DNS Resolution Errors

Understanding DNS errors

DNS errors are best diagnosed by working down the delegation chain: root, TLD, authoritative nameserver, then the record itself. The most common mistake is testing only through your local resolver, which caches both good and bad answers and hides where the failure actually is. NXDOMAIN means the name definitively does not exist; SERVFAIL means the resolver could not get a valid answer, which is usually a DNSSEC or authoritative-server problem, not a typo.

How to debug DNS errors

1. Query the authoritative nameserver directly, bypassing all caches: dig @ns1.example.com example.com A. If that answers correctly, you have a caching or propagation issue, not a records issue.
2. Trace the full delegation with dig +trace example.com. This shows exactly which level of the hierarchy stops returning answers.
3. Distinguish NXDOMAIN from SERVFAIL from timeout. They have three entirely different causes. Check the status: line in dig output.
4. For SERVFAIL, test with DNSSEC validation disabled: dig +cd example.com. If that succeeds, the problem is a broken DNSSEC chain, often after a key rollover.
5. Check TTLs before declaring propagation broken. A record with a 24-hour TTL genuinely will not update for resolvers that cached it, and there is no way to force them.

Tools worth reaching for

• dig +trace
• dig @authoritative-ns
• dig +cd (DNSSEC bypass)
• kdig
• resolvectl status

All 20 DNS errors

• Bad Gateway - DNS resolutionReverse proxy cannot resolve the upstream server's hostname to an IP address.
• dig: ;; Truncated, retrying in TCP mode NewThe answer did not fit in the UDP message size the client offered, so the server set the TC bit and the client started…
• dig: status: SERVFAIL with EDE: 6 (DNSSEC Bogus) NewThe resolver fetched the answer but its DNSSEC signatures did not validate, so it refused to return it. Extended DNS…
• DNS cache poisoning detectedDNS resolver returned suspicious results, possibly indicating cache poisoning attack.
• DNS lookup timeoutDNS query took too long to complete, often due to slow or unresponsive DNS servers.
• DNS NXDOMAINDomain name does not exist in DNS, the queried domain is not registered or configured.
• DNS problem: NXDOMAIN looking up TXT for _acme-challenge.example.com NewLet's Encrypt queried the authoritative servers for the DNS-01 challenge record and was told the name does not exist…
• DNS resolution failedThe domain name could not be resolved to an IP address. DNS server may be unreachable or the domain doesn't exist.
• DNS server unreachableConfigured DNS servers are not responding, preventing domain name resolution.
• DNS: CNAME and other data (CNAME at the zone apex) NewA name may hold a CNAME or it may hold other record types, never both, so a CNAME on the zone apex collides with the…
• DNS: CNAME loop detectedA CNAME record points to another CNAME that eventually points back, creating a circular reference that cannot be…
• DNS: REFUSED NewThe server answered and declined to do the work, which is what separates this from a timeout or NXDOMAIN. In practice…
• DNS: SERVFAILThe DNS server failed to complete the query. The authoritative server may be down, DNSSEC validation failed, or…
• DNS: Transfer refused (AXFR)A DNS zone transfer (AXFR) request was denied. Zone transfers are typically restricted to authorised secondary…
• dnsmasq: failed to create listening socket for port 53: Address already in use NewSomething else already owns port 53. On Ubuntu and Fedora that is almost always the systemd-resolved stub listener on…
• Name resolves with dig but not from the application Newdig talks to a server directly, while the application goes through the stub resolver on 127.0.0.53, which keeps its…
• Slow DNS in Kubernetes pods: each lookup tries every search domain first NewPods get ndots:5 in resolv.conf, so any name with fewer than five dots, api.example.com included, is first tried with…
• Temporary failure in name resolution (EAI_AGAIN) NewThe resolver received no usable answer at all, rather than a negative one, so the problem is the path to the resolver…
• Using degraded feature set UDP instead of UDP+EDNS0 for DNS server Newsystemd-resolved probes each upstream server for EDNS0 and DNSSEC support and steps down when replies look broken. The…
• zone example.com/IN: NS 'ns1.example.com' has no address records (A or AAAA) NewThe zone lists a name server inside itself but never gives that server an A or AAAA record, so nobody could find it…

Other categories

• AI 35Rate limits, context windows, GPU memory and model-serving failures.
• Ansible 18Unreachable hosts, become passwords, undefined variables and Jinja2 failures.
• API 20Auth headers, payload limits, versioning, idempotency and webhook signatures.
• Apple 20Command line tools, dyld, Homebrew permissions, notarisation and Keychain.
• Auth 20OIDC, SAML, Auth0, Okta, Keycloak, passkeys and MFA failures.
• BigData 17Spark, Kafka, Airflow, Snowflake, Flink and Databricks failures.
• C# 18NuGet restore, null references, EF Core migrations, async deadlocks and Blazor…
• C++ 20Segfaults, linker errors, memory corruption and template deduction failures.
• Caching 20Cache stampedes, stale content, Varnish and CloudFront failures.
• CI/CD 18GitHub Actions, GitLab CI, Jenkins, CircleCI: permissions, runners and…
• Client 21CORS, mixed content, module resolution, memory limits and framework runtime…
• Cloud 25IAM permissions, quotas, service limits and credential failures.
• Dart 20Null safety, pub version solving and build toolchain problems.
• Database 41Connections, deadlocks, constraints, replication and memory limits.
• Docker 27Daemon connectivity, disk space, image pulls, ports and architecture mismatches.
• Elixir 18GenServer timeouts, supervision failures and Mix compilation problems.
• Email 20Delivery failures, relay denial, authentication, SPF, DKIM and DMARC.
• Frontend 23Hydration mismatches, bundler resolution, layout shift and font loading.
• Git 20Merge conflicts, rejected pushes, detached HEAD, LFS and repository corruption.
• Go 19Nil map assignment, concurrent map access, context cancellation and deadlocks.
• GraphQL 19Validation, depth limits, N+1 queries and fragment problems.
• gRPC 17Status codes, deadlines, message limits, TLS and HTTP/2 transport failures.
• HTTP 494xx client errors, 5xx server errors, redirects, headers and protocol problems.
• ICMP 23Destination unreachable, time exceeded, fragmentation needed and redirects.
• Ingress 20404 default backend, missing TLS secrets, IngressClass and path matching.
• Java 19Class loading, dependency resolution, connection pools and JVM version…
• JavaScript 42npm resolution, async pitfalls, hydration, memory limits and runtime type…
• Kubernetes 34CrashLoopBackOff, ImagePullBackOff, OOMKilled, RBAC, scheduling and storage.
• Logging 18Log4j, Logback, Fluentd, Logstash and CloudWatch ingestion problems.
• MessageQueue 20Kafka, RabbitMQ, SQS, NATS and Celery: lag, rebalancing and poison messages.
• Mobile 20Gradle, CocoaPods, Xcode signing, Metro bundler and toolchain mismatches.
• Monitoring 18Prometheus scrapes, Grafana data sources, OpenTelemetry exporters and agent…
• Network 35Refused connections, timeouts, resets, MTU problems and port exhaustion.
• Performance 19GC pauses, thread pool starvation and event loop blocking.
• PHP 20Memory limits, execution timeouts, autoloading, Composer and PDO connections.
• Proxy 20nginx, Envoy, HAProxy, Traefik, Caddy and Cloudflare upstream failures.
• Python 35Imports, virtual environments, encoding, concurrency and dependency conflicts.
• Regex 17Catastrophic backtracking, back references, escaping and engine differences.
• Ruby 20Bundler, migrations, native extensions, encoding and asset compilation.
• Rust 19Borrow checker, ownership moves, trait bounds and lifetime mismatches.
• Scala 17Dependency resolution, binary compatibility and type inference failures.
• Security 25JWT validation, CSRF, OAuth grants, SELinux, SSH host keys and CSP.
• Serverless 20Lambda timeouts, package size limits, VPC networking and cold starts.
• Shell 19Command not found, permissions, quoting, expansion and Makefile syntax.
• Storage 19S3 permissions, NFS mounts, quotas, signed URLs and volume attachment.
• Svelte 20Store subscriptions, load functions and server/client boundaries.
• System 26Disk space, systemd units, file descriptors, OOM killer and scheduled jobs.
• Terraform 18State locks, provider auth, drift, dependency cycles and plan-time unknowns.
• Testing 18Jest, pytest, JUnit, Cypress and Playwright: fixtures, snapshots and timeouts.
• TLS 24Untrusted authorities, expiry, hostname mismatch, chains and cipher negotiation.
• TypeScript 19Assignability, missing declarations, strict null checks and generic constraints.
• Virtualization 20VirtualBox, VMware, Hyper-V, WSL, KVM and hypervisor conflicts.
• Web3 17Gas estimation, nonce management and reverted transactions.
• WebAssembly 17Compile errors, memory bounds and host binding mismatches.
• WebServer 20nginx, Apache, IIS and Caddy: binding, permissions, rewrites and TLS.
• Windows 20Installer failures, missing runtimes, update errors and permission problems.