How to Fix SERVFAIL DNS Errors
A SERVFAIL response means that a DNS server was unable to complete your query successfully. This guide explains the most common causes of SERVFAIL responses and provides practical, step-by-step troubleshooting instructions for website owners and administrators.
At a Glance
SERVFAIL is a DNS server response that indicates the query could not be completed successfully. Unlike NXDOMAIN, it does not necessarily mean the domain doesn’t exist.
Why You’re Seeing This Error
A SERVFAIL response indicates that a DNS resolver was unable to successfully complete your DNS request. Unlike NXDOMAIN, which means a domain does not exist, SERVFAIL usually indicates that the domain exists, but the DNS server encountered a problem while trying to resolve it.
This may happen because of DNSSEC validation failures, unavailable authoritative nameservers, incorrect DNS delegation, temporary resolver issues, or other DNS configuration problems.
A SERVFAIL response doesn’t always mean the problem is on your side. In many cases, the issue originates from the domain’s DNS configuration or from the recursive DNS resolver you’re using.
SERVFAIL vs Other DNS Responses
| Response | Meaning |
|---|---|
| SERVFAIL | The DNS server encountered an internal problem while processing the request. |
| NXDOMAIN | The requested domain name does not exist. |
| REFUSED | The DNS server refused to answer the query. |
| NOERROR | The query completed successfully. |
Common Causes of SERVFAIL
A SERVFAIL response can occur for several reasons. The issues below are among the most common and should be checked before making more advanced changes.
DNSSEC Validation Failure
Incorrect or outdated DNSSEC records can prevent DNS resolvers from validating the domain, resulting in a SERVFAIL response.
Authoritative Nameserver Issues
The authoritative nameservers may be offline, unreachable, or incorrectly configured.
Broken DNS Delegation
Incorrect NS records or mismatched delegation between the registrar and the DNS provider can prevent successful lookups.
Resolver Problems
Temporary issues with your ISP’s DNS resolver or public DNS service may cause SERVFAIL responses.
Invalid Zone Configuration
Missing SOA records, broken zone files, or incorrect DNS records can prevent successful resolution.
Firewall or Network Restrictions
Firewalls or network policies blocking DNS traffic may interfere with successful DNS queries.
Before You Start
Before making any changes, verify that the issue isn’t temporary. DNS propagation, resolver outages, or recent configuration changes may temporarily cause SERVFAIL responses.
- ✓ Check whether you recently changed DNS records or nameservers.
- ✓ Confirm that the domain registration is active.
- ✓ Test the domain using another DNS resolver.
- ✓ Avoid making multiple DNS changes simultaneously.
Verify Your DNS Records
Before making any changes, verify the DNS records currently being returned for your domain. This helps identify missing, outdated, or incorrectly configured records that may be causing the SERVFAIL response.
Check the following DNS records:
- A / AAAA – Ensure they point to the correct server.
- NS – Verify the authoritative nameservers are correct.
- SOA – Confirm the zone has a valid Start of Authority record.
- MX – Check mail routing if email services are affected.
- TXT – Review SPF, DKIM and DMARC records if applicable.
Compare the returned DNS records with the configuration in your DNS provider or hosting control panel. If they don’t match, you’ve likely found the source of the problem.
All required DNS records are present, point to the correct values, and are returned without errors.
This tool displays A, AAAA, CNAME, MX, TXT, NS, SOA and other DNS records, along with WHOIS information for your domain.
Verify Your Authoritative Nameservers
If your DNS records appear to be correct, the next step is to verify that your domain is delegated to the correct authoritative nameservers. Incorrect or unavailable nameservers are a common cause of SERVFAIL responses.
Check the following:
- Your domain is using the expected nameservers.
- All authoritative nameservers respond to DNS queries.
- The registrar and DNS provider show the same nameserver configuration.
- The nameservers are not returning timeout or SERVFAIL responses themselves.
Even perfectly configured DNS records won’t be used if the domain is delegated to the wrong nameservers or the authoritative servers are unavailable.
All configured nameservers respond successfully and match the delegation configured at your domain registrar.
Verify Your DNSSEC Configuration
DNSSEC (Domain Name System Security Extensions) protects DNS responses from tampering by adding cryptographic signatures to DNS data. If DNSSEC is enabled but incorrectly configured, DNS resolvers may reject otherwise valid responses and return a SERVFAIL error.
Review the following items:
- Verify that the DS record at your registrar matches the active DNSKEY.
- Ensure DNSSEC is enabled only if your DNS provider fully supports it.
- Check for expired or invalid DNSSEC signatures.
- Confirm that recent DNS migrations didn’t leave old DS records behind.
DNSSEC problems are one of the most common causes of SERVFAIL after changing DNS providers or migrating a domain to another nameserver.
Don’t disable DNSSEC unless you’ve confirmed it’s the source of the problem. Removing DNSSEC unnecessarily reduces protection against DNS spoofing and cache poisoning attacks.
DNSSEC validation completes successfully without generating SERVFAIL responses.
Learn more about DNSSEC in the ICANN DNSSEC Overview .
Test Using Another DNS Resolver
If your DNS records, nameservers, and DNSSEC configuration all appear to be correct, the issue may be related to the recursive DNS resolver you’re currently using.
Testing the domain with another public DNS resolver can help determine whether the problem is local to your ISP or affects multiple DNS providers.
- Test using Google Public DNS.
- Repeat the lookup using Cloudflare DNS (1.1.1.1).
- Compare the responses from multiple resolvers.
- Clear your local DNS cache before testing again if you’ve recently made DNS changes.
Different recursive DNS resolvers maintain independent caches and validation processes. If one resolver returns SERVFAIL while another resolves the domain successfully, the issue may be temporary or isolated to a specific DNS service.
If every public DNS resolver returns SERVFAIL, the problem is very likely with the domain’s DNS configuration rather than your local network.
At least one reliable public DNS resolver successfully resolves the domain, or you’ve confirmed that the SERVFAIL response is consistent across multiple providers.
Contact Your DNS or Hosting Provider
If you’ve completed the previous troubleshooting steps and your domain still returns a SERVFAIL response, the issue is likely related to your DNS provider, hosting provider, or registrar.
Before contacting support, collect the following information to help speed up the investigation.
- Your domain name.
- The exact error message or DNS response.
- The date and time the issue started.
- The DNS provider or registrar managing the domain.
- The nameservers currently assigned to the domain.
- Whether the issue occurs with multiple public DNS resolvers.
- Any recent DNS, nameserver, or DNSSEC changes.
Providing these details allows the support team to reproduce the problem more quickly and determine whether the issue is related to DNS configuration, DNSSEC validation, authoritative nameservers, or infrastructure problems.
If the problem started immediately after changing DNS settings, mention exactly what was changed and when the changes were made.
Verify the Fix
After making DNS changes, verify that the issue has been resolved before considering the troubleshooting complete.
Verify that A, AAAA, MX, NS, and other required DNS records are returned without errors.
Query the domain using multiple public DNS resolvers to confirm the error no longer occurs.
Open the website in your browser and verify that pages load without DNS-related errors.
If the domain handles email, verify that messages can be sent and received successfully.
Related Resources
Continue exploring DNS troubleshooting with these tools and guides.
DNS & WHOIS Lookup
Inspect DNS records, nameservers and WHOIS information.
DNSSEC Explained
Learn how DNSSEC validation works and why it matters.
DNS_PROBE_FINISHED_NXDOMAIN
Troubleshoot one of the most common DNS resolution errors.