DNS resolution failed

Your domain can't be translated to an IP address, so nothing can connect to your site. Your site shows as Down in DomainDash.

Symptom

• DomainDash shows the site as Down
• Browser shows "ERR_NAME_NOT_RESOLVED", "ERR_NAME_RESOLUTION_FAILED", or "This site can't be reached — DNS_PROBE_FINISHED_NXDOMAIN"
• Running dig example.com returns NXDOMAIN (the name doesn't exist), NOERROR with an empty answer (the domain exists but has no A or AAAA record), or SERVFAIL (nameserver error)
• nslookup example.com or host example.com returns "can't find example.com: No answer"

What it means

Every connection to a site starts with a Domain Name System (DNS) lookup: converting a human-readable domain name (like example.com) into an IP address the network can route to. If that lookup fails, the browser doesn't attempt a TCP connection. You'll see "This site can't be reached" rather than a server error.

The dns_resolution_failed uptime error means the lookup failed during a live check.

The most common culprits are an expired domain, a deleted DNS record, or a nameserver that's down or misconfigured. Rule out an expired domain first, because it costs the most to leave.

Common causes

• Domain registration has expired. Once the grace period ends, the domain is removed from DNS and returns NXDOMAIN
• A/AAAA records were accidentally deleted from the DNS provider
• Nameservers were changed at the registrar but the new nameservers aren't configured with the correct records yet
• The registrar has placed a hold on the domain (clientHold or serverHold status) due to a billing issue or suspected abuse
• DNSSEC signatures are misconfigured or expired, causing DNSSEC-validating resolvers to refuse to return the records
• The nameservers themselves are down or unreachable, returning SERVFAIL
• A public DNS resolver issue (rare and usually transient; verify by trying a different resolver)

How to fix

1. Confirm DNS is failing. Run:

   dig example.com

   An NXDOMAIN result means the name doesn't exist in DNS at all. A domain that exists but has no A or AAAA record returns NOERROR with an empty answer. A SERVFAIL means the nameserver returned an error. Try a different resolver to rule out a resolver-specific issue:

   dig example.com @8.8.8.8
   dig example.com @1.1.1.1

   If only one resolver fails, the issue may be transient or resolver-specific. If all fail, the problem is with your domain's DNS configuration.

2. Check your domain registration status. Run:

   whois example.com

   Look for the Expiry Date and Status fields. If the domain has expired, you'll need to renew it at your registrar. Contact them straight away, because most registrars offer only a short grace period. A status of clientHold or serverHold means the registrar has suspended the domain; contact them to resolve the billing or compliance issue.

3. Verify your nameservers are configured correctly. Check the NS records:

   dig NS example.com

   Compare the nameservers returned against what's shown in your registrar's DNS management panel. If they don't match (for example after a recent DNS provider migration), update the nameservers at your registrar.

4. Confirm your A/AAAA records exist. Query directly against an external resolver:

   dig A example.com @8.8.8.8

   An empty ANSWER section means there's no A record. Log in to your DNS provider and ensure an A record pointing to your server's IP address exists for the root domain (@).

5. Check for DNSSEC validation failures. If your domain uses DNSSEC and the signatures are misconfigured or expired, validating resolvers will return SERVFAIL. Use an online DNSSEC analyser (such as Verisign's DNSSEC Debugger) to check. If DNSSEC is the issue and you're not actively managing it, you can disable it at your registrar or DNS provider.

6. Re-verify and allow time for propagation. After making changes:

   dig example.com @1.1.1.1

   DNS changes propagate based on the Time to Live (TTL) of the old records: low-TTL records update in minutes, and high-TTL records can take several hours.

How to verify

Check that public resolvers can find your domain again:

1. Run dig example.com @8.8.8.8. The ANSWER section should contain your server's IP address.
2. Run curl -v https://example.com. The request should now connect.
3. Open the site in DomainDash. Once the domain resolves, the site page header reads Recovering after the first passing check, and Healthy once recovery is confirmed. If uptime for the selected timeframe (24 hours by default) is under 97%, it reads Unstable until the figure recovers.

To avoid losing a domain to a missed renewal, use domain registration checks. The Domain registration card shows Expiring from 30 days before the expiry date.

Related

• Connection refused — if DNS resolves but the server rejects connections
• Connection timeout — if DNS resolves but the server doesn't respond
• Site is down — if you're not sure which uptime issue you have
• Uptime — how DomainDash runs uptime checks