How to fix the DNS_PROBE_FINISHED_NXDOMAIN error?

Sajjad
DNS
10 Oct, 2026

DNS_PROBE_FINISHED_NXDOMAIN is an error shown by Chrome and other Chromium-based browsers when a DNS lookup for the website's domain returns NXDOMAIN, which means "non-existent domain". To fix it, first check the address for typos, then try another device or network to see whether the problem is on your side. If it's only you, clear your browser's and system's DNS caches, check your hosts file, disable any VPN or DNS filter, and switch to a public DNS resolver such as 1.1.1.1 or 8.8.8.8. If the domain fails everywhere, the website owner needs to fix it, usually because the domain has expired, its nameservers are wrong, or the record for that hostname doesn't exist.

The error looks alarming, but it's very specific: something in the DNS chain is telling your browser that the name has no entry at all. This guide explains what the error really means, how to work out whether the fault is on your device or with the domain, and the fixes for each case. There's a separate section for website owners, because if your own site shows this error to every visitor, the fix is in your DNS settings rather than anyone's browser.

What DNS_PROBE_FINISHED_NXDOMAIN Means

Before your browser can load a website, it needs the IP address of the site's server. It asks a DNS resolver, and the resolver goes off to the domain's authoritative nameservers to find the answer.

An NXDOMAIN response is a definite "this name does not exist". It's not a timeout or a crash. A DNS server has positively answered that there's no such domain or hostname.

The name of the error comes from what Chrome does next. When a page fails because a name can't be resolved, Chrome can run a short DNS probe to work out why. If the probe finds that DNS itself is working but the name doesn't exist, it reports DNS_PROBE_FINISHED_NXDOMAIN. Other probe results produce different codes, such as DNS_PROBE_FINISHED_NO_INTERNET when there's no connectivity at all, or DNS_PROBE_FINISHED_BAD_CONFIG when your DNS settings look broken.

Other browsers show the same problem in their own words:

Browser	Typical message
Chrome, Brave, Opera	This site can't be reached ... DNS_PROBE_FINISHED_NXDOMAIN
Microsoft Edge	Hmmm... can't reach this page ... DNS_PROBE_FINISHED_NXDOMAIN
Firefox	Hmm. We're having trouble finding that site.
Safari	Safari can't find the server.

Step 1: Work Out Whose Problem It Is

Before changing any settings, spend two minutes narrowing it down. This saves a lot of wasted effort.

Check the address carefully: A single wrong letter, an extra dot, or the wrong ending (.co instead of .com) is the most common cause of all.
Try another device on a different network: Load the site on your phone using mobile data, with Wi-Fi turned off.
Ask a public resolver directly: Run a lookup from a terminal against a known-good resolver.

On Windows, macOS or Linux:

nslookup www.example.com 1.1.1.1

If the domain doesn't exist, you'll see something like:

** server can't find www.example.com: NXDOMAIN

You can also use an online DNS lookup tool, which queries from servers outside your network.

The results point you to one of two paths:

The site works on mobile data or from a public resolver, but not on your computer: The problem is local. Follow the fixes for visitors below.
The site fails everywhere, including public resolvers: The domain itself has a DNS problem. Only the owner can fix it. If that's you, skip to the website owner section.

Fixes for Visitors

Work through these in order. Most people find the problem in the first three or four steps.

1. Clear Chrome's DNS Cache

Chrome keeps its own short-lived DNS cache, separate from the operating system. If it cached an NXDOMAIN answer, it may keep showing the error briefly even after the problem is fixed.

Type chrome://net-internals/#dns in the address bar and press Enter.
Click Clear host cache.
Go to chrome://net-internals/#sockets and click Flush socket pools.
Reload the site.

In Edge, use edge://net-internals/#dns instead.

2. Flush Your Operating System's DNS Cache

Your operating system also caches DNS answers, including negative ones. Flush it with the command for your system:

# Windows (Command Prompt or PowerShell as administrator)
ipconfig /flushdns

# macOS
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

# Linux with systemd-resolved (Ubuntu, Fedora and most modern distributions)
resolvectl flush-caches

3. Check Your Hosts File

The hosts file lets you override DNS for specific names on your computer. Security software, ad blockers, developers and occasionally malware add entries to it. An entry that points a domain at 0.0.0.0 or an old address can make a site fail on that machine only.

Open it and look for the domain you're trying to reach:

# Windows (PowerShell)
Get-Content C:\Windows\System32\drivers\etc\hosts | Select-String "example.com"

# macOS and Linux
grep -i "example.com" /etc/hosts

If you find an unwanted entry, edit the file as administrator (Windows) or with sudo (macOS and Linux), remove the line, save it, and flush the DNS cache again.

4. Disable VPNs, Proxies and DNS Filters

VPNs and filtering services often run their own DNS resolvers, and some return NXDOMAIN for domains they block rather than showing a block page. This includes:

Commercial VPN apps.
Corporate security agents.
Network-wide ad blockers such as Pi-hole or AdGuard Home.
Parental controls on your router or ISP account.
Browser extensions that filter traffic.

Turn the VPN or filter off temporarily and try again. If the site loads, the domain is being blocked by that service. Add it to an allow list if you trust it.

5. Check Chrome's Secure DNS Setting

Chrome can send DNS queries over HTTPS to a provider of your choice, bypassing your system's resolver. If that provider is filtering the domain or is misconfigured, you'll get errors that your other apps don't.

Go to chrome://settings/security.
Find Use secure DNS.
Try switching it off, or change the provider to a different one, such as Cloudflare or Google.
Reload the page.

6. Change Your DNS Server

Your ISP's or router's DNS resolver may be returning stale or incorrect answers. Switching to a reputable public resolver is a quick test, and you can keep the change if it works better.

Provider	IPv4	IPv6
Cloudflare	1.1.1.1, 1.0.0.1	2606:4700:4700::1111, 2606:4700:4700::1001
Google Public DNS	8.8.8.8, 8.8.4.4	2001:4860:4860::8888, 2001:4860:4860::8844
Quad9	9.9.9.9, 149.112.112.112	2620:fe::fe, 2620:fe::9

On Windows, you can set this in PowerShell as administrator. Replace Wi-Fi with your adapter's name, which you can find with Get-NetAdapter:

Set-DnsClientServerAddress -InterfaceAlias "Wi-Fi" -ServerAddresses ("1.1.1.1","1.0.0.1")

On macOS, replace Wi-Fi with your network service name from networksetup -listallnetworkservices:

sudo networksetup -setdnsservers Wi-Fi 1.1.1.1 1.0.0.1

On Linux with NetworkManager, replace "Home WiFi" with the connection name from nmcli connection show:

sudo nmcli connection modify "Home WiFi" ipv4.dns "1.1.1.1 1.0.0.1" ipv4.ignore-auto-dns yes
sudo nmcli connection up "Home WiFi"

7. Renew Your IP Address and Reset the Network Stack on Windows

If DNS settings came from a stale DHCP lease or the network stack is in a bad state, a reset can help. Run these in Command Prompt as administrator, then restart your computer:

ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset
netsh int ip reset

8. Restart Your Router

Many home routers run a small caching DNS forwarder. Restarting the router clears its cache and often fixes odd, network-wide DNS failures. Unplug it for about 30 seconds, then plug it back in.

Fixes for Website Owners

If your domain returns NXDOMAIN from public resolvers such as 1.1.1.1 and 8.8.8.8, every visitor is affected and the fix is on your side. Start by finding out exactly which level of DNS is failing.

Check Whether the Domain or Just the Hostname Is Missing

Query the bare domain and the specific hostname separately:

dig example.com SOA +short
dig www.example.com A +short

The SOA query returns NXDOMAIN: The whole domain is missing from DNS. Check registration and nameservers.
The SOA query works but www returns NXDOMAIN: The domain is fine, but there's no record for that hostname. Add it.

To see the response status explicitly, look at the header line in full dig output:

dig www.example.com A

;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 41187

Has the Domain Expired or Been Suspended?

When a domain expires, the registrar usually removes it from the zone or points it at a parking page. A domain can also be placed on hold for non-payment, a failed contact verification, or an abuse complaint. Both the clientHold and serverHold statuses remove the domain from DNS entirely, so it returns NXDOMAIN everywhere.

Check the registration with WHOIS or RDAP:

whois example.com | grep -iE "expir|status"

Registry Expiry Date: 2026-09-30T23:59:59Z
Domain Status: clientHold https://icann.org/epp#clientHold

If you see an expiry date in the past or a hold status, log in to your registrar, renew the domain or complete the verification email, and the domain will usually be back in DNS within an hour or so.

Are the Nameservers Correct?

The registry tells the world which nameservers are responsible for your domain. If they point at a DNS provider that doesn't have your zone, lookups fail. Ask the TLD servers directly which nameservers they have on file:

dig +norecurse @a.gtld-servers.net example.com NS

;; AUTHORITY SECTION:
example.com.		172800	IN	NS	ns1.example.net.
example.com.		172800	IN	NS	ns2.example.net.

The a.gtld-servers.net servers handle .com and .net. For other TLDs, find the right server with dig <tld> NS +short, for example dig org NS +short.

Then confirm that those nameservers actually have your zone:

dig @ns1.example.net example.com SOA

If the nameserver replies with REFUSED, or with no answer, your domain is delegated to a provider that isn't hosting it. Either add the zone at that provider, or update the nameservers at your registrar to the ones your DNS host gave you.

Did You Recently Move DNS Providers?

When you change nameservers, the new provider only serves records you've created there. If you forgot to recreate a record, such as www, a subdomain, or a verification record, it will return NXDOMAIN at the new provider. Compare the old and new providers' zones and add anything missing.

Is the Record Under the Right Name?

DNS control panels handle names differently, and it's easy to create a record with the wrong name. Common slips include:

Entering www.example.com in a panel that automatically appends the domain, producing www.example.com.example.com.
Creating the record in the wrong zone, for example in example.net when the site is example.com.
Creating www but not the bare domain (@), or the other way round.

You can test for the doubled-up name directly:

dig www.example.com.example.com A +short

If that returns an address, you've found the mistake.

Is It a Brand-New Domain?

A newly registered domain usually appears in DNS within minutes, but some registries and registrars take longer. If someone looked up the domain before it existed, their resolver may have cached the NXDOMAIN answer. Negative answers are cached for a period set by your zone's SOA record, typically between a few minutes and a few hours. They'll clear on their own.

NXDOMAIN Is Not a DNSSEC Problem

If DNSSEC is broken for your domain, validating resolvers usually return SERVFAIL, not NXDOMAIN. In Chrome, that typically shows as a different error rather than DNS_PROBE_FINISHED_NXDOMAIN. So if you're definitely seeing NXDOMAIN, focus on registration, nameservers and records rather than DNSSEC.

A Quick Diagnostic Checklist

Use this table to match what you see with the most likely cause.

What you see	Likely cause	Fix
Works on mobile data, fails on your PC	Local cache, hosts file, VPN, or filter	Clear caches, check hosts file, disable VPN
Fails only in Chrome, works in other browsers	Chrome's host cache or Secure DNS setting	Clear host cache, change Secure DNS provider
Fails on one network only	Router or ISP resolver	Restart router, switch DNS server
Fails everywhere, whole domain	Expired, on hold, or wrong nameservers	Renew, verify, fix nameservers at registrar
Fails everywhere, one hostname only	Missing or misnamed record	Add the record with the correct name

FAQ: DNS_PROBE_FINISHED_NXDOMAIN

It can be either. If the site loads on another network, such as mobile data, the problem is on your device or network. If it fails everywhere and public resolvers also return NXDOMAIN, the domain itself has a problem that the owner needs to fix.

Clearing cookies and cached files usually doesn't help, because the error is about DNS. Clear Chrome's host cache at chrome://net-internals/#dns and flush your operating system's DNS cache instead.

Yes. VPNs often use their own DNS resolvers, and some return NXDOMAIN for domains they block or can't resolve. Disconnect the VPN and try again to see if it's the cause.

Once the DNS problem is fixed, most visitors see the site again within minutes. Resolvers that cached the NXDOMAIN answer keep it until the negative cache time from the zone's SOA record expires, which is often an hour or less.

The domain may not have been added to the registry's zone yet, its nameservers may not be set, or you haven't created records for it at your DNS host. Check that nameservers are configured at the registrar and that an A or CNAME record exists for the hostname.

Yes. When a domain expires or is put on hold, it's often removed from DNS, so every lookup returns NXDOMAIN. Renewing the domain at the registrar usually restores it quickly.

Conclusion

DNS_PROBE_FINISHED_NXDOMAIN means a DNS server has told your browser that the name doesn't exist. Start by checking the spelling and testing from another network, because that tells you straight away whether to fix your own device or the domain. For local problems, clearing Chrome's and your system's DNS caches, checking the hosts file, and switching resolvers fix the vast majority of cases.

If you own the domain and it fails everywhere, check the basics in order: is it registered and active, do the registry's nameservers point at your DNS host, and does that host have a record with the right name? A few dig commands against the TLD and your own nameservers will show you exactly which link is missing.