DNS_PROBE_FINISHED_NXDOMAIN: causes and fixes

What the error means

Before a browser can connect to a website, it asks the Domain Name System for the address behind the name. NXDOMAIN is the DNS answer "this name does not exist". Chrome shows it as DNS_PROBE_FINISHED_NXDOMAIN ("This site can't be reached"), Firefox as "Hmm. We're having trouble finding that site", Safari as "Safari can't find the server". No connection was attempted; the browser never got an address to connect to.

That is good news in one way: the web server is not involved at all. The problem is in DNS, either on the visitor's side (a typo, a stale cache, a resolver that is wrong) or on the owner's side (the domain or its records are gone).

Common causes

On the visitor's side

1. A typo in the address, or a link to a domain that no longer exists.
2. A DNS cache on the computer, in the browser or in the router that still holds an old "does not exist" answer.
3. A resolver that cannot reach the internet, a VPN or a corporate network that blocks the domain, a parental filter.
4. Antivirus or "web protection" software that intercepts DNS.

On the owner's side

5. The domain has expired. The registrar removes the nameservers at expiry, and from that moment the name does not exist. Most common cause for a site that worked yesterday.
6. The A or AAAA record is missing. After a move to a new host or a new DNS provider, the record for www or for the bare domain was never created.
7. Nameservers changed but the zone is empty. You pointed the domain at Cloudflare or a new host, but did not copy the records there first.
8. A subdomain that was never set up. shop.example.com returns NXDOMAIN because there is no record for shop, while example.com works.
9. DNSSEC broken. A wrong DS record at the registrar after a provider change makes validating resolvers (most of them today) return a failure, which browsers show as NXDOMAIN or a similar error.
10. Propagation. You just changed nameservers; some resolvers still see the old, now empty zone. Takes up to the TTL, in the worst case 24 to 48 hours.

If you are a visitor

1. Check the spelling of the address and try it with and without www.
2. Flush the DNS cache: Windows ipconfig /flushdns, macOS sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder, Linux sudo resolvectl flush-caches. In Chrome, open chrome://net-internals/#dns and click "Clear host cache".
3. Restart the router, or try the site on your phone with Wi-Fi off. If it works there, your network's resolver is the problem.
4. Switch the resolver to a public one (1.1.1.1 or 9.9.9.9) in the network settings.
5. If none of that helps, the domain is really gone or broken, and only its owner can fix it.

If it is your site: check first

Run the website down checker: it tells you whether the domain resolves from a neutral location. If it does not, continue here. If it does, the problem is on your visitor's side; send them the list above.

Then look at the domain itself:

# does the name resolve, and who answers?
dig +short example.com A
dig +short www.example.com A
dig example.com NS +short

# ask the authoritative nameserver directly (skips every cache)
dig @ns1.your-dns-provider.com example.com A

# registration status and expiry date
whois example.com | grep -iE 'expir|status'

An empty answer from dig with status: NXDOMAIN in the full output means the record does not exist at the authoritative server. whois showing a status like clientHold, redemptionPeriod or pendingDelete means the registration is the problem, not the records.

# DNSSEC: a broken chain shows up as SERVFAIL on validating resolvers
dig @1.1.1.1 example.com A +dnssec | grep -E 'status|flags'

Fixes for site owners

1. Expired domain

Log in at your registrar and renew. Most registrars restore a domain within minutes after payment during the grace period (usually 30 days); in the redemption period after that, it costs a restore fee and takes longer. Set the domain to auto-renew and make sure the card on file is current; a domain that expires takes mail, website and every subdomain down at once.

2. Missing record

At your DNS provider, add the record that is missing. For a website this is typically:

example.com.      A      203.0.113.10
www.example.com.  CNAME  example.com.

Use the IP of your web server (hostname -I on the server, or the address your host gave you). If the server has IPv6, add an AAAA record too, or remove the broken one if the server has none. Changes take effect within the record's TTL, usually 5 minutes to an hour.

3. Empty zone after a nameserver change

Before you switch nameservers, export the zone from the old provider (dig example.com AXFR @old-ns rarely works; most providers have an export button) and import it at the new one. If you already switched: recreate the records at the new provider; A for the bare domain and www, MX and TXT for mail, and any subdomains you use. The old provider often still shows you the list.

4. DNSSEC

If dig +dnssec returns SERVFAIL while the plain query at the authoritative server works, the DS record at the registrar does not match the keys at the DNS provider. Either remove DNSSEC at the registrar (remove the DS record) until both sides are set up together, or copy the new DS record from the DNS provider to the registrar.

5. On your own server

Nothing on the web server causes NXDOMAIN, so there is nothing to restart. Still check that your server's own resolver works, because a server that cannot resolve names fails at updates, mail and API calls:

resolvectl status | head -20
dig +short example.com @127.0.0.53

When it is your host's problem

If your host also runs your DNS (common with shared hosting), and the records look right in their panel but still do not resolve from outside, send them:

Hello, my domain example.com does not resolve (NXDOMAIN) since about 11:00 UTC. The records in the control panel look correct and the domain is registered until 2027. Could you check the DNS zone on your nameservers and whether the domain is still delegated to them?

Preventing the next one

NXDOMAIN on your own domain is almost always the expiry you forgot or the record you did not copy. A DNS monitor compares your records against the values you expect and alerts you the moment one disappears or changes; a website check from outside catches the moment the name stops resolving. Both are part of website monitoring, free for the first 50 monitors. And if the records live on your own server, a deep fix restores them.