Nameservers unreachable

Your domain's nameservers aren't responding to DNS queries, so every resolver trying to look up your domain hits the same dead end. DomainDash's Domain routing card shows Failing.

Symptom

• The site's Domain routing card shows Failing. If the site can't be reached, the site card shows Down. If it still responds, the site card shows Alert once the DNS incident opens (two failing DNS checks in a row)
• Browsers show "This site can't be reached" or a DNS-related error on every network
• Running dig +trace example.com shows the resolution chain stopping or timing out at the nameserver step
• dig example.com returns SERVFAIL (the nameservers returned an error, or the resolver couldn't get an answer from them) or times out with no reply at all
• The issue affects all visitors globally, so flushing your local cache doesn't help

What it means

Your domain's nameservers are the servers that hold the authoritative answer for your DNS records. When a resolver wants to know the IP address for example.com, it eventually asks your nameservers, and only they can answer. If they're unreachable, every resolver in the world hits the same wall, and your domain returns SERVFAIL to anyone who queries it.

Most often, the nameservers listed in your registrar's records are wrong. They point to nameservers that either don't exist or aren't configured to serve your zone. This happens after provider migrations or domain transfers.

Less commonly, your DNS provider itself is having an outage, and the nameservers are physically unreachable. This is rare for major providers, but when it happens there's nothing to fix on your end while it lasts.

SERVFAIL separates this from missing records. An empty answer or NXDOMAIN comes from nameservers that responded: the name has no address records, or it doesn't exist. SERVFAIL means the nameservers returned an error, or the resolver couldn't get an answer from them. A timeout means no reply at all.

DomainDash picks this up at its next DNS check.

Common causes

• DNS provider is experiencing an outage affecting nameserver availability
• NS records at the registrar still point to old nameservers from a previous DNS provider
• A domain transfer moved the domain to a new registrar but NS records weren't updated
• Nameservers were configured at the DNS provider but the registrar still shows placeholder NS records
• The DNS provider account was suspended or closed, taking the nameservers offline
• DNSSEC DS records are still published at the registrar after nameservers were migrated, causing DNSSEC validation to fail

How to fix

1. Confirm the nameservers are the problem. Run a trace:

   dig +trace example.com

   This walks the resolution chain from root servers down to your nameservers. If it stops or times out at the last hop, the nameservers are unreachable. Also run:

   dig NS example.com

   Note which nameservers it returns. These are the servers responsible for answering DNS queries for your domain.

2. Check your DNS provider's status page. If this is a provider outage (Cloudflare, AWS Route 53, Google Cloud DNS, etc.), check their status page (cloudflarestatus.com, status.aws.amazon.com, and so on). Your provider will post a widespread nameserver incident there. If there's an active incident, wait for them to resolve it. You can't fix it from your DNS records.

3. Verify the NS records at your registrar. Log in to the registrar where you bought your domain (this may be different from your DNS provider). Compare the nameservers listed there against what dig NS example.com returns. If they don't match (common after migrating DNS providers), update the NS records at your registrar to point to your current provider's nameservers. Your DNS provider's setup guide will give you the exact nameserver hostnames to use. NS record updates at the registrar typically take 30 minutes to 24 hours to take effect.

4. Query the nameservers directly. Once you've identified the nameservers responsible for your domain, query them directly:

   dig example.com @ns1.yourprovider.com

   Replace ns1.yourprovider.com with the actual nameserver hostname. If this returns your DNS records, the nameserver is up and serving your zone, and the problem is likely the NS records at the registrar not yet pointing to it. If this times out or returns REFUSED, the nameserver isn't configured to serve your zone.

5. Migrate to a working DNS provider if necessary. If your provider is down for an extended period and you need your domain back urgently: export your DNS records (most providers offer a zone file export), import them into a new provider (Cloudflare, AWS Route 53, and Bunny DNS all have free tiers), then update the NS records at your registrar and allow time for NS propagation. For future resilience, consider setting up secondary nameservers with a separate provider, as most enterprise DNS providers support this.

How to verify

After fixing:

1. Run dig +trace example.com. The trace should now complete all the way to your nameservers and return your DNS records.
2. Run dig example.com @8.8.8.8. This should return an IP address in the ANSWER section.
3. In DomainDash, open the site. Once the trace completes cleanly, the DNS check moves from Failing to Healthy at its next scheduled run.

If dig still shows SERVFAIL, the NS record update at your registrar may still be propagating. That typically takes 30 minutes to 24 hours, so try again later.

Related

• No A or AAAA records — if the nameservers are reachable but have no address records
• DNS changes not propagating — if you've updated NS records but they haven't taken effect everywhere yet
• Domain not resolving — if you're not sure which DNS issue you have
• DNS health — how DomainDash runs DNS checks