NXDOMAIN vs SERVFAIL vs REFUSED: DNS Response Codes Compared

Every DNS reply carries a 4-bit response code (RCODE) in its header. When a lookup fails, that code is the first thing to read, because it points at a different layer for each value. People often treat them all as "DNS is broken," which wastes time: an NXDOMAIN fix and a SERVFAIL fix have nothing in common.

In dig the code appears in the header line:

;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 5821

The codes side by side

The numbers come from the IANA DNS RCODE registry. Other values exist (FORMERR 1, NOTIMP 4) but are rare in everyday troubleshooting.

NXDOMAIN: the name does not exist

The authoritative answer says that no records of any type exist for that name. It is a definitive answer, not a failure, and resolvers cache it according to the SOA record's negative-caching value (RFC 2308), so it can linger after you add the record.

Check, in order:

1. Spelling. wwww.example.com, a trailing dot, an extra label.
2. Is the record in the zone you think is live? Many people edit the registrar's DNS panel while the domain uses Cloudflare or another provider's nameservers. Run dig example.com NS +short and edit the zone at the provider that appears.
3. Is the domain registered and active? Look at WHOIS Lookup for expiry or hold status.
4. Was it deleted? Dangling or removed subdomains return NXDOMAIN; the DNS History tool shows past records.
5. Cached negative answer. Wait for the negative TTL or query another resolver.

Browser-level versions of this error are DNS_PROBE_FINISHED_NXDOMAIN and ERR_NAME_NOT_RESOLVED. The glossary entry on NXDOMAIN gives a short definition.

NOERROR with an empty answer (NODATA)

If you ask for AAAA and the name has only an A record, you get status NOERROR and ANSWER: 0. The name exists, so this is not NXDOMAIN. It is a correct reply that means "no record of that type." Confirm with dig example.com A and dig example.com AAAA separately. Applications that treat any empty answer as failure report misleading errors, so check how your client handles it.

SERVFAIL: something went wrong while resolving

This is the vague one. The resolver tried and could not produce a trustworthy answer. Typical causes are DNSSEC validation failures, unreachable or broken authoritative servers and lame delegation. The diagnosis flow (compare resolvers, test with +cd, trace the delegation) is in DNS SERVFAIL explained.

REFUSED: the server will not answer you

REFUSED means the server is alive and understood the question but is not willing to answer it. Two situations account for most cases:

• You asked an authoritative server about a zone it does not host, for example a nameserver that lost the zone. This is also a symptom of lame delegation.
• You asked a recursive resolver that only serves certain clients, from an address outside its allow list. Closed resolvers are normal and good practice, since open resolvers get abused for amplification attacks.

More detail in dig status REFUSED.

A quick decision order

dig example.com A                        # your default resolver
dig example.com A @1.1.1.1               # a public resolver
dig example.com NS +short                # who is authoritative
dig example.com A @<one-of-those-ns> +norecurse

1. Same result everywhere, status NXDOMAIN: fix the zone contents or the domain registration.
2. SERVFAIL everywhere: query the authoritative servers directly, then test DNSSEC.
3. SERVFAIL or REFUSED only from your default resolver: the resolver is the problem.
4. REFUSED from an authoritative server: that server does not host the zone, so the delegation points to the wrong place.
5. NOERROR but no answer: the name exists, so request the right record type.

Why the layer matters

A record you can add or delete yourself solves NXDOMAIN, but only your DNS provider or registrar can fix delegation. Resolver problems are solved by switching the resolver. Treat the RCODE as a routing hint to the right owner. Use the DNS Checker to see worldwide answers, the Nameserver Lookup to see delegation, and the Dangling DNS Checker when stale records are suspected.

Next steps

• Dig into DNS SERVFAIL explained.
• Read dig status: REFUSED.
• Learn the basics in DNS explained for website owners.
• Check propagation with how long DNS propagation takes.

FAQ

Is NXDOMAIN always my fault?

Not always, but it is a real answer rather than an outage: the authoritative zone says the name does not exist. Check that you edited the zone that is actually live.

Why do I get NXDOMAIN right after adding a record?

A resolver may have cached the earlier negative answer. It stays until the negative TTL from the SOA expires, so test with another resolver.

Which code means the DNS server is down?

Usually none; you get a timeout instead. A SERVFAIL can be the resolver's report that the authoritative servers were unreachable.

Can the same domain return different codes?

Yes. Different resolvers, record types and DNSSEC validation can all lead to different results for the same name.

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.