DNS_PROBE_FINISHED_NXDOMAIN: What is this error and how can it be fixed?

DNS_PROBE_FINISHED_NXDOMAIN is one of the most common DNS errors in Chrome, which makes websites unavailable to a significant portion of Windows users in Ukraine. In this article, we will look at the main causes of the error, methods of diagnosis using dig and whois, as well as practical ways to fix the problem.

🔍 What does DNS_PROBE_FINISHED_NXDOMAIN mean?

DNS_PROBE_FINISHED_NXDOMAIN occurs during the DNS resolution phase when the browser successfully performs a DNS query through the system resolver, but receives an NXDOMAIN response (RCODE = 3) — the requested domain name is not present in the DNS hierarchy and cannot be matched with an A or AAAA record.

This means that:

• the domain is not delegated in the root or TLD zone,
• the domain zone is missing or unavailable on authoritative DNS servers,
• or the resolution chain is broken at the local level.

💰 Implications for business:

NXDOMAIN is a critical availability error:

• the site is completely inaccessible, without fallback mechanisms,
• advertising traffic cannot be processed because domain resolution does not occur,
• Users and bots cannot reacquire an IP address until the TTL expires or the problem is resolved.

This is an infrastructure DNS error, not a browser or web server issue, and requires checking domain delegation, authoritative NS, zone records, and local resolver behavior to resolve.

🚨 Main causes of DNS_PROBE_FINISHED_NXDOMAIN

1️⃣ Domain is missing or expired

NXDOMAIN is most often returned when a domain name does not actually exist in the DNS hierarchy or has lost its delegation due to the expiration of its registration.

Some domains have a delay between expiration and complete deletion, after which resolution stops—registration should be checked immediately when NXDOMAIN appears.

2️⃣ DNS changes and incomplete propagation (TTL)

After changing NS or zone records, client and public resolvers may still use cached data until the TTL expires. During this period, some queries return NXDOMAIN or an empty response.

In the correct case, the response should contain ANSWER SECTION A / AAAA or NS records. Their absence indicates an incomplete or inconsistent delegation status.

3️⃣ Damaged or outdated local DNS cache

Operating systems and browsers use a multi-level DNS cache. An incorrect or outdated record can lead to a stable NXDOMAIN even with a functioning DNS infrastructure.

This is particularly common on Windows due to the local DNS Client Service and browser cache, which store a large number of records and are not always updated correctly after zone changes.

4️⃣ Failures on the DNS provider’s side

Internet service provider resolvers may temporarily return NXDOMAIN due to:

• problems with forwarding,
• filtering DNS queries,
• DNSSEC validation errors,
• overload or rate limiting.

In such cases, the domain may open correctly via public DNS (Google, Cloudflare) and be unavailable via the provider’s DNS.

For a quick preliminary check, you can run this command: nslookup yourdomain.com 1.1.1.1
NXDOMAIN – domain is dead/NS is not configured. TIMEOUT – DNS server is unavailable. IP is issued – local problem.

🛠️ Diagnostics: using dig and whois

In the case of DNS_PROBE_FINISHED_NXDOMAIN, assumptions are ineffective — a direct check of the domain status and DNS resolution is required. Tools whois and dig allow you to get an objective picture in a few seconds.

📋 Step 1. Check the domain via whois

whois example.ua

What to look for in the answer:

• Domain Status — ok, active, expired, redemptionPeriod
• Registrar — current registrar
• Expiry Date — registration end date

If the response contains No match, NOT FOUND or statuses indicating the completion of registration or suspension of the domain (clientHold, serverHold, expired, redemptionPeriod, pendingDelete etc.), then NXDOMAIN means that the domain is not in the registry or its NS records are not published and do not participate in DNS resolution.

🔍 Step 2. DNS query via dig

dig @1.1.1.1 example.ua A +short

The correct result is the return of an IPv4 address (for example, 94.130.xxx.xxx). An
empty response or NXDOMAIN indicates a problem with resolution.

To rule out errors in a specific resolver, it is recommended to check the domain through several independent DNS servers:

# Google Public DNS
dig @8.8.8.8 example.ua

# Cloudflare DNS
dig @1.1.1.1 example.ua

# Quad9 DNS
dig @9.9.9.9 example.ua

If the domain resolves via public DNS but does not open via the DNS provider, the problem is on the ISP (provider) side.

📁 Step 3. Checking the local hosts file

On Windows:

C:\Windows\System32\drivers\etc\hosts

Check that there are no lines like:

0.0.0.0 example.ua
127.0.0.1 example.ua

Such records forcibly intercept resolution and can cause NXDOMAIN regardless of the state of the DNS zone.

🔧 5 working ways to fix DNS_PROBE_FINISHED_NXDOMAIN

✨Method 1: Clear the DNS cache

Windows 10/11:

Win + R → cmd → Run as administrator

ipconfig /flushdns
ipconfig /release
ipconfig /renew
netsh winsock reset

Restarting your PC is mandatory! Commands ipconfig /flushdns, /release and /renew can be executed without rebooting, but resetting Winsock only takes effect after restarting the system, as the changes are applied to the network stack.

macOS:

sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

🌐 Method 2: Changing DNS servers

In the network settings (IPv4), set:
1.1.1.1 (Cloudflare)
1.0.0.1
8.8.8.8 (Google)
8.8.4.4

🚀 Method 3: Checking the domain owner

whois yourdomain.com

If the domain has expired, renew it through the registrar.

📛 Method 4: Disable VPN/antivirus

VPN services and antivirus programs sometimes block DNS requests.
Test: turn off your VPN and antivirus for a few minutes and check the availability of the site.

📡 Method 5: Checking NS records

dig NS yourdomain.com

Expected response: a list of authoritative NS servers (for example, ns1.examplehost.ua, ns2.examplehost.ua). If the records are missing or incorrect, contact your host.

❓ FAQ: Top 3 most frequently asked questions