SERVFAIL signals a failed lookup, while NXDOMAIN signals a name that does not exist. They need different investigations because SERVFAIL points to server or validation trouble and NXDOMAIN points to a wrong or missing entry. DNS turns a domain into the address a browser loads. When that step returns an error, WordPress, Drupal, marketing pages and ad landing pages can all fail at once.
Table of Contents
- What each response means
- Why SERVFAIL points to the server path
- Why NXDOMAIN points to the name
- How to triage the failure safely
What each response means
NXDOMAIN means the authoritative server, the source for your zone, replied that the exact name has no record. The lookup completed, but nothing matched. Visitors may see a browser error about an unknown address. SERVFAIL means the recursive resolver, the service that chases the answer for visitors, could not return a valid result.
Causes include down nameservers, broken delegation between parent and child zones, or failed security validation. The result can vary by location and retry. A simple contrast helps. NXDOMAIN for shop.example.com with an answer for example.com often means the host entry is missing. SERVFAIL for the whole domain on several networks often means the delegation or nameserver setup is broken.
Why SERVFAIL points to the server path
Start with delegation and nameservers. Delegation is the parent zone pointing to your nameservers. If those pointers are wrong, or the servers do not respond with authority, resolvers return SERVFAIL. Then check security validation and limits.
Validation is the extra signature check that rejects tampered or expired data. Expired signatures, wrong clocks, or a failed transfer to a secondary server can trigger failure. A SERVFAIL that moves or clears on retry still deserves a server check. Intermittent failure often means one nameserver answers while another times out.
- test the domain from two separate networks and note whether failures vary
- query the authoritative nameservers directly for the failing name
- review recent changes to nameservers, delegation, or signature settings
- ask the DNS host to check server logs and response size
Why NXDOMAIN points to the name
Check spelling, full host, and suffix. Many outages come from a missing www, a typo, or a staging name that was never published. Compare the failing address letter by letter with the address in your zone. Then check registration and zone contents.
Registration keeps your right to use the domain, while the zone holds the actual entries. An expired domain, a rebuilt zone, or a move between hosts can drop individual entries. For WordPress and Drupal teams, test the apex, the root domain without www, and www separately. A missing www entry leaves the main page working while links and landing pages fail.
- confirm the exact failing URL, including www and subdomains
- look for the name in the current zone, not an old export
- confirm the domain is active with its registrar
- confirm recent moves, deletions, or automated cleanup did not remove the entry
How to triage the failure safely
Capture the failure before changing anything. Record the full address, error code, time, network, and a screenshot of the resolver message. Small details separate a local cache issue from a site-wide fault. Isolate cache from authority.
Local cache is temporary stored data, while authority is the live zone source. Retest with a fresh network or cleared lookup, then query authority directly. If SERVFAIL persists after local checks, send the host the failing name, timestamps, resolver messages, and direct query results. If NXDOMAIN persists for a name you need, recreate that entry and verify it answers from authority before updating links.
- record error code, address, time, and network
- retest apex and www plus one unaffected address
- check domain status and zone entries before editing
- change one setting at a time and retest
