DNS_PROBE_FINISHED_NXDOMAIN: what it means and how to fix it

Check from outside your network first

The first question is whether the name fails everywhere or only for you. A DNS propagation check queries several public resolvers (Google, Cloudflare, DNS.SB and AdGuard) and compares their answers with the domain's authoritative nameserver.

If the authoritative nameserver has no record either, the problem is in the domain's DNS setup, and the site owner has to fix it. If the authoritative server answers correctly but some resolvers still return nothing, they are serving an old cached answer that will expire on its own. If every resolver answers correctly and only your device fails, the cause is local.

Causes for site owners

When the name fails for everyone, one of these is usually behind it:

• The domain expired. When registration lapses, the registrar typically stops the domain resolving or points it at a parking page within days.
• The domain is on hold. A clientHold or serverHold status removes the domain from DNS. Registrars apply holds for unpaid renewals, abuse reports, and contact email addresses that were never verified after registration or a contact change. A WHOIS or RDAP lookup shows the status.
• The record does not exist. A new subdomain, or www, was never added to the DNS zone, or a cleanup deleted it.
• The nameservers point at the wrong provider. After moving DNS, the registrar may list nameservers at a provider that does not hold the zone, or the zone was set up at one provider while the registrar still points at another.
• DNSSEC is broken. If DNSSEC was enabled at the old DNS provider and the DS record stays at the registrar after a move, validating resolvers such as Google and Cloudflare reject the answers and lookups fail.
• A typo in a record or in a link. A missing letter in a CNAME target, or in the link visitors click, produces a name that genuinely does not exist.

How site owners fix it

Work down the chain from the registrar to the record. Each step depends on the one before it.

1. 1Look up the domain's registration status and expiry date. Renew an expired domain and clear any hold with the registrar, including verifying the registrant email if they ask for it.
2. 2Check which nameservers the registrar lists for the domain, and confirm they belong to the DNS provider where you edit records.
3. 3In that provider's zone, confirm an A record (and AAAA record if you use IPv6) or a CNAME exists for the exact name that fails, including www if visitors use it.
4. 4If you changed DNS providers, check DNSSEC: either remove the DS record at the registrar or replace it with the one from the new provider.
5. 5Run the DNS check again. When the authoritative nameserver returns the record, resolvers pick it up as their cached answers expire.

How visitors fix it

If the domain resolves fine from public resolvers, the stale or blocked answer is somewhere between your device and the internet. Try these in order:

1. 1Check the spelling of the address, including the ending (.com, .co, .net).
2. 2Load the site on another network, such as a phone on mobile data. If it works there, the problem is your network's DNS.
3. 3Clear Chrome's own DNS cache: open chrome://net-internals/#dns and click "Clear host cache".
4. 4Flush your operating system's cache. On Windows, run ipconfig /flushdns. On macOS, run sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder.
5. 5Restart your router, which also caches DNS answers.
6. 6Switch to a different DNS resolver in your network settings, or in Chrome's "Use secure DNS" setting, and retry.
7. 7Turn off VPNs, ad-blocking DNS services and parental-control filters. Some filtering services answer blocked domains with NXDOMAIN.

Why it fails for some people and works for others

Resolvers cache negative answers as well as positive ones. If someone looked up a name before its record existed, their resolver remembers "does not exist" for a period set by the zone's SOA record, often anywhere from minutes to hours. Until that cache expires, those visitors keep getting NXDOMAIN while everyone else sees the site.

That is why creating a record and immediately testing it can be misleading, and why a fix can appear not to work. The DNS check shows each resolver's answer side by side, so you can see whether the record is correct at the source and which resolvers have caught up.

Related Chrome DNS errors

Chrome uses a family of DNS error codes. The ending tells you what its probe concluded, which points at where to look:

• DNS_PROBE_FINISHED_NXDOMAIN: DNS works, but this name could not be resolved. Usually the domain or record, sometimes a stale or filtered local answer.
• DNS_PROBE_FINISHED_NO_INTERNET: the probe found no working internet connection. Check Wi-Fi, cables and the router before anything else.
• DNS_PROBE_FINISHED_BAD_CONFIG: the probe could not reach the configured DNS resolver. Check the DNS servers set on the device or router, or switch to a public resolver.
• ERR_NAME_NOT_RESOLVED: the lookup failed without a probe verdict. Treat it like NXDOMAIN and check the domain from outside your network.

Brand-new domains and records

A newly registered domain needs its nameservers set at the registrar and a zone with records at the DNS provider before it resolves. Registries usually publish new nameserver settings within minutes to hours, but a domain registered with the registrar's default parking nameservers and then switched can briefly answer from either side.

For a new record on an existing domain, the authoritative nameserver answers immediately once the record is saved. Resolvers that never asked about the name see it right away; only resolvers holding a cached "does not exist" answer lag behind. Testing a new name before creating its record is the usual way to trigger that delay.