How to Fix “DNS_PROBE_FINISHED_NXDOMAIN” on Web Hosting Domains

When a website fails to load and Google Chrome, Microsoft Edge, or Firefox displays the error “DNS_PROBE_FINISHED_NXDOMAIN”, it means that the Domain Name System (DNS) resolver searched the internet hierarchy and determined that the domain name is Non-Existent (NXDOMAIN).

In web hosting, this does not necessarily mean your server has crashed. It means web browsers cannot find an IP address associated with your domain. The cause is usually a missing A record, mismatched nameservers after a migration, an expired domain registration, or an ICANN verification lock.

Quick Answer

Check if the domain resolves to an IP address using a public DNS resolver (like Google 8.8.8.8 or Cloudflare 1.1.1.1):
```
dig @8.8.8.8 yourdomain.com A +short
```
If nothing returns, check your authoritative nameservers:
```
dig yourdomain.com NS +short
```
Check WHOIS domain status to verify it is not expired or on clientHold:
```
whois yourdomain.com | grep -i "Status:"
```
If nameservers are correct, log into your DNS management provider (Cloudflare, cPanel, Route 53, or Registrar) and add an A record pointing @ and www to your server’s public IP address.

Symptoms

Browsers display: “This site can’t be reached — Server IP address could not be found. DNS_PROBE_FINISHED_NXDOMAIN”.
Pinging the domain returns: ping: cannot resolve yourdomain.com: Unknown host.
Email deliverability fails immediately with 550 Host not found or DNS delivery timeouts.
The issue often occurs within hours of updating nameservers or migrating to a new web host.

Common Causes

Missing or Deleted A Record: The authoritative DNS zone file has no A record linking the domain (@ or www) to the web hosting server’s public IPv4 address.
Mismatched Authoritative Nameservers: Your domain registrar (GoDaddy, Namecheap, Google/Squarespace) points to Nameserver Set A, but your active DNS records were created on Nameserver Set B.
ICANN clientHold Status: ICANN requires domain registrants to verify their contact email address within 15 days of purchase or update. Failure to click the verification link causes the registrar to suspend DNS resolution with a clientHold status.
Expired Domain Registration: The domain registration expired and passed into redemption grace period, causing the registrar to replace your nameservers with parking pages.
Stale Local DNS Resolver Cache: Your local computer, operating system, or home router cached an older negative DNS response before recent DNS changes finished propagating.

Before You Start

Determine which company manages your authoritative DNS. If your domain nameservers point to Cloudflare, you must edit records inside the Cloudflare dashboard, not your web hosting cPanel or registrar.
For complex domain migrations, consult our server migration services team to avoid DNS downtime.

Step 1 — Query Public DNS Resolvers Using dig

First isolate whether the DNS failure affects the entire internet or only your local computer network.

Run dig against Google’s public resolver (8.8.8.8):

dig @8.8.8.8 yourdomain.com A

Sample NXDOMAIN Response

;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 41209
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

status: NXDOMAIN confirms that Google’s global resolvers cannot locate an active DNS record. The issue is at the DNS provider or registrar level. Proceed to Step 2.
If it returns an IP address (e.g. 203.0.113.10): The DNS record is live globally. The problem is your local computer’s cached DNS. Proceed to Step 5 (Flush DNS).

Step 2 — Check Domain Registration and WHOIS Status

Verify that the domain name is registered, active, and not suspended by the registrar.

Run whois on the domain:

whois yourdomain.com | grep -i -E "Registry Expiry Date|Domain Status|Status"

What to Look For

Domain Status: clientHold https://icann.org/epp#clientHold
Registry Expiry Date: 2026-09-02T12:00:00Z

How to Fix WHOIS Issues:

If you see clientHold or serverHold: The domain registrar suspended resolution because your contact email address was not verified, or payment failed. Log in to your domain registrar, check your account alerts, and resend the ICANN verification email.
If the Expiry Date is in the past: Renew your domain immediately through your registrar account. Once renewed, DNS resolution typically restores within 2 to 4 hours.

Step 3 — Verify Authoritative Nameservers

Check which nameservers the global internet is looking to for your DNS records:

dig yourdomain.com NS +short

Sample Output

ns1.cloudflare.com.
ns2.cloudflare.com.

The Common Mistake

If the command outputs Cloudflare nameservers, but you are creating your A records inside your web hosting cPanel (Zone Editor), the internet will never see your changes!

You must add your records to the exact provider returned by the dig NS query.

Step 4 — Add or Correct the A Record

Once you are logged into your authoritative DNS provider, check your DNS zone table.

Ensure you have two core A records configured:

Type	Name / Host	Target / Value	TTL
A	`@` (or `yourdomain.com`)	`203.0.113.10` (Your server’s public IP)	Auto / 300s
A	`www`	`203.0.113.10` (Your server’s public IP)	Auto / 300s

(Alternatively, www can be a CNAME record pointing to yourdomain.com).

Save the records. If using Cloudflare, verify whether the proxy status is set to Proxied (Orange Cloud) or DNS Only (Grey Cloud) depending on your SSL configuration.

Step 5 — Flush Local DNS Cache and Reset Resolvers

If public resolvers (like 8.8.8.8) return the correct IP but your personal browser still shows DNS_PROBE_FINISHED_NXDOMAIN, your local device is holding a stale negative cache entry.

On Windows (Command Prompt / PowerShell):

ipconfig /flushdns

On macOS (Terminal):

sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

On Linux (systemd-resolved):

sudo systemd-resolve --flush-caches
# Or on modern distributions:
sudo resolvectl flush-caches

Clear Google Chrome’s Internal DNS Cache:

Open Chrome and navigate to: chrome://net-internals/#dns
Click the Clear host cache button.
Restart the browser.

Step 6 — Trace Complete DNS Propagation

Use dig +trace to watch the complete hierarchical resolution from the Root DNS servers down to your authoritative nameserver:

dig +trace yourdomain.com

Confirm that the bottom lines show an authoritative A record returned directly from your nameservers without any NXDOMAIN status codes.

Common Mistakes

Forgetting the @ symbol for the root domain: Leaving the hostname blank in some DNS panels causes them to reject the record. Use @ to denote the root domain.
Expecting instant global propagation with high TTL: If your previous DNS records had a Time-to-Live (TTL) of 86400 (24 hours), some internet service providers (ISPs) will cache the old state for up to a full day. Lower your TTL to 300 (5 minutes) before planned migrations.
Typing the wrong IP address: Pointing your A record to an internal private IP (like 192.168.1.1 or 10.0.0.5) instead of your server’s public internet-facing IP.

Prevention Checklist

Set DNS TTL to 300s (5 minutes) 48 hours prior to website migrations.
Enable auto-renewal on all critical domain names at your registrar.
Regularly verify WHOIS administrative contact email addresses to avoid ICANN suspension.
Review our cPanel support and server migration services for zero-downtime DNS cutovers.

Quick Reference Commands

Task	Command
Query Google DNS	`dig @8.8.8.8 yourdomain.com A +short`
Query Cloudflare DNS	`dig @1.1.1.1 yourdomain.com A +short`
Check authoritative NS	`dig yourdomain.com NS +short`
Full DNS trace	`dig +trace yourdomain.com`
Flush Windows DNS	`ipconfig /flushdns`
Flush Linux DNS	`sudo resolvectl flush-caches`

Frequently Asked Questions

What does NXDOMAIN stand for?

NXDOMAIN stands for Non-Existent Domain. It is an official DNS status code defined in RFC 1035 that informs the querying client that the requested domain name does not exist within the authoritative namespace.

How long does it take for NXDOMAIN to clear after adding an A record?

If you just added the missing A record, most public resolvers (Cloudflare, Google, OpenDNS) pick up the record within 5 to 15 minutes. Some regional ISPs with aggressive caching can take between 2 to 24 hours to fully update.

Can an incorrect SSL certificate cause DNS_PROBE_FINISHED_NXDOMAIN?

No. An SSL error results in SSL_ERROR_ or NET::ERR_CERT_ status codes. A DNS error occurs before any SSL/TLS handshake or web server connection can even be initiated.

How does ServerCare360 help manage DNS and domain migrations?

Our server migration and outsourced technical support engineers configure redundant Anycast DNS records, manage TTL ramp-downs, monitor global propagation across 30+ regional nodes, and ensure zero-downtime domain cutovers.