that bucket and hijack traffic.
- •Registrar Hijacking: Attackers transferring expired domains out from under the legitimate organization.
- •Denial of Service (DoS): Misconfigured negative caching locking users out for the duration of the SOA TTL.
Hardening Best Practices
- ✓Audit all dangling CNAME and ALIAS records regularly with automated vulnerability scanners.
- ✓Enable Registrar Lock (Transfer Lock) and Registry Lock to prevent unauthorized nameserver changes.
- ✓Ensure ICANN registrant email address is monitored and verified annually.
Diagnosing an NXDOMAIN via dig Response Headers
$ dig api.example.com
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 48123
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; AUTHORITY SECTION:
example.com. 1800 IN SOA ns1.example.com. hostmaster.example.com. (
2026100501 ; serial
7200 ; refresh
3600 ; retry
1209600 ; expire
3600 ; negative caching TTL (1 hour!)
)$ dig api.example.com
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19482
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; ANSWER SECTION:
api.example.com. 300 IN A 198.51.100.25Frequently Asked Questions About Why DNS Returns NXDOMAIN
What is the difference between NXDOMAIN and SERVFAIL?↓
NXDOMAIN means the authoritative server replied that the name does not exist. SERVFAIL means the resolver encountered an error (like a timeout or DNSSEC failure) trying to find the answer.
NXDOMAIN (RCODE 3) is a definitive negative statement from authoritative infrastructure. SERVFAIL (RCODE 2) indicates an infrastructure breakdown, such as unreachable nameservers, network packet loss, or a broken DNSSEC signature chain.
Why does NXDOMAIN stay cached even after I fixed the DNS record?↓
Resolvers cache negative answers according to RFC 2308 using the minimum TTL value defined in the zone’s SOA record.
To prevent servers from being bombarded by queries for non-existent domains, resolvers store negative responses. If your SOA minimum TTL is set to 3600, recursive resolvers will not check again for 1 hour unless manually purged.
Can an expired domain cause NXDOMAIN?↓
Yes. When a domain expires, registrars replace authoritative nameservers with parking servers or suspend resolution with clientHold status.
Once the grace period ends, nameserver glue records are stripped from the parent TLD registry zone, resulting in immediate NXDOMAIN across all global resolvers.