This Site Can’t Be Reached: DNS Errors Decoded

The short answer. Sort the error into one of three families first. If it mentions DNS or name resolution, the name did not resolve and the problem is the domain. If it says refused or timed out, the name resolved perfectly and the problem is the server. If it mentions a certificate, both worked and the problem is TLS. That single split removes most of the guesswork.

---

The three families#

Everything below is detail within those three.

---

Name resolution errors#

DNS_PROBE_FINISHED_NXDOMAIN and ERR_NAME_NOT_RESOLVED

NXDOMAIN literally means non-existent domain. The resolver asked and was told authoritatively that this name does not exist.

Likely causes, in order:

• A typo. Check it before anything else.
• The domain is expired. An expired domain is removed from the zone and produces exactly this. Look it up in our checker, which reads the registry directly rather than guessing from whether the site loads.
• The record genuinely does not exist. Common with a missing www record, where the bare domain works and www does not, or the reverse.
• The domain is on clientHold. The registry is deliberately not publishing it, usually over non-payment or unverified contact details.
• Negative caching. If you queried the name before creating the record, the "does not exist" answer is cached for a period set by the zone's SOA. The fix is to wait, not to keep editing.

SERVFAIL

The resolver tried and failed. This is not "does not exist", it is "something went wrong while asking".

The most common cause in 2026 is DNSSEC validation failure. If DNSSEC is misconfigured, validating resolvers refuse to return an answer while non-validating resolvers serve the site normally. That produces the signature symptom: the site works for some people and not others, and works fine from your phone on mobile data but not on the office network.

If you recently enabled DNSSEC or changed DNS provider while it was enabled, this is your answer. See DNSSEC Explained.

Other causes: all authoritative nameservers unreachable, or a broken delegation where the registry points at nameservers that do not answer for the zone.

DNS_PROBE_FINISHED_BAD_CONFIG

Usually local. The resolver configured on your machine or router is not working. Test another network or another resolver; if the domain works elsewhere, the domain is fine.

---

Connection errors#

These mean DNS succeeded. The name resolved to an address. Stop looking at DNS.

ERR_CONNECTION_REFUSED

Something is at that address and it actively refused. The server is reachable but nothing is listening on the port, or a firewall rejected you. Typically the web server is stopped, or is listening on a different port.

ERR_CONNECTION_TIMED_OUT

Nothing answered at all. The address may be wrong, the server may be down, or a firewall may be dropping packets silently.

A useful check: if the A record points at an old IP after a host migration, you get this. Compare the record against the IP your host currently gives you.

ERR_EMPTY_RESPONSE

The server accepted the connection and then closed without answering. Almost always an application crash rather than anything to do with the domain.

---

Certificate errors#

DNS worked, the server answered, and TLS failed. The domain is not your problem.

ERR_CERT_DATE_INVALID

The certificate expired. Automated renewal fails silently more often than people expect, so an unattended site can go from working to blocked without any change on your part.

ERR_CERT_COMMON_NAME_INVALID

The certificate does not cover the hostname requested. Commonly a certificate issued for example.com being served for www.example.com, or the other way round.

ERR_SSL_PROTOCOL_ERROR

A handshake failure. Often a server configuration issue, sometimes an incomplete certificate chain, which produces the frustrating pattern of working in one browser and failing in another because browsers differ in how much chain they will reconstruct.

---

The fastest diagnosis#

1. Read the error and place it in a family. This decides where to look and saves most of the time.

2. If it is a name resolution error, check the registry first. Expired, on hold, or wrong nameservers are all visible in the RDAP record and all produce browser errors that look like server problems. Our checker shows that record.

3. If it is a connection error, test the IP directly. That separates "DNS points somewhere wrong" from "the server is down".

4. If it works for some people and not others, suspect DNSSEC or caching, in that order.

5. Try a different network. Phone on mobile data is the fastest way to rule out your own machine, router and resolver.

The wider walkthrough is in Why Is My Domain Not Working.

---

Common questions#

What does DNS_PROBE_FINISHED_NXDOMAIN mean?

The domain name does not exist as far as DNS is concerned. Common causes are a typo, an expired registration, a missing record, or a registry hold.

What is the difference between NXDOMAIN and SERVFAIL?

NXDOMAIN is a definitive answer that the name does not exist. SERVFAIL means the resolver could not complete the lookup, most often because DNSSEC validation failed or the authoritative servers did not answer.

Why does a site work on my phone but not my laptop?

Different networks and resolvers. If mobile data works and your office network does not, suspect DNSSEC validation failure or a local resolver problem rather than the domain itself.

Does ERR_CONNECTION_REFUSED mean my DNS is broken?

No, the opposite. DNS resolved successfully and the server refused the connection. The problem is the server or a firewall.

My certificate expired, is that a DNS problem?

No. DNS and the server both worked. Renew the certificate and check why automated renewal stopped, since it usually fails silently.

How do I check whether the domain itself is the problem?

Look up the registration record over RDAP. It shows expiry, status codes and nameservers, which covers every domain-level cause of these errors without needing to inspect the server.