net::ERR_NAME_NOT_RESOLVED / DNS_PROBE_FINISHED_NXDOMAIN: this site can't be reached

The browser never even tried the web server. It asked “what IP is this name?” and got no usable answer — so you see a name-not-resolved error before any HTTP status code.

What the error means

net::ERR_NAME_NOT_RESOLVED
DNS_PROBE_FINISHED_NXDOMAIN
This site can't be reached — DNS_PROBE_FINISHED_NXDOMAIN
curl: (6) Could not resolve host: example.com
getaddrinfo ENOTFOUND example.com

These all mean the same thing: DNS lookup failed. No TCP connection was opened, so fixing TLS, redirects or the app itself will not help until the name resolves. A refused connection on a known IP is a different problem — see localhost refused to connect.

Quick triage

1. Spelling. One wrong letter, a doubled TLD (example.com.com), or http:// pasted into a DNS box are the most common causes. Compare the URL carefully; decoding a messy link in the URL encoder can reveal hidden characters.
2. Does the name exist anywhere? Ask a public resolver, not only your laptop:

   dig example.com A +short
   dig example.com AAAA +short
   nslookup example.com 1.1.1.1
   # PowerShell
   Resolve-DnsName example.com -Server 1.1.1.1

   If public DNS returns nothing (NXDOMAIN / empty), the records are missing, the wrong zone is published, or the name was never registered. If public DNS works but your machine fails, the problem is local (cache, hosts, VPN, filter).
3. Propagation and pending proxy. New records and DNS-only ↔ proxied flips at a CDN can take minutes to hours. “Pending” SSL or an orange-cloud proxy that has not finished often shows as intermittent NXDOMAIN or wrong answers until the change settles.

Local causes that look like “the site is down”

Flush the DNS cache

# Windows (Admin Command Prompt or PowerShell)
ipconfig /flushdns

# macOS
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

# systemd-resolved (many Linux desktops)
sudo resolvectl flush-caches
# older nscd
sudo systemctl restart nscd

Browsers keep their own cache too: Chrome’s chrome://net-internals/#dns has a clear-host-cache button. After flushing, retry dig before blaming the site.

Missing or wrong DNS records

• No A / AAAA for the hostname you typed (including www vs apex).
• CNAME to a name that itself does not resolve — follow the chain with dig +trace or repeated lookups.
• Wrong account / wrong zone — records edited in a staging zone while the public NS still point elsewhere. Compare dig NS example.com with the registrar’s listed nameservers.
• TTL still serving the old answer — wait out the TTL, or lower TTL before the next planned cutover.

Docker and “could not resolve host” in builds

Inside Compose or Kubernetes, short names like db only resolve on the container network. From your laptop they will NXDOMAIN unless you use the published host port. Build-time failures often mean the build container has no working resolver (corporate DNS, offline builder, or a network: none build). Prefer fully qualified public hostnames for anything fetched during docker build, and pin base images so builds do not depend on flaky registry redirects.

Related

DNS_PROBE_FINISHED_NXDOMAIN · TypeError: fetch failed (Node) · net::ERR_CONNECTION_TIMED_OUT · localhost refused to connect · EADDRINUSE address already in use · ssh Connection timed out port 22 · ERR_TOO_MANY_REDIRECTS · ERR_SSL_PROTOCOL_ERROR · ECONNREFUSED ::1 · ETIMEDOUT / connect ETIMEDOUT · getaddrinfo ENOTFOUND · WebRTC ICE failed

Questions

Published 5 November 2026.