Common DNS Errors Explained

DNS errors happen when the Domain Name System cannot complete a request as expected. They can prevent a website from loading, stop emails from reaching their destination, or cause applications and online services to become unavailable.

Some DNS errors are temporary. Others point to incorrect DNS records, unavailable name servers, DNSSEC problems, or configuration mistakes.

The good news is that they usually provide clues about what went wrong.

In this guide, we will explain the most common DNS errors, what they mean, why they happen, and how you can troubleshoot them.

What Is a DNS Error?

DNS translates domain names such as example.com into IP addresses that computers use to communicate.

When you enter a domain in your browser, your device sends a DNS query. A DNS resolver then tries to find the correct answer.

If something goes wrong during this process, the DNS server may return an error code instead of the expected DNS record.

For example, the server may report that:

• the domain does not exist
• it cannot complete the query
• it refuses to answer
• the request is incorrectly formatted
• no response arrived in time

Understanding these responses can make DNS troubleshooting much easier.

1. NXDOMAIN

NXDOMAIN stands for Non-Existent Domain.

It means the DNS server could not find the requested domain name or hostname.

For example, if you request:

shop.example.com

but that hostname does not exist in DNS, the server may return NXDOMAIN.

Common causes of NXDOMAIN

NXDOMAIN can occur because of:

• a misspelled domain name
• a missing DNS record
• an expired or unregistered domain
• incorrect DNS configuration
• a deleted subdomain
• cached negative DNS responses

It can also appear in browsers as an error such as:

DNS_PROBE_FINISHED_NXDOMAIN

How to troubleshoot NXDOMAIN

First, check that the domain name is spelled correctly.

Next, verify that the domain is registered and has valid authoritative name servers.

You can also use tools such as dig or nslookup to check whether the hostname actually has DNS records.

If you recently created the record, remember that DNS changes may take time to propagate.

2. SERVFAIL

SERVFAIL means the DNS server tried to process the request but could not successfully return an answer.

Unlike NXDOMAIN, SERVFAIL does not necessarily mean the domain or record does not exist.

Instead, something prevented the DNS resolution process from completing.

Common causes of SERVFAIL

Possible reasons include:

• unavailable authoritative name servers
• DNSSEC validation failures
• broken DNS delegation
• misconfigured DNS servers
• network communication problems
• temporary resolver issues

DNSSEC problems are a particularly common reason for SERVFAIL.

For example, if a domain publishes incorrect DNSSEC information, a validating resolver may reject the DNS response instead of returning potentially untrusted data.

How to troubleshoot SERVFAIL

Try querying the domain through more than one DNS resolver.

You can also use dig to check individual parts of the DNS chain.

If DNSSEC is enabled, verify the DS and DNSKEY records carefully.

You should also confirm that the authoritative name servers are online and responding correctly.

3. REFUSED

A REFUSED response means the DNS server received your request but decided not to process it.

In other words, the server is reachable, but its configuration or security policy prevents it from answering the query.

Why does DNS return REFUSED?

Common reasons include:

• the DNS server does not allow queries from your IP address
• recursion is disabled
• access control rules block the request
• the server is not authoritative for the requested zone
• zone transfers are restricted

For example, authoritative DNS servers often refuse recursive queries because their job is to answer only for the zones they host.

A REFUSED response does not always indicate a problem. It may simply mean that the server is working according to its security policy.

How to troubleshoot REFUSED

Check whether you are querying the correct DNS server.

If you manage the server yourself, review its access control and recursion settings.

For zone transfer requests, make sure the requesting server is authorized.

4. FORMERR

FORMERR stands for Format Error.

It means the DNS server received a query that it could not understand because the request was incorrectly formatted.

This error is less common for regular users because DNS applications normally generate valid queries automatically.

Common causes of FORMERR

It may occur because of:

• malformed DNS packets
• incompatible DNS software
• incorrect EDNS configuration
• unusual or unsupported query options

If FORMERR occurs repeatedly, investigate both the DNS client and server software involved.

Updating outdated DNS software may also help resolve compatibility problems.

5. NOTIMP

NOTIMP means Not Implemented.

The DNS server understood the request but does not support the requested operation.

For example, a client may ask the server to perform a DNS function that the server software does not implement.

This response is uncommon during normal website browsing but may appear when using advanced DNS tools or uncommon query types.

6. DNS Timeout

A DNS timeout happens when a resolver sends a query but does not receive a response within the expected time.

Unlike NXDOMAIN or SERVFAIL, a timeout may not return a formal DNS response code at all.

Common causes of DNS timeouts

DNS queries may time out because of:

• unavailable DNS servers
• network connectivity problems
• firewall rules
• packet loss
• overloaded servers
• DDoS attacks
• incorrect name server configuration

One slow or unavailable authoritative server can also delay the entire lookup process.

How to troubleshoot DNS timeouts

Try querying another resolver.

Then check whether the authoritative name servers respond directly.

You should also review firewall settings and confirm that DNS traffic can use both UDP and TCP on port 53 when required.

Why Do DNS Errors Happen?

Most DNS errors come from a few common areas.

• Incorrect DNS Records

A missing or incorrect A, AAAA, CNAME, MX, or other DNS record can prevent a hostname from resolving properly.

• Nameserver Problems

If authoritative name servers are unavailable or configured incorrectly, resolvers may not be able to retrieve DNS information.

• DNSSEC Misconfiguration

Incorrect DNSSEC settings can make valid DNS records appear untrustworthy to validating resolvers.

• DNS Propagation

After changing DNS records or name servers, different resolvers may temporarily return different answers because cached records have not yet expired.

• Network Problems

Firewalls, routing problems, server outages, and packet loss can all interfere with DNS communication.

How to Troubleshoot DNS Errors

When you encounter a DNS problem, follow a simple process instead of changing multiple settings at once.

1. Check the Domain Name

Start with the simplest possibility: make sure the domain or hostname is correct.

2. Check the DNS Records

Verify that the expected A, AAAA, CNAME, MX, or other records exist and contain the correct values.

3. Check the Name Servers

Confirm that the domain points to the correct authoritative name servers and that those servers respond.

4. Use Dig or NSlookup

Command-line tools such as dig and nslookup can show the exact response returned by DNS servers.

For example:

dig example.com

The result may reveal NXDOMAIN, SERVFAIL, REFUSED, or another response.

5. Test Different DNS Resolvers

Try public resolvers or another network.

If one resolver fails while others work correctly, the issue may be related to caching or resolver configuration.

6. Check DNSSEC

If the domain uses DNSSEC and returns SERVFAIL, verify that the DNSSEC chain is configured correctly.

7. Run a DNS Check

A DNS lookup or audit can help you review records, name servers, and other parts of the domain’s DNS configuration in one place.

Conclusion

DNS errors may look confusing at first, but the response usually gives you an important clue.

NXDOMAIN usually means the requested name does not exist. SERVFAIL means the server could not successfully complete the query. REFUSED means the server chose not to answer, while timeouts often point to connectivity or availability problems.

The best way to troubleshoot DNS is to work step by step. Check the domain, review its DNS records, verify the authoritative name servers, and use tools such as dig, nslookup, or a DNS audit to identify where the problem begins.

Once you understand the most common DNS errors, diagnosing DNS problems becomes much faster and easier.