SERVFAIL

SERVFAIL is a DNS response saying that a server could not complete the query. It reports a failure to look up DNS information, not that the queried domain name definitely does not exist. The response alone usually does not reveal the precise cause.

Why might a resolver return SERVFAIL?

A DNS lookup service (a resolver) or a name server may be unable to reach another DNS server, may encounter a configuration problem, or may reject data that fails DNSSEC checks of digital signatures. SERVFAIL can represent several different problems. Some DNS software can add an Extended DNS Error that gives extra context, but not every server sends one.

For example, if example.com has a broken chain of DNSSEC signatures and links between zones, a resolver that checks DNSSEC may refuse to return the domain's records and report SERVFAIL. Another resolver that does not validate might behave differently. The error therefore does not prove that the records are absent; it may mean the resolver could not verify or retrieve them.

How is SERVFAIL different from NXDOMAIN?

NXDOMAIN is a negative answer that says the queried name does not exist. SERVFAIL means the server could not complete the DNS lookup. A checker should not translate SERVFAIL into “domain not found” or treat it as proof that a name is unregistered.

Related terms

• NXDOMAIN — a specific negative DNS answer
• DNSSEC — validation problems can contribute to SERVFAIL
• Timeout — no reply arrived at the checking tool
• Incomplete check result — failure leaves the state unknown