NXDOMAIN usually means the requested name does not exist; SERVFAIL means a resolver could not obtain a valid answer.
Applies to: Nameservers and DNS records
DNS tells internet services where to find a website, mail server or other service. Changes can be technically correct yet appear inconsistent for a time because recursive resolvers cache earlier answers until their TTL expires.
Key information
| NXDOMAIN | The authoritative DNS path says that the queried name does not exist. |
|---|---|
| SERVFAIL | The resolver failed to validate or retrieve a usable answer, commonly because of broken delegation, DNSSEC or unavailable authoritative servers. |
| Timeout | No answer arrived within the resolver's wait period; this is different from a valid negative answer. |
Before you start
- Confirm that you are authorised to manage the domain and identify its authoritative DNS provider.
- Export or record the complete current DNS zone and previous TTL values before making changes.
- Allow for DNS caching and avoid making unrelated DNS changes during the same maintenance window.
Work through these checks
- Confirm the exact hostname and record type; a working root domain does not prove that www, mail or a selector exists.
- Check the registry delegation and list of authoritative nameservers.
- Query each authoritative nameserver directly and compare serial numbers and answers.
- When SERVFAIL appears, inspect DNSSEC DS and DNSKEY consistency and test whether authoritative servers answer over both UDP and TCP.
- When NXDOMAIN is unexpected, confirm that the zone and record were created at the authoritative provider rather than an old DNS account.
- After correction, allow negative-cache TTLs to expire and test through more than one public resolver.
Confirm the result
- Authoritative servers return consistent NOERROR answers and validating resolvers no longer return SERVFAIL.
Common problems
| Symptom | Likely cause | What to do |
|---|---|---|
| Only one authoritative server fails. | The zone is not synchronised or that server is unreachable. | Correct replication or remove the broken server from delegation through a controlled change. |
| SERVFAIL began after nameserver change. | A stale DS record or unsigned replacement zone broke DNSSEC validation. | Restore matching DNSSEC configuration or remove the DS record through the registrar before relying on the new zone. |
When to contact Tudor Internet
Open a ticket through the Customer Portal when the checks above do not resolve the issue, when an action is unavailable for your service, or when continuing could risk data loss or service interruption. Include the following so the request can be investigated efficiently:
- The full domain name
- The current and intended registrar or nameservers
- Any registry or transfer error shown
- Whether website or email service is currently live
Do not send passwords, private keys, full payment-card details, one-time authentication codes or unredacted identity documents in an ordinary support reply.
Related articles
- Check DNS with dig, nslookup and public resolvers
- DNSSEC availability and changes
- Change a domain’s nameservers
- DNS propagation and caching
- Create and troubleshoot A and AAAA records
Last reviewed: 2026-07-18.
