If a site opens by IP address but not by its domain name, the server is often running and the failure is in the hostname path: DNS records, name-server delegation, cached answers, DNSSEC, or—if DNS already works—TLS and virtual-host handling. Check the exact hostname first, compare several public resolvers, then inspect authoritative servers before changing web-server settings.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What the symptom actually proves
A browser normally resolves a hostname to an address before it connects. Entering an IP skips that lookup, so a successful IP test proves only that some service answered at that address. It does not prove that example.com resolves correctly, that www.example.com points to the same server, or that the web server is configured to serve the requested hostname.
As an Amazon Associate I earn from qualifying purchases.
The error text narrows the search. DNS_PROBE_FINISHED_NXDOMAIN means the resolver completed its lookup and concluded that the requested domain does not exist in DNS. A missing record, a broken delegation, or an incorrectly entered hostname can produce that result. SERVFAIL means the resolver could not obtain a usable answer; DNSSEC and unreliable authoritative servers are common areas to investigate. A timeout or intermittent result can indicate a resolver-path problem, overloaded or unreachable authoritative servers, or conflicting DNS data.
| What you observe | Most useful first check |
|---|---|
| IP works; hostname returns NXDOMAIN | Check the spelling, the zone apex, and the requested subdomain’s A, AAAA, or CNAME record. |
| Some networks work; others fail | Query several public resolvers and compare their answers and TTLs. |
| All resolvers return SERVFAIL | Inspect delegation, DNSSEC DS/DNSKEY data, and every authoritative server. |
| DNS returns the expected IP, but the page fails | Test TLS, the HTTP Host header, virtual-host rules, firewalls, and IPv6. |
| Results change after a DNS edit | Check TTL caching and whether the edit was made in the active DNS zone. |
1. Verify the exact hostname and its records
Separate the apex from each subdomain
example.com, www.example.com, and blog.example.com are separate DNS names. A record for the apex does not automatically create a record for www. Check the hostname shown in the browser’s address bar, including spelling, hyphens, and the presence or absence of www. Also test the exact protocol and port you use; an HTTPS failure can be unrelated to an HTTP result.
#1 Best Overall
- DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
- AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
- CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
- EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
- OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
Inspect A, AAAA, and CNAME answers
An A record supplies an IPv4 address, an AAAA record supplies an IPv6 address, and a CNAME points a name at another hostname. Query each type explicitly so that a stale or unexpected IPv6 answer is not overlooked:
dig example.com A
dig example.com AAAA
dig www.example.com A
dig www.example.com AAAA
dig www.example.com CNAMEOn Windows, the equivalent interactive tool is:
nslookup -type=A example.com
nslookup -type=AAAA example.com
nslookup -type=CNAME www.example.comCompare every returned address with the current origin documented by your hosting service. Cloudflare notes that missing records can trigger DNS probe errors and recommends checking the zone apex, active subdomains, and origin address. If the answer is empty, points to an old server, or contains a typo, correct the record in the DNS provider that is actually authoritative for the domain.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsDo not treat an IP-only success as a complete web test
Web servers commonly host several sites on one address. A request made directly to the IP may receive a default site, while a request carrying your domain’s Host header is routed elsewhere. Therefore, record correction is still required even when an IP entered in a browser displays a page.
2. Compare independent DNS resolvers
Run the same query against more than one resolver. Google Public DNS uses 8.8.8.8, Cloudflare’s public resolver uses 1.1.1.1, Quad9 uses 9.9.9.9, and OpenDNS uses 208.67.222.222. For example:
dig @8.8.8.8 example.com A
dig @1.1.1.1 example.com A
dig @9.9.9.9 example.com A
dig @208.67.222.222 example.com AWith nslookup, specify the resolver on the command line:
nslookup example.com 8.8.8.8
nslookup example.com 1.1.1.1- If all public resolvers fail in the same way, concentrate on the domain’s delegation, records, or authoritative servers. Google Public DNS troubleshooting describes this pattern as most likely a domain-side problem.
- If only one resolver fails, the issue may be that resolver’s cache, filtering, or route. Test from another network and temporarily use a different resolver to confirm the scope.
- If answers differ, inspect the TTL shown in each response. Different answers can be legitimate during a cached transition, but persistent disagreement after the TTL expires suggests multiple active DNS providers, inconsistent authoritative servers, or edits in the wrong zone.
Record the response status, answer, authority section, and TTL from each query. Those details are more useful to a registrar or DNS operator than a screenshot of a browser error.
Rank #2
- Dual-band Wi-Fi with 5 GHz speeds up to 867 Mbps and 2.4 GHz speeds up to 300 Mbps, delivering 1200 Mbps of total bandwidth¹. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance to devices, and obstacles such as walls.
- Covers up to 1,000 sq. ft. with four external antennas for stable wireless connections and optimal coverage.
- Supports IGMP Proxy/Snooping, Bridge and Tag VLAN to optimize IPTV streaming
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
- Advanced Security with WPA3 - The latest Wi-Fi security protocol, WPA3, brings new capabilities to improve cybersecurity in personal networks
3. Inspect delegation and authoritative DNS
Find the delegated name servers
The registrar publishes NS records that tell the internet which servers are authoritative. Query them and follow the chain:
dig example.com NS
dig +trace example.comThe name servers shown at the registrar must exactly match the name servers assigned by the active DNS provider. A mismatch means you may be editing one provider’s zone while resolvers are asking another provider for the answer. Cloudflare identifies mismatched registrar name servers as a cause of failed resolution; DigitalOcean lists incomplete name-server propagation, incorrect registrar configuration, and multiple active DNS providers among common causes.
Query every authoritative server directly
After identifying the NS hostnames, obtain their addresses and query each one. Replace the example server name with every NS returned for your domain:
dig ns1.dns-provider.example example.com A
dig @ns1.dns-provider.example example.com A
dig @ns2.dns-provider.example example.com AAll authoritative servers should provide consistent records and status codes. If one server has the new address and another still has the old address, the provider’s zone is not synchronized. If none answers, the server may be unreachable or the delegation may be wrong. If you recently moved DNS, remove obsolete provider entries at the registrar only after the replacement provider has a complete, tested zone.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteLook for duplicate hosted zones
DNS services can contain more than one zone with the same domain name. AWS documentation warns that edits made in a duplicate hosted zone have no effect when the registrar still delegates to a different zone. Compare the NS set displayed in the provider dashboard with the registrar’s delegation before making further changes.
4. Account for TTL, caching, and propagation
Every DNS record has a TTL (time to live), measured in seconds. AWS defines TTL as the period for which resolvers may cache information such as a web server’s IP address. During that period, a resolver can legally continue returning an old answer even after the authoritative record has changed.
Rank #3
- NIGHTHAWK WIFI 6 ROUTER FOR YOUR WHOLE HOME: Delivers fast, reliable WiFi across every room of your apartment or small home for streaming, gaming, video calls, and smart home devices, all running at the same time without slowing each other down.
- WORKS WITH YOUR EXISTING INTERNET SERVICE: Pairs with your existing modem or gateway via ethernet. Compatible with most cable, fiber, DSL, and satellite providers. Some gateways and modem router combos may require bridge mode. No coax needed.
- SET UP AND MANAGE YOUR NETWORK WITH THE NIGHTHAWK APP: Download the free Nighthawk app on iOS or Android for guided setup. Manage WiFi, run speed tests, pause devices, and set up guest networks from anywhere. Active internet required.
- READY FOR THE DEVICES YOU ALREADY OWN: Your phones, laptops, and TVs work right out of the box. WiFi 6 delivers speeds up to 1.8 Gbps across 2.4 GHz and 5 GHz bands. Backward compatible with WiFi 5 and earlier.
- COVERAGE IN EVERY ROOM: Covers up to 1,500 sq. ft. for up to 20 connected devices. Walls, floors, and interference can reduce range. Larger or multi-story homes may benefit from a NETGEAR Orbi mesh WiFi system.
There is no universal propagation time. A low-TTL A record may update quickly, while a registrar name-server change can take substantially longer because parent-zone and resolver caches are involved. DigitalOcean’s 2026 support guidance says name-server changes usually take 24–48 hours to update completely; treat that as a typical expectation, not a guarantee or a rule for every record.
Flush caches only after authoritative data is correct
Flushing a local cache cannot repair a wrong authoritative record. Once the authoritative queries return the intended value, clear local caches if your computer still shows the old result:
Recommended Free Tools
- Windows: run
ipconfig /flushdnsin Command Prompt. - macOS: run
sudo dscacheutil -flushcachefollowed bysudo killall -HUP mDNSResponder. - Linux with systemd-resolved: run
sudo resolvectl flush-caches.
Browsers can maintain their own host cache, and managed networks may cache DNS upstream. Test with a different network or resolver rather than repeatedly refreshing one browser tab.
5. Investigate DNSSEC when the status is SERVFAIL
DNSSEC adds signatures that allow resolvers to validate DNS answers. A broken chain can cause validating resolvers to return SERVFAIL even though a non-validating query appears to have an answer. Google advises comparing a normal query with a DNSSEC-aware result from dns.google; if the latter returns SERVFAIL while queries without DNSSEC succeed, investigate the DNSSEC chain.
Check the DS and DNSKEY relationship
- Stale DS record: a DS record left at the registrar after moving DNS providers can point to a key that no longer exists.
- Mismatched DNSKEY: the authoritative zone may publish keys that do not match the DS record in the parent zone.
- Expired or invalid signatures: signed records can fail validation when their signatures are expired or generated incorrectly.
- Incomplete key rollover: removing an old key before caches have expired can break validation for resolvers that still hold the old DS information.
Use DNSViz or a DNSSEC Analyzer to visualize the chain from the parent zone to the authoritative servers. Correct the registrar’s DS data or the provider’s signing configuration in a coordinated change; do not randomly delete DNSSEC records.
Check response size and transport fallback
DNSSEC responses can be larger than ordinary DNS responses. Authoritative servers must signal UDP truncation correctly and accept the resolver’s retry over TCP. A server that blocks TCP/53, mishandles truncated packets, or imposes an overly strict response limit can produce SERVFAIL even with otherwise correct keys.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #4
- 𝐅𝐮𝐭𝐮𝐫𝐞-𝐑𝐞𝐚𝐝𝐲 𝐖𝐢-𝐅𝐢 𝟕 - Designed with the latest Wi-Fi 7 technology, featuring Multi-Link Operation (MLO), Multi-RUs, and 4K-QAM. Achieve optimized performance on latest WiFi 7 laptops and devices, like the iPhone 16 Pro, and Samsung Galaxy S24 Ultra.
- 𝟔-𝐒𝐭𝐫𝐞𝐚𝐦, 𝐃𝐮𝐚𝐥-𝐁𝐚𝐧𝐝 𝐖𝐢-𝐅𝐢 𝐰𝐢𝐭𝐡 𝟔.𝟓 𝐆𝐛𝐩𝐬 𝐓𝐨𝐭𝐚𝐥 𝐁𝐚𝐧𝐝𝐰𝐢𝐝𝐭𝐡 - Achieve full speeds of up to 5764 Mbps on the 5GHz band and 688 Mbps on the 2.4 GHz band with 6 streams. Enjoy seamless 4K/8K streaming, AR/VR gaming, and incredibly fast downloads/uploads.
- 𝐖𝐢𝐝𝐞 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 𝐰𝐢𝐭𝐡 𝐒𝐭𝐫𝐨𝐧𝐠 𝐂𝐨𝐧𝐧𝐞𝐜𝐭𝐢𝐨𝐧 - Get up to 2,400 sq. ft. max coverage for up to 90 devices at a time. 6x high performance antennas and Beamforming technology, ensures reliable connections for remote workers, gamers, students, and more.
- 𝐔𝐥𝐭𝐫𝐚-𝐅𝐚𝐬𝐭 𝟐.𝟓 𝐆𝐛𝐩𝐬 𝐖𝐢𝐫𝐞𝐝 𝐏𝐞𝐫𝐟𝐨𝐫𝐦𝐚𝐧𝐜𝐞 - 1x 2.5 Gbps WAN/LAN port, 1x 2.5 Gbps LAN port and 3x 1 Gbps LAN ports offer high-speed data transmissions.³ Integrate with a multi-gig modem for gigplus internet.
- 𝐎𝐮𝐫 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐂𝐨𝐦𝐦𝐢𝐭𝐦𝐞𝐧𝐭 - TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
6. Test authoritative-server reliability
Query every authoritative server repeatedly from more than one network. Look for timeouts, different A or AAAA answers, intermittent SERVFAIL, or one server that never responds. Google recommends verifying that all authoritative servers answer consistently, support UDP truncation and TCP retry, and do not block legitimate resolver traffic or impose inappropriate limits.
If only one authoritative server is unhealthy, ask the DNS provider to repair or replace it. If all are unreachable, verify that the domain has not expired, the delegation has not been suspended, and firewall rules allow DNS queries. A local browser refresh cannot fix an authoritative outage.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. When DNS resolves but the website still fails
Once public resolvers return the expected address, the problem has moved above DNS. Test the HTTP and HTTPS paths while preserving the hostname:
curl -I http://example.com
curl -I https://example.com
curl --resolve example.com:443:203.0.113.10 https://example.com/The --resolve test forces a chosen address but still sends the domain as the TLS Server Name Indication and HTTP Host value. It distinguishes DNS from certificate and virtual-host behavior. An HTTPS error with this test points to certificate coverage, certificate chain, SNI routing, or the server’s TLS configuration rather than name resolution.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Check virtual hosts and the Host header
Ensure the web server has a site definition for the exact hostname, including both the apex and www if both are used. A server can answer at the IP while returning a default site or a 404 for an unrecognized Host header. Reverse proxies and content-delivery layers must also have the hostname enabled and directed to the correct origin.
Check IPv6 separately
If an AAAA record exists, many clients prefer IPv6. A broken IPv6 route can make the domain appear down even while IPv4 and direct-IP testing work. Compare:
Best Value
- Dual band router upgrades to 1200 Mbps high speed internet (300mbps for 2.4GHz plus 900Mbps for 5GHz), reducing buffering and ideal for 4K stream
- Full Gigabit Ports - Gigabit Router with 4 Gigabit LAN ports, ideal for any internet plan and allow you to directly connect your wired devices
- Boosted Coverage - Four external antennas equipped with Beamforming technology extend and concentrate the Wi-Fi signals
- MU-MIMO technology - (5GHz band) allows high speeds for multiple devices simultaneously
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
curl -4 -I https://example.com
curl -6 -I https://example.comIf IPv4 succeeds and IPv6 fails, repair the IPv6 address, routing, firewall, or origin listener, or remove the AAAA record until IPv6 is correctly configured. Do not leave an unreachable AAAA record in place simply because the A record works.
Review firewalls and redirects
Confirm that ports 80 and 443 are open at the origin, load balancer, and any network firewall. Check redirect rules for loops between HTTP and HTTPS or between the apex and www. These are web-server issues and require configuration changes at the hosting or proxy layer, not DNS edits.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choosing or changing a DNS provider without repeating the problem
If you are moving DNS, evaluate the operational features that affect failure recovery rather than choosing on a single advertised speed claim.
| Evaluation area | Questions to ask |
|---|---|
| Registrar and delegation workflow | Can you see the assigned NS values clearly, and is the change process documented? |
| Record support | Are A, AAAA, CNAME, TXT, MX, and required verification records supported at the names you need? |
| DNSSEC | Does the service support signing, key rollover, DS management, and validation diagnostics? |
| TTL controls | Can you set record-specific TTLs and lower them before a planned migration? |
| Visibility and diagnostics | Are authoritative answers, query status, and propagation views available when troubleshooting? |
| Authoritative reliability | Are multiple authoritative servers geographically and operationally independent, with TCP fallback? |
| Migration handling | Can you import the complete zone, verify it, and keep the old provider active until delegation is confirmed? |
| Monitoring and support | Will the service alert you to expired domains, DNSSEC failures, or inconsistent authoritative answers? |
Before changing NS records, copy every existing record, recreate it at the new provider, verify the new zone directly, and only then update the registrar. Keep the old zone available through the expected cache period.
End-to-end recovery checklist
- Copy the exact failing hostname from the browser and check its spelling and protocol.
- Query its A, AAAA, and CNAME records and compare the answers with the intended origin.
- Run the same queries through Google Public DNS, Cloudflare, Quad9, and OpenDNS.
- Query the domain’s NS records and confirm that the registrar delegates to the active DNS provider.
- Use
dig +traceand direct queries to every authoritative server. - Resolve duplicate hosted zones or multiple active providers before editing records again.
- Check TTLs and allow the relevant cache period; DigitalOcean’s 24–48-hour figure applies to many name-server changes, not every DNS edit.
- If the status is SERVFAIL, inspect DS, DNSKEY, signatures, UDP truncation, and TCP fallback with DNSSEC diagnostic tools.
- After authoritative data is correct, flush local and browser caches and retest from another network.
- If DNS now returns the expected IP, test TLS, Host-header routing, virtual hosts, firewalls, redirects, and IPv6 with
curl.
The decisive boundary is simple: if independent resolvers cannot obtain the right address, keep working on DNS, delegation, caching, DNSSEC, or authoritative availability. If they can, stop changing DNS and troubleshoot the web server and network path that receive the hostname.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
