Pillar · 36 errors
DNS & Domain Errors
DNS is the address book of the internet. When a record is wrong, missing, or still propagating, the browser can’t find your server at all — the site is simply unreachable even though nothing is wrong with the server itself.
DNS_PROBE_FINISHED_NXDOMAINDNS_PROBE_FINISHED_NXDOMAIN NXDOMAIN means the domain name couldn’t be resolved to an IP — the browser literally can’t find your server. critical DS MISMATCHDS record mismatch (broken chain of trust) The DS record at the registrar doesn't match the zone's active key, so validators reject every name in the domain with SERVFAIL. critical clientHold / serverHoldEPP status clientHold / serverHold (domain suspended) An EPP hold status removes the domain from the registry zone, so DNS stops resolving and the entire site goes dark. critical DNSSEC SERVFAILDNSSEC validation failed (SERVFAIL) A validating resolver couldn't verify the DNSSEC chain of trust, so it withholds the answer and returns SERVFAIL. critical Dangling CNAMEDangling DNS Record / Subdomain Takeover A DNS record still points at a deprovisioned host, letting anyone who re-claims that target hijack your subdomain. critical SERVFAILSERVFAIL DNS Response Code The resolver tried to answer but couldn't get a valid response, usually from broken authoritative DNS or DNSSEC. high ERR_NAME_NOT_RESOLVEDERR_NAME_NOT_RESOLVED Chrome's resolver got no usable IP back for the hostname, so the request never left the device. high DNS_PROBE_FINISHED_NO_INTERNETDNS_PROBE_FINISHED_NO_INTERNET Chrome's DNS probe couldn't reach any resolver, signalling a broken network link rather than a problem with the site. high DNSSEC SERVFAIL (bogus)DNSSEC Validation Failure (Bogus / DS Mismatch) A validating resolver returns SERVFAIL because the DNSSEC chain of trust is broken and the answer is bogus. high Cloudflare 1014Cloudflare Error 1014: CNAME Cross-User Banned Cloudflare blocked a proxied CNAME because it targets a hostname proxied under a different Cloudflare account. high Cloudflare 1000Cloudflare Error 1000: DNS Points to Prohibited IP A proxied Cloudflare record points back at a Cloudflare IP or stacks a second proxy, creating a loop. high Invalid ConfigurationVercel “Invalid Configuration” (Custom Domain) Vercel marks a custom domain “Invalid Configuration” when its DNS records don’t point at Vercel’s required A or CNAME targets. high InvalidDNSErrorGitHub Pages “InvalidDNSError” (Custom Domain) GitHub Pages can’t retrieve your custom domain’s DNS records because the apex A or www CNAME doesn’t point at GitHub. high curl: (6)curl: (6) Could Not Resolve Host / Temporary Failure in Name Resolution curl, wget, or a cron job can’t turn a hostname into an IP because the box has no working DNS resolver. high SERVFAILResolver returns SERVFAIL (Server Failure) The recursive resolver couldn't get a usable answer and gave up, returning status SERVFAIL instead of an address. high Cloudflare 1001Cloudflare Error 1001: DNS Resolution Error A request landed on a Cloudflare IP but the hostname has no working Cloudflare DNS setup behind it, so there's no zone to serve. high DoH SECURE_DNS_FAILEDSecure DNS (DoH) resolution failure The browser's encrypted DNS-over-HTTPS resolver is unreachable or blocked, so name lookups fail even when plain DNS works fine. high CAA MISMATCHCAA record blocks SSL certificate issuance A DNS CAA record authorizes only specific Certificate Authorities, so the CA you're using is refused and certificate issuance fails. high REFUSEDREFUSED DNS response code (RCODE 5) The nameserver understood the query but declined to answer, almost always a policy, authority, or recursion-permission problem. high NS not propagatedNameservers not updated / DNS not propagated After changing nameservers or records, resolvers keep serving cached values until TTLs expire, so the site looks broken or stale. high Awaiting External DNSNetlify "Awaiting External DNS" / DNS Verification Failed Netlify can't confirm your custom domain points at it, so it stalls and won't issue the Let's Encrypt certificate. high Lame DelegationLame Delegation / NS Mismatch at the Registry Parent NS records point to servers that aren't authoritative for the zone, so resolvers get no usable answer. high Parked DomainDomain Shows a Registrar Parked Page (Nameservers Not Pointed) The domain resolves to the registrar's parking page because nameservers still point at registrar defaults instead of your host. high DNS server not respondingDNS Server Not Responding Your OS can't reach the resolver it's configured to use, so no lookups complete at all. medium NXDOMAINNXDOMAIN (Non-Existent Domain) An authoritative nameserver confirms the queried name simply does not exist in its zone. medium DNS_PROBE_FINISHED_BAD_CONFIGDNS_PROBE_FINISHED_BAD_CONFIG Chrome's DNS probe failed because the device's configured resolver is unreachable or isn't a real DNS server. medium ERR_NAME_RESOLUTION_FAILEDERR_NAME_RESOLUTION_FAILED Chrome couldn't turn the hostname into an IP because the resolver was unavailable or returned a stale answer. medium dnsNotFoundFirefox "Server Not Found" (dnsNotFound) Firefox's DNS lookup returned no IP for the hostname, so it can't connect to the server. medium DNS_PROBE_POSSIBLEDNS_PROBE_POSSIBLE in Chrome Chrome's DNS probe came back ambiguous — a timeout or partial answer instead of a clean result, usually from a slow or blocked resolver. medium CNAME @ apexCNAME record not allowed at zone apex You can't put a CNAME on the root domain because it would collide with the mandatory SOA and NS records at the apex. medium DNS_PROBE_STARTEDDNS_PROBE_STARTED Chrome started a DNS lookup but the query stalled before any resolver responded, so the name never resolved. medium ERR_DNS_SERVER_FAILEDERR_DNS_SERVER_FAILED Chromium's mapping of a DNS SERVFAIL — the resolver reached an authoritative server that returned a server-failure response. medium DNS_PROBE_FINISHED_BAD_RESPONSEDNS_PROBE_FINISHED_BAD_RESPONSE A DNS server answered the query, but the reply was malformed or unexpected, so Chrome discarded it and the page failed. medium ERR_ICANN_NAME_COLLISIONERR_ICANN_NAME_COLLISION (127.0.53.53) A hostname you expected to be internal resolved to the ICANN collision signal 127. medium Can't Find ServerSafari "Can't Find the Server" Safari couldn't resolve the domain to an IP address — its plain-language equivalent of NXDOMAIN or name-not-resolved. medium DNS UnavailableWindows "Your DNS Server Might Be Unavailable" Windows Network Diagnostics reports the configured resolver isn't answering, blocking name resolution while raw connectivity may be fine. medium