Networking & DNS

How to fix DNS SERVFAIL errors

A SERVFAIL DNS response means the resolver failed to get an answer for your domain. Learn the causes, from broken DNSSEC and dead nameservers to lame delegation, and fix it.

AdvancedcPanel hosting2 min read

A DNS SERVFAIL error means a resolver tried to look up your domain and failed to get a valid answer. Unlike NXDOMAIN (name does not exist), SERVFAIL says "something is broken on the way". Browsers often show it as a generic DNS error, and the site, email and SSL renewals all stop working for affected visitors.

Before you start

  • A terminal with dig (or use an online dig tool).
  • Access to your registrar and DNS host.

Confirm the SERVFAIL

dig example.com @8.8.8.8

Look at the status: field in the header. Then repeat with @1.1.1.1. If both return SERVFAIL, the problem is with the domain's DNS, not your network.

Common causes of SERVFAIL

  • Broken DNSSEC – a DS record at the registrar no longer matches the zone, usually after moving DNS to a new host. Validating resolvers then refuse every answer.
  • Nameservers not responding – the listed nameservers are down, unreachable or no longer host the zone.
  • Lame delegation – the registrar lists nameservers that do not have the zone configured.
  • Expired domain or registry hold.

How to fix SERVFAIL

  1. Test DNSSEC. Run dig example.com @8.8.8.8 +cd. If that works but the normal query fails, DNSSEC validation is the problem.
  2. Remove or update DS records. At your registrar, delete the DS record if the new DNS host does not sign your zone, or replace it with the new host's DS record. See how DNSSEC works.
  3. Check the delegation. dig ns example.com @a.gtld-servers.net (for .com) shows the nameservers the registry has. Then query each one: dig example.com @ns1.example-dns.com. Each must answer with the aa flag.
  4. Fix nameservers at the registrar to match where your zone actually lives (your MdmHost nameservers, Cloudflare, etc.).
  5. Check domain status with our WHOIS checker and renew if needed.

Warning: When you move DNS to a new provider, turn off DNSSEC (remove the DS record) first, wait a day, then move. Moving with a stale DS record causes SERVFAIL for most visitors.

FAQ

Why do some people see the site and others get SERVFAIL?

Only DNSSEC-validating resolvers fail on bad signatures, and caches expire at different times.

How long until SERVFAIL clears after a fix?

Usually within the DS record TTL, often a few hours.

Can my own router cause SERVFAIL?

Yes, if its resolver is broken. Test with 8.8.8.8 to compare.

Next steps

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AIOpen a ticket

Related guides