NXDOMAIN means the name does not exist; SERVFAIL means DNS broke while trying to answer. That is the core difference. One is a clean “nope.” The other is a messy “uh oh.” If you mix them up, you can waste 30 minutes chasing the wrong gremlin.

TLDR: NXDOMAIN means DNS found an answer: the domain or record is not there. SERVFAIL means DNS could not finish the lookup because something failed. Example: if shop.example.com returns NXDOMAIN, the record may be missing; if it returns SERVFAIL, DNSSEC or the authoritative nameserver may be broken. In a support queue of 100 DNS tickets, about 60 can often be sorted faster just by separating “missing record” from “broken lookup.”

DNS errors are like restaurant answers

Imagine you ask a waiter for pizza.

  • NXDOMAIN: “We do not have pizza. It is not on the menu.”
  • SERVFAIL: “The kitchen is on fire. I cannot check.”

That is DNS in tiny pants.

DNS turns names into IP addresses. You type a domain. Your device asks a resolver. The resolver asks other DNS servers. Then you get an answer. Or you get an error that ruins your coffee.

The two errors look similar to users. The site does not load. Email may bounce. Apps may spin forever. But for troubleshooting, they are very different beasts.

What NXDOMAIN really means

NXDOMAIN stands for Non Existent Domain. It means DNS checked and found that the requested name does not exist.

This can happen for a full domain. It can also happen for a subdomain.

  • notrealbrand123.com may return NXDOMAIN.
  • api.example.com may return NXDOMAIN if the api record is missing.
  • mail.example.com may return NXDOMAIN if nobody created it.

NXDOMAIN is not always bad. Sometimes it is correct. If the name was never created, DNS is doing its job. A bit rude, sure. But honest.

Common causes include:

  • A typo in the domain name.
  • A deleted DNS record.
  • A subdomain that was never created.
  • A domain that expired.
  • Wrong search suffixes on a device.

Honestly, it feels like DNS waits until Friday afternoon to expose one missing letter in a hostname.

What SERVFAIL really means

SERVFAIL means Server Failure. It does not mean the domain is missing. It means the DNS system failed while trying to answer.

Think of it as DNS coughing into a napkin.

The resolver asked a question. Something went wrong. So it gave up and returned SERVFAIL.

Common causes include:

  • Broken DNSSEC signatures.
  • Expired DNSSEC keys.
  • Authoritative nameservers are down.
  • Nameserver delegation is wrong.
  • Firewall rules block DNS traffic.
  • Timeouts between DNS servers.
  • Bad zone data on the DNS provider.

SERVFAIL is usually more urgent than NXDOMAIN. Why? Because a real domain may exist, but nobody can resolve it. That can break websites, logins, APIs, checkout pages, and email.

The big difference

ErrorPlain meaningBest first guess
NXDOMAINThe DNS name does not exist.Missing record or typo.
SERVFAILDNS failed while checking.Server, DNSSEC, or delegation issue.

Here is the simple rule.

NXDOMAIN = “No such name.”

SERVFAIL = “Could not get a valid answer.”

That one line saves time. Tape it to your monitor if DNS has hurt you before.

How to test it

Use dig if you can. It says the quiet part out loud.

dig example.com

Look for the status line.

;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN

Or:

;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL

You can also test a specific record.

dig api.example.com A
dig example.com MX
dig example.com TXT

Try a public resolver too.

dig @8.8.8.8 example.com
dig @1.1.1.1 example.com

If one resolver gives NXDOMAIN and another gives a good answer, caching may be involved. If many resolvers give SERVFAIL, the problem is likely deeper.

It drives me crazy that some web dashboards hide this detail behind a red “failed” badge. Great. Very helpful. That badge took two seconds to load and told us nothing.

Troubleshooting NXDOMAIN

Start with spelling. Yes, really.

Check the full name. Check dots. Check the zone. Check if someone wrote prod-api when the record is actually prodapi.

Then check the DNS zone file or provider panel.

  • Does the record exist?
  • Is it in the right zone?
  • Was it deleted during cleanup?
  • Did the domain expire?
  • Is the parent domain delegated correctly?

If login.example.com returns NXDOMAIN, look for a missing A, AAAA, or CNAME record. If the whole domain returns NXDOMAIN, check the registrar first. The domain may be expired or not delegated.

Also check negative caching. DNS can cache “does not exist” answers. That means you can recreate a record but still see NXDOMAIN for a while. The wait depends on the zone’s negative TTL. Annoying? Yes. Normal? Also yes.

Troubleshooting SERVFAIL

SERVFAIL needs a wider net.

Start with DNSSEC. DNSSEC is useful, but when it breaks, it breaks loudly. A bad signature can make validating resolvers reject the answer.

Try this:

dig example.com +dnssec

Then test with a resolver known to validate DNSSEC. If validation fails, check DS records at the registrar and DNSKEY records in the zone.

Next, check the authoritative nameservers.

dig NS example.com
dig @ns1.provider.com example.com

If the authoritative server does not answer, you found smoke. Maybe the provider has an outage. Maybe the zone was not loaded. Maybe a firewall blocks UDP or TCP port 53.

Also compare results from different networks. Test from your office. Test from mobile data. Test from a cloud server. If SERVFAIL appears only in one place, a local resolver or network filter may be the culprit.

A quick user case

A small store launched a sale at 9:00 AM. At 9:12 AM, checkout stopped loading. Support saw “DNS error” and blamed the web host.

But dig checkout.storeexample.com returned SERVFAIL, not NXDOMAIN. The record existed. The app was fine. The issue was a broken DNSSEC change made 18 minutes before the sale.

The fix took 6 minutes after DNSSEC was checked. Without that clue, the team had already spent 24 minutes restarting healthy servers. That is classic DNS comedy. Not funny at the time, of course.

Fast cheat sheet

  • NXDOMAIN: Check spelling first.
  • NXDOMAIN: Check if the record exists.
  • NXDOMAIN: Check domain expiry and delegation.
  • SERVFAIL: Check DNSSEC first.
  • SERVFAIL: Check authoritative nameservers.
  • SERVFAIL: Check firewalls, timeouts, and provider status.

Simple rule for real life

If users say, “The site does not exist,” do not trust the wording. Users report symptoms. DNS gives clues.

Run a lookup. Read the status. Then act.

NXDOMAIN points you toward missing names. SERVFAIL points you toward broken resolution. One is a missing signpost. The other is a collapsed bridge.

Once you know that, DNS gets less scary. Still weird. Still picky. But less scary.