DNS_PROBE_FINISHED_NXDOMAIN: what Chrome is telling you, and the fix on both sides

Short answer: DNS_PROBE_FINISHED_NXDOMAIN means Chrome could not turn the site’s name into an IP address, and a follow-up test showed that your DNS resolver itself works. So the failure is about this one name: a typo, a domain that is not registered or has lapsed, a hostname without a DNS record, or a filter that blocks it. The page is headed “This site can’t be reached” and asks you to check the address for a typo. ERR_NAME_NOT_RESOLVED, whose page says “…’s server IP address could not be found”, is the same failure on a page where Chrome skipped that test or got no clear result from it.

Two kinds of reader land here. Visiting someone else’s site? Go to the fixes for visitors, ordered from most to least likely. Your own domain shows it? Go to the checks for site owners, which start with one dig command and a table that tells you what its answer means.

What does DNS_PROBE_FINISHED_NXDOMAIN mean?

NXDOMAIN is the DNS response code for “this name does not exist”. Chrome’s error is broader than the label. Its resolver reports every failed lookup as one error, ERR_NAME_NOT_RESOLVED, whether the name does not exist, the server failed or the query timed out. Chrome then runs a probe: it resolves google.com once through your current DNS settings and once through Google Public DNS (8.8.8.8 and 8.8.4.4), and picks the error page from the two results. We read this logic in Chromium’s source (dns_probe_service_factory.cc):

One consequence matters for site owners: the page does not prove that DNS answered NXDOMAIN. A domain whose DNSSEC is broken returns SERVFAIL, the probe still finds your resolver healthy, and Chrome shows the same NXDOMAIN page. Edge and other Chromium-based browsers show the same error codes; Firefox says “Hmm. We’re having trouble finding that site.”

Fixes for visitors, most likely first

1. 1Check the address, then try another network

   Most cases are a mistyped name or a missing www. Then open the same address on your phone over mobile data, not Wi-Fi. If it fails there too, and the DNS lookup tool (which asks our resolver in Amsterdam) finds no A or AAAA record for the name either, the domain itself is broken or gone. Nothing on your computer will fix it; only the owner can.

2. 2Ask a public resolver directly

   This tells you whether your own resolver is the problem. The command works the same in Windows cmd, PowerShell, macOS Terminal and Linux, where minimal installs need the bind9-dnsutils or bind-utils package first. Replace www.example.com with the address that fails:

   nslookup www.example.com 1.1.1.1

   Addresses in the answer, while the browser still fails, mean the name exists and something on your side hides it: a cache, a filter or the resolver your device uses. ** server can't find …: NXDOMAIN from 1.1.1.1 (on Windows: Non-existent domain) means the name really does not resolve anywhere; skip to the owner section if it is yours.

3. 3Clear Chrome's own DNS cache

   Chrome keeps a host cache of its own. Open chrome://net-internals/#dns and click Clear host cache, then on chrome://net-internals/#sockets click Flush socket pools, and reload. The DNS page also has a lookup box that shows what Chrome itself resolves, which can differ from nslookup when Secure DNS is on (step 7).

4. 4Flush the operating system's DNS cache

   ipconfig /flushdns

   sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

   sudo resolvectl flush-caches

   A plain Debian 12 or 13 install runs no local DNS cache, so there is nothing to flush unless you added one such as nscd, dnsmasq or unbound; if resolvectl status answers, systemd-resolved is running and the command above applies. Older guides tell Windows users to restart the DNS Client service with net stop dnscache; current Windows 10 and 11 refuse to stop that service, and the flush does the same job. If your device uses the router as its DNS server, the router caches answers too: restart it, or bypass it with step 5.

5. 5Switch to a public resolver

   If step 2 showed that 1.1.1.1 answers and your default resolver does not, point your device at two unfiltered public resolvers from different operators. In PowerShell as Administrator, replace Ethernet with the name Get-NetAdapter shows for your connection:

   Set-DnsClientServerAddress -InterfaceAlias 'Ethernet' -ServerAddresses ('1.1.1.1','8.8.8.8')

   networksetup -setdnsservers Wi-Fi 1.1.1.1 8.8.8.8

   On macOS, networksetup -listallnetworkservices lists the service names if yours is not Wi-Fi. To go back to the servers DHCP hands out, run Set-DnsClientServerAddress -InterfaceAlias 'Ethernet' -ResetServerAddresses on Windows or networksetup -setdnsservers Wi-Fi empty on macOS. On Linux, where the setting lives depends on the distribution; Temporary failure in name resolution walks through systemd-resolved, netplan and /etc/resolv.conf.

6. 6Pause the VPN, ad blocker or filtering DNS

   DNS filters answer a blocked name with NXDOMAIN or with a null address. Pi-hole does the first in its NXDOMAIN blocking mode, and Quad9’s 9.9.9.9 does it for domains on its threat lists. A blocked answer usually has no SOA record in its authority section, and resolvers that support Extended DNS Errors (RFC 8914) add a code with the reason. This is Quad9 answering its own test domain:

   ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 16136
   ;; flags: qr rd ad; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
   ; EDE: 17 (Filtered)

   A name that truly does not exist carries the zone’s SOA record in the authority section instead (see the owner section). Disconnect the VPN completely, pause the blocker, or ask an unfiltered resolver such as 9.9.9.10 to compare.

7. 7Check Chrome's Secure DNS setting

   Under Settings → Privacy and security → Security → Use secure DNS, Chrome can send lookups to a chosen provider over HTTPS instead of your system resolver. Then nslookup may succeed while Chrome fails, or the other way round. Set the provider list to OS default (when available) or turn the switch off, and reload. On a managed browser the setting is locked.

8. 8On a phone, check Private DNS and profiles

   Android’s Private DNS setting and DNS or VPN profiles on iOS replace the network’s resolver, and some of them filter. Turn the setting off or remove the profile, toggle flight mode, and reload.

Your own domain shows it: checks for site owners

Test from outside your own network and caches. Ask a public resolver for the exact hostname visitors type, and for the bare domain. Replace example.com with your domain:

dig @1.1.1.1 www.example.com
dig @1.1.1.1 example.com

On Windows, Resolve-DnsName www.example.com -Server 1.1.1.1 does the same. No dig on your machine? The DNS lookup tool shows the status and the records from our resolver. Read two parts of the answer: the status in the header, and the AUTHORITY SECTION. The SOA record there names the zone that said no.

;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 31239
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;no-such-host.vmheaven.io.      IN      A

;; AUTHORITY SECTION:
vmheaven.io.    1800    IN      SOA     aisha.ns.cloudflare.com. dns.cloudflare.com. 2415933946 10000 2400 604800 1800

The zone vmheaven.io answered for itself: the domain works, this hostname has no records. Compare a domain that is not registered at all. Here the .com registry answers:

;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 14341
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; AUTHORITY SECTION:
com.            900     IN      SOA     a.gtld-servers.net. nstld.verisign-grs.com. 1791728479 1800 900 604800 900

The domain is not registered, has expired or has no nameservers

An SOA from the TLD means the registry has no delegation for your domain. Check the registration with the WHOIS lookup, which asks the registry over RDAP, or with the whois command:

whois example.com | grep -iE 'expiry date|domain status|name server|dnssec'

   Registry Expiry Date: 2027-08-13T04:00:00Z
   Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
   Name Server: ELLIOTT.NS.CLOUDFLARE.COM
   Name Server: HERA.NS.CLOUDFLARE.COM
   DNSSEC: signedDelegation

Three statuses take a domain out of DNS, according to ICANN’s list of EPP status codes: clientHold (set by the registrar, for example after a missed renewal or an unconfirmed registrant e-mail), serverHold (set by the registry) and inactive (no nameservers associated). No match for domain means it is not registered at all. Renew it, confirm the e-mail, or enter the nameservers at the registrar. Some ccTLDs, among them .io and .de, are not in IANA’s RDAP directory, so check those on the registry’s own website.

The nameservers do not serve your zone

Records only count at the provider your domain is delegated to. If you edit records at provider A while the registrar still names provider B’s nameservers, nobody ever sees them. dig +trace follows the delegation from the root down and shows which servers answer at each step:

dig +short NS example.com @1.1.1.1
dig +trace +nodnssec www.example.com

io.             172800  IN      NS      a0.nic.io.
io.             172800  IN      NS      b0.nic.io.
;; Received 301 bytes from 198.41.0.4#53(a.root-servers.net) in 15 ms

vmheaven.io.    3600    IN      NS      dimitris.ns.cloudflare.com.
vmheaven.io.    3600    IN      NS      aisha.ns.cloudflare.com.
;; Received 113 bytes from 65.22.161.17#53(b0.nic.io) in 7 ms

vmheaven.io.    1800    IN      SOA     aisha.ns.cloudflare.com. dns.cloudflare.com. 2415933946 10000 2400 604800 1800
;; Received 116 bytes from 108.162.195.6#53(dimitris.ns.cloudflare.com) in 55 ms

+trace prints no status line. A last step that returns only an SOA record is the negative answer, and the line under it names the server that gave it. Then ask each nameserver directly, without recursion. Replace NS1.YOUR-DNS-PROVIDER.TLD with a name from the NS answer:

dig +norec www.example.com @NS1.YOUR-DNS-PROVIDER.TLD

A server that does not have your zone refuses the question. This is a Cloudflare nameserver asked about a domain it does not host:

;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 40905
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
; EDE: 20 (Not Authoritative)

Public resolvers turn that into SERVFAIL for your visitors. Fix it on the side that is wrong: point the registrar at the provider that holds your records, or create the zone at the provider the registrar names. Some networks block outgoing DNS to anything but their own resolver, so +trace may time out. Adding +tcp gets through where only UDP is filtered; otherwise the DNS lookup tool works from outside.

The exact hostname has no record (www and the bare domain)

DNS has no automatic www. example.com and www.example.com are separate names, and each needs its own record:

dig +short A example.com @1.1.1.1
dig +short A www.example.com @1.1.1.1
dig +short AAAA www.example.com @1.1.1.1

An empty line for one of them is your answer. Give each name an A record with your server’s IPv4 address, an AAAA record if the server has IPv6, or make www a CNAME to the bare domain; Point a domain to your VPS has the record set. Watch dangling CNAMEs: if www points at a hostname that no longer exists, for example an app you deleted at a platform, the answer shows the CNAME and still ends in NXDOMAIN, because the status always describes the end of the chain (RFC 6604).

You added the record and it is still NXDOMAIN

Resolvers cache a “does not exist” too. Under RFC 2308, a resolver may keep an NXDOMAIN for the smaller of two numbers in the SOA record that came with it: the record’s TTL and its last field, the minimum. In the vmheaven.io output above both are 1800, so a resolver that asked before you created the record can repeat “does not exist” for up to 30 minutes. For a freshly registered .com domain the registry’s value applies, 900 seconds.

• Confirm the authoritative server already has the record, with the dig +norec command above. If it does, only caches are left.
• The DNS propagation checker asks twelve public resolvers and your own nameserver at once, so you see which ones still hold the old answer.
• Cloudflare (one.one.one.one/purge-cache) and Google (dns.google/cache) let anyone drop one name from their cache. Flush your own machine as in step 4.
• Next time, create records before you open the name in a browser, so no resolver has a “no” to remember.

SERVFAIL, not NXDOMAIN: check DNSSEC

If dig says SERVFAIL, the resolver could not get an answer it trusts. With DNSSEC the cause is usually a DS record at the registrar that no longer matches the keys of the zone, typically after moving DNS to a new provider. The test domain dnssec-failed.org is broken this way on purpose:

;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 2594
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
; EDE: 9 (DNSKEY Missing): (no SEP matching the DS found for dnssec-failed.org.)

Repeat the query with dig +cd, which switches validation off for that one question. If an address comes back now, DNSSEC is the reason. Fix it at the registrar: remove the old DS record, or replace it with the one your current DNS provider shows. The DNSSEC line in the whois output above tells you whether a DS record is published at all.

Test your server while DNS is still broken

You do not need working DNS to see whether the server itself is ready. curl can be told which IP address to use for a name. Replace www.example.com with your hostname and 203.0.113.10 with your server’s IP:

curl -sI --resolve www.example.com:443:203.0.113.10 https://www.example.com/

On Windows, type curl.exe instead of curl: in Windows PowerShell, curl is an alias for Invoke-WebRequest. Response headers mean nginx or your application answers and only DNS is missing. If curl cannot connect, the server needs work as well: a refused connection, which browsers show as ERR_CONNECTION_REFUSED, means nothing listens on the port or a firewall rejects it, and a timeout means the packets are dropped on the way.

If the domain should point at a VMHeaven server

A domain’s A and AAAA records live at your registrar or DNS provider, not on the server and not in our panel. Every Standard KVM VPS gets an IPv4 address of its own, plus an IPv6 prefix where the location has one free. Copy the IPv4 address from the panel into the A record. Add an AAAA record only for an IPv6 address the server has actually configured and answers on; Windows, for one, does not set IPv6 up by itself. The reverse DNS field in the panel sets the PTR record, which maps the IP address back to a name. Mail servers check it; browsers do not, and it does not create the forward record a visitor needs.

Frequently asked