DNS SERVFAIL Error: What It Means and How to Fix It

SERVFAIL is the DNS response code a resolver returns when it tried to answer a query and couldn't. It doesn't mean the name is missing (that's NXDOMAIN). It means "I couldn't get an answer I can give you". For a website, that looks the same as being offline: browsers show errors such as DNS_PROBE_FINISHED_BAD_CONFIG or "server not found".

Because a resolver returns SERVFAIL for several unrelated reasons, the fix depends on finding the right one first.

SERVFAIL vs NXDOMAIN vs REFUSED

What causes a SERVFAIL error?

1. DNSSEC validation failed

This is the most common cause for domains that were working until recently. A validating resolver checks the domain's signatures against the DS record at the registry. If they don't match, for example because DNS moved to a new provider and the old DS record was left at the registrar, it returns SERVFAIL rather than possibly forged data. See common DNSSEC failures for each variant and its fix.

2. No nameserver answered

If every authoritative nameserver for the domain is down, unreachable or timing out, the resolver has nothing to return. A firewall that blocks DNS over TCP, or large responses that are lost when fragmented, can cause the same thing for some queries only.

3. Lame or broken delegation

The registry lists nameservers that don't serve the zone: they refuse the query, answer without authority or return errors. When all listed servers are lame, resolvers return SERVFAIL. When only some are, you get intermittent failures. See troubleshooting nameserver mismatches.

4. A resolver-side problem

Less often, the fault is in the resolver: an outdated trust anchor, a broken forwarder, or a cached failure. If the domain resolves through several public resolvers but not through one particular resolver, the problem is that resolver.

How to fix a SERVFAIL error

1. Repeat the query with DNSSEC checking disabled. The +cd flag tells a validating resolver to skip validation:

   dig @1.1.1.1 example.com A        ; status: SERVFAIL
   dig @1.1.1.1 example.com A +cd    ; status: NOERROR

   If the answer appears with +cd, DNSSEC is the problem. Run the DNSSEC checker to see which link in the chain is broken.
2. Read the Extended DNS Error. Modern resolvers attach a reason to SERVFAIL (RFC 8914). In dig output, look for a line such as EDE: 7 (Signature Expired) or EDE: 22 (No Reachable Authority).
3. Query each authoritative nameserver directly. If they time out or answer REFUSED, the problem is the nameservers or the delegation. The nameserver check tests every listed server and compares them with the registry.
4. Compare resolvers. Ask 1.1.1.1, 8.8.8.8 and 9.9.9.9. SERVFAIL everywhere points to the domain. SERVFAIL from just one points to that resolver.

Why it works on some networks but not others

Not every resolver validates DNSSEC. A domain with broken DNSSEC fails for users of validating resolvers, which includes the big public ones and many ISPs, and works for everyone else. That split is the classic sign of a DNSSEC problem, and it often makes the outage look random.

Resolvers also cache failures for a short time, typically a few seconds to several minutes, so a fixed problem can linger briefly.