DNS_PROBE_FINISHED_NXDOMAIN

NXDOMAIN is not a failure to look something up. It is a successful lookup that returned a definite negative: The DNS system was asked whether this name exists and said no.

That distinction matters, because it narrows things considerably. Your network is working. Your resolver is reachable and answering. The question got asked and got a reply. The reply was "there is no such domain".

The four reasons you see it

1. A typo

By a wide margin the most common. A missing letter, a wrong TLD, an extra character. It is worth actually reading the address bar before doing anything else, because this is the answer most of the time.

2. The domain genuinely does not exist

It expired, was never registered, or was suspended. Domain expiry is more common than people assume and produces an abrupt, total NXDOMAIN for every hostname under the domain simultaneously - A very distinctive signature.

3. The domain exists but its nameservers are broken

The subtle case. If a domain's authoritative nameservers are unreachable or misconfigured, resolvers may return NXDOMAIN even though the domain is registered and paid for. Registrar changes go wrong this way: Nameservers are updated at the registry, the new ones are not yet configured, and the domain vanishes for everyone.

This is also what a catastrophic routing withdrawal looks like from outside. In the 2021 Meta outage, the nameservers themselves became unreachable, so every Meta hostname returned NXDOMAIN worldwide - The domains were fine, and nothing could find out.

4. Your resolver is wrong

The name exists, and your particular resolver is returning NXDOMAIN anyway. Causes include a poisoned or stale negative cache, an ISP resolver having a bad day, DNS filtering at the router or network level (many parental control and ad-blocking systems return NXDOMAIN for blocked domains), or a VPN pushing its own resolver that cannot see public names properly.

The test

Ask a different resolver the same question.

nslookup example.com 1.1.1.1

Or on macOS and Linux:

dig @8.8.8.8 example.com

Three possible outcomes, each conclusive:

• It returns an address. The domain is fine and your normal resolver is the problem. Flush your cache, and if that does not fix it, switch resolvers.
• It also returns NXDOMAIN. The domain genuinely does not resolve anywhere. Nothing on your side will help.
• It times out. A network or firewall problem rather than DNS specifically.

Without a terminal, the equivalent test is trying the site on mobile data, which uses your carrier's resolver instead of your home one.

Fixing it when it is your side

1. Flush the local cache. Windows: ipconfig /flushdns. macOS: sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder. Linux varies by resolver daemon.
2. Flush the browser cache too. Chrome keeps its own at chrome://net-internals/#dns.
3. Restart the router. Routers cache DNS and some cache negative answers for a long time. This is one of the few situations where rebooting the router is genuinely the right move.
4. Change resolver. Setting the device to 1.1.1.1 or 8.8.8.8 bypasses the ISP resolver entirely and is the most reliable fix - Step by step, per platform.
5. Check your hosts file. An entry there overrides DNS completely, and some software adds entries you did not ask for.
6. Disconnect the VPN. A VPN that pushes its own resolver can fail to resolve public names.

The full cache-clearing guide has the exact commands for each platform.

Negative caching, and why it persists

DNS caches negative answers as well as positive ones, governed by a value in the domain's SOA record. If you tried a domain seconds before its records became valid, your resolver may hold the NXDOMAIN for anywhere from minutes to hours - And every retry during that window returns the cached negative rather than asking again.

This is the main reason a newly registered or newly repointed domain works for other people and not for you. Flushing local caches helps; the resolver's own cache you cannot touch, which is why switching resolvers is sometimes the only quick fix.

If it is your domain

Check, in order: That the registration has not expired; that the nameservers listed at the registrar match the ones actually serving the zone; that the zone contains the record you expect; and that the delegation is consistent at the parent. A public DNS diagnostic tool will check all four in one pass and tell you which is wrong.

And remember DNSSEC. A domain with a broken DNSSEC chain returns SERVFAIL on validating resolvers and works fine on non-validating ones, which produces the bewildering situation where a site works for half your users and not the other half.