DNS_PROBE_FINISHED_NXDOMAIN (Chrome / Edge)
Your browser asked DNS for the hostname and got a definitive “that name does not exist.” Not a timeout, not a refused connection — the name itself is missing from the DNS tree you queried.
What you see
This site can’t be reached
Check if there is a typo in example.con.
DNS_PROBE_FINISHED_NXDOMAINFirefox often says “we can’t connect to the server” / “server not found.” Safari says the server cannot be found. Same underlying idea: DNS returned NXDOMAIN (or your OS cache still remembers that answer).
NXDOMAIN vs ERR_NAME_NOT_RESOLVED vs ENOTFOUND
| Symptom | Where | Meaning |
|---|---|---|
| DNS_PROBE_FINISHED_NXDOMAIN | Chrome / Edge | Resolver returned NXDOMAIN — name does not exist |
| ERR_NAME_NOT_RESOLVED | Chrome (and friends) | Broader “could not resolve”; often the same root cause |
| getaddrinfo ENOTFOUND | Node / C libraries | Same DNS failure from app code / Docker service names |
| SERVFAIL / timeout | dig / resolvers | Resolver broken or unreachable — not NXDOMAIN |
| ERR_TOO_MANY_REDIRECTS | Browser | Name resolved; HTTP redirect loop — different layer |
Rule of thumb: NXDOMAIN is authoritative “no such name.” Fix the spelling, the zone, or the resolver view (split-horizon / DoH). Do not open firewall ports yet — there is no IP to dial.
Frequent real causes
- Typo in the hostname or TLD —
example.con,exmaple.com, missing subdomain (api.never created). - Newly registered domain / fresh DNS — registrar zone empty or still propagating; low TTL helps after you publish records, but brand-new names can take minutes to hours depending on parent NS.
- /etc/hosts (or Windows hosts) typo — a bad local override can invent or block names; remove stale lines.
- Split-horizon DNS — corp VPN resolver returns NXDOMAIN for an internal name when you are off-VPN (or the reverse).
- DNS over HTTPS / alternate resolver — browser DoH (Chrome “Use secure DNS”) querying a public resolver that does not see your private zone.
- Deleted or never-created Cloudflare / registrar record — orange-cloud still needs a real hostname in DNS. Proxying does not invent names; the record must exist (even if the origin is a Tunnel).
- Stale negative cache — OS or browser remembered NXDOMAIN from before you created the record; flush and retry.
Diagnose with dig / nslookup
# Does the public DNS tree have the name?
dig example.com A +noall +answer +comments
dig www.example.com A +noall +answer +comments
# Look for status: NXDOMAIN vs status: NOERROR
# NOERROR with an empty answer may mean a bare zone / missing subdomain (not always NXDOMAIN)
nslookup example.com
nslookup example.com 1.1.1.1
nslookup example.com 8.8.8.8
# Compare resolver views (VPN vs off-VPN, DoH vs system):
resolvectl query example.com # systemd-resolved
scutil --dns | head # macOS
# Local overrides:
grep -n example /etc/hosts
# Windows: notepad C:\Windows\System32\drivers\etc\hosts
If dig @1.1.1.1 is NOERROR with an A record but the browser still shows NXDOMAIN, flush local caches and disable browser DoH briefly to see which resolver the browser was using.
Flush DNS caches
# Windows (Admin CMD / PowerShell):
ipconfig /flushdns
# macOS:
sudo dscacheutil -flushcache
sudo killall -HUP mDNSResponder
# Linux systemd-resolved:
sudo resolvectl flush-caches
# or: sudo systemd-resolve --flush-caches
# Chrome: navigate to chrome://net-internals/#dns → Clear host cache
# Also try a private/incognito window (extensions + DoH settings aside)
Fix checklist
- Check spelling and TLD — one-character typos are the most common NXDOMAIN.
- Confirm the record exists where you think — registrar / Cloudflare DNS UI; apex vs
www; A/AAAA/CNAME as intended. - Query with dig from multiple resolvers — NXDOMAIN everywhere → publish/fix the zone. NOERROR publicly but NXDOMAIN locally → hosts file, VPN split-horizon, or DoH.
- Flush OS + browser DNS caches — especially after you just created the name.
- Wait out TTL / registration — new domains and NS changes need propagation; avoid thrashing records every minute.
- Orange-cloud still needs a hostname — create the DNS record first; pointing a Tunnel or origin IP comes after the name exists.
- Still stuck? — inspect the URL path with Anvil URL inspect; rule out redirect loops via ERR_TOO_MANY_REDIRECTS once DNS is healthy.
Related
ERR_NAME_NOT_RESOLVED · getaddrinfo ENOTFOUND · ERR_TOO_MANY_REDIRECTS · ERR_CONNECTION_TIMED_OUT · localhost refused to connect · Cloudflare Error 523 · Anvil URL inspect
Questions
What does DNS_PROBE_FINISHED_NXDOMAIN mean?
Chrome/Edge got an NXDOMAIN answer from DNS — the hostname does not exist in the DNS zone that resolver queried.
Is NXDOMAIN the same as ERR_NAME_NOT_RESOLVED?
Same family. NXDOMAIN is the specific DNS status; ERR_NAME_NOT_RESOLVED is Chrome’s broader “could not resolve this name” error.
How is this different from getaddrinfo ENOTFOUND?
Same idea in Node/C: the resolver could not find an address for the hostname. Fix DNS or the name, not HTTP.
How do I flush DNS on Windows, macOS, and Linux?
Windows: ipconfig /flushdns. macOS: dscacheutil -flushcache and HUP mDNSResponder. Linux systemd-resolved: resolvectl flush-caches. Also clear chrome://net-internals/#dns.
Can a hosts-file typo cause NXDOMAIN?
A bad hosts entry more often forces a wrong IP, but missing/incorrect local overrides plus resolver quirks are worth checking. Prefer dig against 1.1.1.1 to see the public truth.
I just registered the domain — why NXDOMAIN?
The zone may be empty or still propagating to parent nameservers. Create the A/AAAA/CNAME, wait for TTL/propagation, then flush local caches.
Does Cloudflare orange-cloud create the DNS name for me?
No. You must create the hostname record. Orange-cloud proxies an existing name to Cloudflare’s edge; it does not invent NXDOMAIN names.
Published .