DNS TROUBLESHOOTING GUIDE
How to Fix DNS_PROBE_FINISHED_NXDOMAIN
DNS_PROBE_FINISHED_NXDOMAIN means your browser could not resolve the website’s name. Before a page can load, DNS translates its hostname into an address. If that lookup says the name does not exist, Chrome and other Chromium-based browsers may show this error instead of reaching the website.
The problem can sit on your device, your network, the DNS resolver you use, or the domain’s configuration. Start by comparing devices and networks rather than changing several settings at once. That makes it easier to identify what actually helps.
Start with these checks
1. Check the spelling and try the exact hostname on another device or network.
2. Compare public DNS results with your local resolver, then clear a stale local DNS cache if appropriate.
3. Check browser Secure DNS, VPN, and network settings. If you own the domain, verify registration, nameservers, and authoritative records.
What Does DNS_PROBE_FINISHED_NXDOMAIN Mean?
NXDOMAIN is a DNS response code meaning “non-existent domain.” It indicates that the queried name does not exist in the DNS data available to the resolver. The browser error is a symptom of a failed name lookup; it does not, by itself, identify the underlying cause.
A typo, a hostname that has not been configured, incorrect domain delegation, or an outdated cached negative answer can cause this result. Filtering software and some DNS resolvers may also return negative answers. NXDOMAIN does not automatically mean the domain is unregistered.
A name can exist without having the record type you requested. For example, a hostname with an A record but no AAAA record may return an empty answer for AAAA, often called NODATA, rather than NXDOMAIN. DNS timeouts and SERVFAIL responses are different problems, even when a browser presents a similar-looking error.
Check Whether the Domain Resolves
Read the address carefully: check the spelling, domain extension, and subdomain. example.com and www.example.com are different hostnames and may have different records. DNS commands expect the hostname alone, without https:// or a page path.
Try the same hostname on another device using the same network, then on a different network such as mobile data. If only one device fails, focus on its browser, DNS cache, or settings. If all devices on one network fail, investigate its resolver or router. If independent networks fail too, public DNS configuration becomes more likely.
Check your domain's DNS records.
Hostingcone’s DNS Lookup Tool checks publicly available DNS records and selected common hostnames. It does not discover every record in a DNS zone. Check the exact failing hostname and relevant A, AAAA, CNAME, and NS records. A successful public lookup is useful evidence, but it is not definitive: your browser may use another resolver, cached answers may differ, and private or split-horizon DNS may intentionally return different results.
You can also compare your configured resolver with a public resolver. Replace example.com with the affected hostname. The second command explicitly queries Google Public DNS; some networks restrict direct external DNS queries.
nslookup example.comnslookup example.com 8.8.8.8
Fix the Error on Windows
1. Verify the address and restart the browser
Close and reopen the browser, then retest the exact URL. If the problem affects only one browser, compare it with another browser before changing Windows network settings.
2. Check the network connection
Confirm that other websites load and complete any Wi-Fi sign-in page. Disconnect and reconnect Wi-Fi or Ethernet if the connection appears stuck. Restart your own router only when other devices on that network are affected and it will not disrupt essential work. Avoid resetting unrelated adapter or firewall settings.
3. Flush the Windows DNS cache
Open Start, search for Command Prompt, and choose Run as administrator if required by your Windows configuration. Run the command below. This removes cached DNS answers, including cached failures; it does not repair incorrect records at the domain’s DNS provider.
ipconfig /flushdns4. Verify the resolver before changing it
Run nslookup for the failing hostname and compare its answer with an explicitly selected public resolver. If your current resolver consistently fails while another succeeds, check your active adapter’s DNS settings. On Windows 11, look under Settings → Network & internet → your Wi-Fi or Ethernet connection → DNS server assignment; on Windows 10, use the adapter’s IPv4 properties. Labels can vary by version.
On an unmanaged home connection, you can test a reputable resolver such as Cloudflare (1.1.1.1 and 1.0.0.1) or Google (8.8.8.8 and 8.8.4.4). Record the original settings first and restore them if the test does not help. Keep organization-managed DNS, VPN, and private-domain requirements intact; ask your administrator before changing those settings.
5. Retest and compare results
Reopen the browser and test the site again. If it still fails, check the browser’s Secure DNS setting and compare another network. Renewing a DHCP lease changes network address configuration; it is not a replacement for flushing DNS or correcting an authoritative DNS record.
Fix the Error on macOS
First check the URL, restart the browser, and verify whether other sites and devices work. If a stale local answer is plausible, open Terminal and use the following commands on many recent macOS versions:
sudo dscacheutil -flushcachesudo killall -HUP mDNSResponder
Enter your Mac administrator password when prompted; Terminal does not display password characters. These commands clear local cached lookup information and signal the DNS responder to refresh. Successful execution may produce no confirmation message. Commands vary by macOS version, so check version-specific Apple guidance if your system does not support them.
On recent macOS versions, review System Settings → Network → the active connection → Details → DNS. Older versions use System Preferences → Network → Advanced → DNS. If comparative lookups suggest a resolver issue, test a known public resolver only where your network policy permits it. Note the original settings, especially on VPN or workplace connections.
Retest the affected hostname in the browser and with nslookup. A browser configured to use DNS-over-HTTPS may continue to use a different resolver from macOS, so check that setting separately if the results disagree.
Check Browser and Network Issues
Browser DNS caching and Secure DNS
Fully restart the browser to clear transient state. Chrome’s Use secure DNS setting is generally under Settings → Privacy and security → Security. DNS-over-HTTPS can send lookups to a resolver different from your operating system’s resolver. Compare the selected provider with your network’s expected DNS setup; do not assume an operating-system cache flush changes browser-managed DNS. A private window alone may not bypass DNS caches.
VPNs, proxies, and filtering
A VPN can supply private DNS servers or route queries differently, and a proxy or security filter can affect browsing. If permitted, briefly compare with the VPN or proxy disconnected, then restore it. Do not disable required workplace protection. If private company names stop resolving, involve the network administrator instead of substituting public DNS.
Router and local resolver checks
If several devices fail only on the same network, check the DNS servers supplied by the router and ask whether filtering or custom DNS rules are involved. A router restart can clear some local state, but it will not fix a missing domain record. Testing mobile data or another trusted network helps separate a local network issue from a public DNS problem.
Change one setting at a time and record the result. If only Chrome fails while command-line lookups succeed, investigate browser DNS. If every device on every tested network fails for the same hostname, shift attention to the domain’s authoritative DNS.
Fix NXDOMAIN for a Domain You Own
For domain owners, the key is to check the active DNS chain rather than repeatedly clearing a visitor’s cache. An existing registration can still have missing hostnames, incorrect delegation, or records saved at an inactive DNS provider.
Check registration and domain status
Sign in to your registrar and confirm that the domain is registered, renewed, and not suspended or on a hold that affects DNS. Expiration handling varies by registrar and registry. Do not assume a browser’s NXDOMAIN message proves the domain is available to register.
Explore Hostingcone domain services
Verify the authoritative nameservers
Compare the nameservers assigned at the registrar with the nameservers required by your current DNS provider. Edit records in the authoritative zone that those servers actually serve. Records saved at an old hosting account or an inactive Cloudflare zone will not affect public answers. If you changed nameservers, verify the delegation before moving more records.
Check the exact hostname and its records
Compare the A record with the hosting provider’s required IPv4 address, and add AAAA only when your service has a valid IPv6 destination. If www or another subdomain uses a CNAME, verify both the alias and its target; a target name that does not exist can break resolution. A mistyped record value may produce a connection problem rather than NXDOMAIN.
A missing A record is not automatically NXDOMAIN if the name exists with other record types. Likewise, an incorrect AAAA address often causes an IPv6 connection failure rather than a non-existent-name response. Check the returned DNS status and the hostname’s actual records instead of treating every browser error as the same issue.
Review subdomain labels and zone boundaries
Check whether your DNS control panel expects a short label such as www or a fully qualified name. Entering the full domain in a panel that automatically appends the zone can create the wrong hostname. Separately delegated subdomains may need changes in their own authoritative zone. A working root domain does not guarantee that www, shop, or another hostname is configured.
Allow for TTLs and negative caching
DNS updates are not broadcast to every resolver at once. Positive answers remain cached according to their TTL, and previous NXDOMAIN answers can also be cached according to the zone’s negative-cache settings. Nameserver changes may involve registrar or registry processing and delegation caches. There is no universal propagation deadline: compare authoritative answers and multiple resolvers, then allow relevant caches to expire.
Treat DNSSEC failures as a separate diagnostic
DNSSEC validation failures commonly produce SERVFAIL rather than NXDOMAIN. A stale DS record at the registrar after a DNS-provider change, or a mismatch with the zone’s signing keys, can prevent validating resolvers from answering. Ask the registrar or DNS provider to verify the DS and DNSKEY chain. Do not disable DNSSEC blindly as a general NXDOMAIN fix.
When to Contact Your Hosting or DNS Provider
Contact your registrar or DNS provider when registration status is unclear, nameserver delegation is incorrect, authoritative servers disagree, or DNSSEC validation fails. Your hosting provider can confirm the addresses and hostname configuration needed for the website. If only a managed office network fails, contact its administrator first.
Include the affected hostname, when the issue began, recent DNS or hosting changes, the devices and networks tested, and the results of comparative lookups. Share screenshots or command output without passwords, API keys, or sensitive account information.
Hostingcone’s published DNS Fixes service is $79 one-time for one domain and includes up to 1 hour of standard DNS troubleshooting and configuration. It covers standard DNS configuration issues; additional work requires approval. Review the service page for the current included scope and exclusions before purchasing.
Frequently Asked Questions
What causes DNS_PROBE_FINISHED_NXDOMAIN?
Common causes include a misspelled hostname, a missing name in authoritative DNS, incorrect nameservers, or a cached negative answer. Device, network, browser Secure DNS, and filtering settings can also affect the result.
Can clearing the DNS cache fix NXDOMAIN?
It can help if a device is holding an outdated negative answer after the underlying DNS problem was corrected. It cannot create a missing record, renew a domain, or fix incorrect nameserver delegation.
Does NXDOMAIN mean my website is down?
It means the queried name could not be resolved through that DNS path. The web server may still be running, and other resolvers may return a working answer. Check the exact hostname from multiple networks before drawing a broader conclusion.
How long does DNS propagation take?
It depends on record TTLs, negative-cache lifetimes, delegation caches, and any registrar or registry processing. Some changes appear quickly, while others take longer. There is no single guaranteed waiting period for every DNS change.
Can incorrect nameservers cause NXDOMAIN?
Yes. A domain delegated to nameservers that do not serve the expected zone or hostname can return a negative answer. Other delegation faults can instead produce timeouts or SERVFAIL, so inspect the actual response.
What if the error happens on only one device?
Check that device’s browser, local cache, VPN or proxy, and configured DNS resolver. Compare another browser and network before changing the domain’s DNS records, especially when other devices resolve it normally.
How do I check whether my domain has valid DNS records?
Use Hostingcone’s DNS Lookup Tool to query the exact hostname and relevant record types, then compare the results with your provider’s required values. A public lookup shows selected public records, not a complete DNS zone or a guarantee that the website application is working.
Still Having DNS Problems?
Use Hostingcone’s free DNS Lookup Tool to check your domain records, or explore professional DNS assistance if the issue persists.
Explore more DNS troubleshooting guides and tools in the Hostingcone DNS Troubleshooting Hub.