TechCompare LogoTechCompare
Showing centimeters. Press to switch to inches.Showing inches. Press to switch to centimeters.

What does NXDOMAIN mean? No such name vs no records vs SERVFAIL

By TechCompare · Updated · How we check

NXDOMAIN means the name doesn't exist. An empty answer means it exists without that record type. SERVFAIL means the resolver couldn't find out.

NXDOMAIN is the DNS answer for a name that doesn't exist. It's response code 3, and it covers every record type at once: if www.example.com is NXDOMAIN, there's no A, MX or TXT record there either. It's different from an empty answer, where the name exists but has nothing of the type you asked for, and from SERVFAIL, where the resolver couldn't get an answer at all.

Topic
NXDOMAIN
Response codes
Category
Caching and errors
TTLs, propagation and empty answers
Try the live DNS Lookup. Check records on Cloudflare or compare several resolvers, with SPF, DMARC and DKIM explained.
Edit in the full tool

How this is calculated

The three answers point to different fixes, so it pays to tell them apart:

  • NXDOMAIN (code 3): no such name. Check the spelling, check that the record was created in the right zone, and check that the domain is still registered.
  • No records (code 0 with an empty answer, often called NODATA): the name exists, just not with this type. A site with an A record and no AAAA gives this for an IPv6 lookup.
  • SERVFAIL (code 2): the resolver gave up. Broken DNSSEC signatures and name servers that don't answer are the usual causes.

A domain that looks fine can still return NXDOMAIN. An expired domain drops out of the registry's zone, and a registrar or registry hold (clientHold or serverHold) does the same while the domain is still registered. An alias can also end in NXDOMAIN when its CNAME points at a name that's gone, like a retired CDN hostname. Names with accents or other scripts have to be sent as punycode (xn--), and a client that sends them as Unicode gets NXDOMAIN too.

NXDOMAIN gets cached. Resolvers keep it for the negative caching time in the zone's SOA record (RFC 2308), so a name you just created can stay missing for a while for anyone who looked it up a moment too early.

The DNS Lookup words each case differently and shows the resolver's own error note when one comes with the answer. When you compare resolvers and one says NXDOMAIN while another returns records, a change is usually still on its way. A filtering resolver may also answer NXDOMAIN for names on its blocklists, and the tool says so when the resolver notes that it blocked the name.

Verdict

When you see NXDOMAIN, check the spelling first, then whether the record exists in the right zone at your DNS host, then the domain's registration status. If the name is new, wait out the SOA negative caching time. If one resolver says NXDOMAIN and the other has records, the answer settles once the cached NXDOMAIN expires.

More DNS scenarios

TXT records
The free text record that holds verification codes, SPF, DKIM keys and DMARC policies.
View details
SPF vs DKIM vs DMARC
SPF checks the sending server, DKIM checks the message, and DMARC ties both to the From address.
View details
MX records
How senders find your mail servers, what the priority number does, and the null MX for domains that take no mail.
View details

Related guides

Character encoding basics
How text turns into bytes, the problem punycode solves for domain names.
View guide
Fixing jwt expired
Another error that often comes from timing and caches, not a broken setup.
View guide

Frequently asked questions

Is NXDOMAIN the same as DNS_PROBE_FINISHED_NXDOMAIN?
Yes. That's Chrome's message for an NXDOMAIN answer. Look the name up on public resolvers: if they also say NXDOMAIN, the name really doesn't exist, and if they return an address, your device or network has a stale or blocked copy.
Can a subdomain exist if its parent has no records?
Yes. If a.b.example.com exists and b.example.com has no records, b.example.com gives an empty answer, not NXDOMAIN. RFC 8020 says NXDOMAIN means nothing exists at or below the name, so a name with children always exists.
Why does my ISP show a search page instead of an error?
Some ISP resolvers swap NXDOMAIN for the address of their own search or ad page. Google Public DNS says it always returns NXDOMAIN for a name that doesn't exist, so a lookup through a public resolver can disagree with what your browser shows.

Related tools

Subnet Calculator

Calculate network address, broadcast address, and usable IP ranges for IPv4/IPv6.

Use tool

Text Encoding Converter

Convert text to Base64, binary, hex, URL encoding and HTML entities, and back again.

Use tool

JWT Decoder & Validator

Decode JWT headers and claims, check exp, nbf and iat, and verify signatures locally with your own key.

Use tool