NXDOMAIN vs SERVFAIL

2026-08-30

Problem

A domain that's supposed to be up is failing to resolve, but two different DNS error responses — NXDOMAIN and SERVFAIL — get treated as the same failure by whoever's triaging it, sending them down the wrong troubleshooting path.

Symptoms

Some resolvers or tools report "domain not found" (NXDOMAIN)
Other checks, or the same domain checked again a few minutes later, report a resolution error described as SERVFAIL or a generic DNS error
The behavior isn't perfectly consistent across every resolver checked

Observed

A DNS query from one vantage point returned status NXDOMAIN with an empty answer section
The same query against a different resolver, or after a short wait, returned status SERVFAIL instead
The authoritative nameservers listed at the registrar didn't fully match the nameservers actually serving answers for the zone, and the zone's DNSSEC signatures had expired

Root cause (working theory)

These two outcomes mean structurally different things, and we treat them as separate diagnoses. NXDOMAIN is an authoritative, confirmed answer — the queried name does not exist, according to a nameserver that successfully answered. SERVFAIL means the resolver couldn't get a valid answer at all, most often from a timeout to the authoritative server, malformed zone data, or — in our experience most commonly — DNSSEC validation failure. In the case reviewed here, we believe the inconsistency across resolvers pointed to an expired DNSSEC signature on the zone: DNSSEC-validating resolvers rejected the answer as SERVFAIL, while non-validating resolvers returned whatever the authoritative answer was, which happened to be NXDOMAIN because the record set was also out of date at one of two authoritative providers still listed during an in-progress migration.

Why the obvious fix failed

The first response was to re-check and re-save the DNS records themselves, since NXDOMAIN reads as "the record is missing." The records at the primary DNS provider were actually correct. The problem wasn't the record content — it was that a validating resolver couldn't trust the answer at all because of DNSSEC, and a second, stale authoritative source was still being queried by some resolvers.

Fix

Check DNSSEC status directly and correct or remove expired signatures and keys, and confirm the registrar's authoritative nameserver delegation points only to the current, intended DNS provider — remove any leftover secondary or old provider still listed as authoritative.

dig +dnssec <hostname>

Verify

Query the domain from multiple public resolvers, including at least one that enforces DNSSEC validation, and confirm a consistent, correct answer from all of them. Re-check a few hours later once TTLs from the old delegation have expired.

Takeaway

NXDOMAIN and SERVFAIL are not interchangeable "DNS is broken" signals. NXDOMAIN means a nameserver definitively answered that the name doesn't exist; SERVFAIL means no trustworthy answer could be obtained at all. Conflating them sends troubleshooting toward record content when the real issue — stale delegation, DNSSEC — is somewhere else.