DNS_PROBE_FINISHED_NXDOMAIN: Trace the Failed Name Resolution
A browser reports that a site cannot be reached, while another site opens normally. A DNS probe ending in an NXDOMAIN result points the investigation toward the requested name and its DNS answers. Check the name, compare resolver and authoritative responses, and then retest after any correction.
The message dns_probe_finished_nxdomain indicates that the lookup received a negative answer for the name. NXDOMAIN means the answering DNS server says the queried name does not exist in the DNS view it used. A timeout is different: the client did not receive a timely answer. A name can also exist without the particular record type requested, producing a no-data response rather than NXDOMAIN. These outcomes call for different investigations.
Check the name and the comparison
Inspect the address for spelling, misplaced dots, and the intended domain suffix. For an internal application, confirm the full hostname with the service owner and connect to the approved corporate network or VPN if required. Short names may have a search suffix appended; the resulting query can differ from the intended fully qualified domain name. Ask IT which suffix and DNS view apply.
On Windows, open Command Prompt and compare the affected name with a known working name on the same network:
nslookup -type=A app.example.com.
nslookup -type=A known.example.com.
Replace the examples with authorized names. The trailing dot makes the name absolute and avoids appending a search suffix. Record the DNS server shown, the queried names, and the results. If both queries time out, investigate connectivity to the resolver. If the known name resolves and the other returns a non-existent-domain response, focus on that name and its zone.
Compare the resolver and authoritative servers
A recursive resolver answers on the client’s behalf, using cached information or querying the DNS hierarchy. An authoritative server holds the relevant zone data. When an NXDOMAIN browser error persists, an administrator can compare the same name and record type against the configured resolver and the authoritative server for the appropriate DNS view:
nslookup -type=A app.example.com. 192.0.2.53
Replace the example address with an approved server’s address. Use the resolver first, then an authoritative server identified by the zone administrator. If the authoritative server returns the expected record but the resolver returns NXDOMAIN, investigate caching, forwarding, and split DNS configuration. If the authoritative server also returns NXDOMAIN, check the name and zone records with the owner. An authoritative server may not be reachable directly from every client network.
For public zones, the administrator should also check that the parent zone delegates to the intended name servers and that those servers are reachable and serve consistent zone data. For private namespaces, inspect the organization’s forwarding and delegation configuration. Microsoft’s DNS troubleshooting guidance describes these server checks. DNS filtering can also affect responses; raise an unexpected policy result with the administrator rather than changing resolvers to evade it.
Check caches and retest
A corrected record may not appear immediately because a recursive resolver can retain an earlier negative response. A local cache and an upstream resolver cache are separate. On Windows, ipconfig /flushdns clears the local DNS client cache; it does not clear the resolver’s cache. nslookup queries DNS directly rather than using the Windows local DNS cache, so compare it with a fresh browser attempt after the fix. The administrator can check the negative-cache lifetime or clear the relevant resolver cache under local procedures.
If dns_probe_finished_nxdomain continues after the expected cache period, repeat the same queries from the affected network. Give the administrator the exact name, time and time zone, client network or VPN, configured resolver, query type, full responses, and comparison with the known working name. Include recent record changes and the results from authoritative servers if those tests were available.