Nameservers unreachable

Your domain's nameservers aren't responding to DNS queries. DomainDash's DNS check shows Failing (error code nameservers_unreachable), and because nothing can resolve your domain the site itself shows as Down: every resolver trying to look up your domain hits the same dead end.

Symptom

• DomainDash marks the DNS check as Failing (error code nameservers_unreachable), and the site shows as Down because it can't be reached
• Browsers show "This site can't be reached" or a DNS-related error across all networks, not just yours
• Running dig +trace example.com shows the resolution chain stopping or timing out at the nameserver step
• dig example.com returns SERVFAIL (the resolver couldn't get an answer from your nameservers)
• The issue affects all visitors globally, not just a local caching problem

What it means

Your domain's nameservers are the servers that hold the authoritative answer for your DNS records. When a resolver wants to know the IP address for example.com, it eventually asks your nameservers, and only they can answer. If they're unreachable, every resolver in the world hits the same wall, and your domain returns SERVFAIL to anyone who queries it.

The most common scenario: the nameservers listed in your registrar's records are wrong. They point to nameservers that either don't exist or aren't configured to serve your zone. This happens after provider migrations or domain transfers.

Less commonly, your DNS provider itself is having an outage, and the nameservers are physically unreachable. This is rare for major providers, but when it happens there's nothing to fix on your end while it lasts.

The SERVFAIL response is the tell: NXDOMAIN means "no records for this domain"; SERVFAIL means "I couldn't get an answer from the nameservers at all".

Without a check in place, the first sign this has happened is usually a customer email, by which point your site has been dark for a while. DomainDash spots the outage on its next check and tells you, so you hear it first instead of finding out from a customer.

Common causes

• DNS provider is experiencing an outage affecting nameserver availability
• NS records at the registrar still point to old nameservers from a previous DNS provider
• A domain transfer moved the domain to a new registrar but NS records weren't updated
• Nameservers were configured at the DNS provider but the registrar still shows placeholder NS records
• The DNS provider account was suspended or closed, taking the nameservers offline
• DNSSEC DS records are still published at the registrar after nameservers were migrated, causing DNSSEC validation to fail

How to fix

1. Confirm the nameservers are the problem. Run a trace:

   dig +trace example.com

   This walks the resolution chain from root servers down to your nameservers. If it stops or times out at the last hop, the nameservers are unreachable. Also run:

   dig NS example.com

   Note the nameservers returned: these are the servers at fault.

2. Check your DNS provider's status page. If this is a provider outage (Cloudflare, AWS Route 53, Google Cloud DNS, etc.), check their status page (cloudflarestatus.com, status.aws.amazon.com, and so on). A widespread nameserver incident will be documented there. If there's an active incident, the fix is to wait for resolution; there's nothing you can do on your DNS records in the meantime.

3. Verify the NS records at your registrar. Log in to the registrar where you bought your domain (this may be different from your DNS provider). Compare the nameservers listed there against what dig NS example.com returns. If they don't match (common after migrating DNS providers), update the NS records at your registrar to point to your current provider's nameservers. Your DNS provider's setup guide will give you the exact nameserver hostnames to use. NS record updates at the registrar typically take 30 minutes to 24 hours to take effect.

4. Query the nameservers directly. Once you've identified the nameservers responsible for your domain, query them directly:

   dig example.com @ns1.yourprovider.com

   Replace ns1.yourprovider.com with the actual nameserver hostname. If this returns your DNS records, the nameserver is up and serving your zone, and the problem is likely the NS records at the registrar not yet pointing to it. If this times out or returns REFUSED, the nameserver isn't configured to serve your zone.

5. Migrate to a working DNS provider if necessary. If your provider is down for an extended period and you need your domain back urgently: export your DNS records (most providers offer a zone file export), import them into a new provider (Cloudflare, AWS Route 53, and Bunny DNS all have free tiers), then update the NS records at your registrar. DomainDash will detect the fix at its next DNS check once NS propagation completes, so you don't need to do anything in the app.

How to verify

After fixing:

1. Run dig +trace example.com. The trace should now complete all the way to your nameservers and return your DNS records.
2. Run dig example.com @8.8.8.8. This should return an IP address in the ANSWER section.
3. In DomainDash, open the site and wait for the next DNS check. The DNS status should move from Failing to Healthy once the trace completes cleanly. There's nothing to click; it re-checks on its normal schedule.

If dig still shows SERVFAIL, the NS record update at your registrar may still be propagating. Wait 30–60 minutes and try again.

Related

• No A or AAAA records — if the nameservers are reachable but have no address records
• DNS changes not propagating — if you've updated NS records but they haven't taken effect everywhere yet
• Domain not resolving — if you're not sure which DNS issue you have
• DNS health — how DomainDash runs DNS checks