You type in the address in your browser and expect to see a web page load up. Instead, you get no result and check your connection. But suddenly you receive some weird DNS error – SERVFAIL.
SERVFAIL means Server Failure. It is a type of DNS response which lets you know that a DNS resolver failed to perform a request. The error does not mean that the hosting server of the website is down. There can be problems at other stages of the DNS resolution process.
Website administrators need to be particularly mindful of SERVFAIL as DNS aids in finding their servers. Therefore, a problem with DNS may cause a perfectly good website to appear inaccessible.
- SERVFAIL indicates DNS resolution failure, meaning a DNS resolver could not provide a valid answer to a query.
- Incorrect DNS settings and DNSSEC issues are among the common causes of SERVFAIL errors.
- DNS failures can affect websites and emails, resulting in lost visitors, failed email delivery, and accessibility issues.
- Tools like dig and nslookup help diagnose DNS problems by testing resolvers and authoritative nameservers.
- Regular DNS maintenance reduces failure risks, including verifying DNS records, nameserver delegation, and DNSSEC configurations.
Starting from $2.99/month
Our hosting is attractive as that price tag! Visit our home page or domain section now and see how qualified our platform is for your website. Join us today!
What Is SERVFAIL?
SERVFAIL is a DNS response code received when a DNS server is unable to resolve a query. Your computer asks the DNS about the location of a certain domain. It does not get an answer for some reason.
Imagine DNS to be the address book of the Internet. You type in the domain name like www.example.com, and DNS helps find the IP address corresponding to that particular domain name. Your browser then uses that address to connect with the website server.
In case of failure in DNS lookup, your browser may be left without any place to go. In that case, you see an error instead of connecting with the website.
SERVFAIL is different from NXDOMAIN. NXDOMAIN typically implies that the domain name requested does not exist. But in the case of SERVFAIL, there is some error in DNS resolution process.
What is a SERVFAIL Error?
You enter the domain name in the browser. Your device will search its local DNS cache for information. There will be a DNS request made to a recursive resolver. The resolver will try to find the authoritative DNS server. The authoritative DNS server needs to give the necessary information. It will be validated and processed.
The browser will get an IP address and access the website. If any step in the process outlined above is unsuccessful, then it could hinder the resolver from coming up with a valid answer.
The problem may be very different. SERVFAIL is the result, not the cause.
Common Causes of SERVFAIL
1. Incorrect DNS Setup
One small mistake will make DNS lookup fail.
An incorrect nameserver, a wrong record, a broken delegation, lack of zone information, and incorrect DNS configuration are some of the issues that might arise. It often happens when you change a DNS provider or a hosting service.
Check that your domain uses the correct nameservers and that they are set up correctly.
2. DNSSEC Validation Issues
DNSSEC allows authenticating DNS responses. It assists the resolver in ensuring that the DNS data has not been tampered with.
But DNSSEC needs to be set up properly. The DS record in the parent zone and the DNSKEY information published by the domain not matching can result in the response being refused by validating resolvers with a SERVFAIL.
Such an issue can arise after switching DNS providers, incorrect key rollovers, or having outdated DNSSEC data on the registrar’s side.
Authoritative DNS servers are what your domain relies on for its DNS information.
And when these servers are unreachable, misconfigured, fail to load the zone, or produce conflicting data, the recursive resolvers won’t be able to get a usable response from them.
That’s why reliable and properly configured authoritative DNS infrastructure is critical.
4. Network Connectivity Problems
DNS servers have to communicate with each other. Routing issues and firewall rules or other problems with connectivity can disrupt this communication.
This can result in SERVFAIL being returned by a DNS resolver because it failed to reach the right server.
5. Malformed Zone Data
The DNS zone consists of data which describes how the domain is meant to function.
In the case where the data in the zone is flawed or incorrect, the authoritative server might not be able to process it properly. Also, DNS servers can have problems in situations when a secondary server fails to get zone data from its primary server.
6. Temporary Issues with DNS Servers
Sometimes the underlying cause for a SERVFAIL response may be temporary.
The DNS server might have experienced a power outage, heavy traffic, software malfunction, maintenance or connection issues. If the problem is solved, then the problem with the SERVFAIL response will be solved too.
But still, multiple instances of SERVFAIL should not be ignored. It usually requires more investigation.
How SERVFAIL Affects Your Website
Even though SERVFAIL seems like a simple error, it can be rather devastating in some situations.
Website Accessibility
If users cannot resolve your domain name, then there is no way for them to connect to your web server. The website will be completely inaccessible for them.
Email Delivery
DNS is also crucial for delivering emails. Special DNS records such as MX records make sure that the mail is delivered properly.
Loss of Visitors and Sales
When a user faces an inaccessible website time and again, he might just quit and search somewhere else. For online retailers and service providers, DNS failure even for few seconds may become a business problem.
Search Engine Optimizing Factors
Continuing availability issues could also turn into technical SEO issues. Search engines must be able to crawl and index website content, which DNS failure might impede.
Expert Tip
The main thing is that DNS becomes one of the availability components for your website. Your website might have good content and a web server but still be unreachable because of an unresolved domain.
Fatima Nawaz
Expert Web Developer and SEO Manager
How to Solve SERVFAIL Issue
It does not mean you should start changing DNS records randomly. Checking systematically would help find out where the problem lies.
Step 1: Find Out If the Issue Is Common
Resolve the domain using several DNS resolvers.
You might face a resolver issue if one resolver returns SERVFAIL while the other succeeds in resolving the domain. Other issues could be caching or a DNSSEC validation problem.
Check your authoritative DNS for the domain if several resolvers independently fail to resolve the domain.
Identify the nameservers that are serving the domain name. Run the DNS query on those nameservers. This will help clarify whether the issue is with the authoritative DNS or somewhere between the client and the authoritative DNS infrastructure.
Step 3: Perform a dig lookup
One of the best command-line tools for debugging DNS is dig. A simple DNS lookup would be like this:
dig example.com
We can also try digging against a specific resolver like:
dig @1.1.1.1 example.com
In case of any DNSSEC issues, dig allows further options that may be useful in diagnosing whether validation was performed. For example, Cloudflare documentation suggests using dig to compare DNSSEC validation results with results of a disabled checking query to investigate SERVFAIL.
Step 4: Do nslookup
For simplicity, the nslookup command can also be used to test the DNS lookup.
nslookup example.com
Step 5: Test DNSSEC
If the domain works using a non-validation query but does not work when validating DNSSEC normally, check the DNSSEC chain.
Check whether there are any issues with the DS, DNSKEY, signatures, and recent DNS provider changes.
Do not disable DNSSEC to ignore the problem. Fixing the validation chain is crucial.
Step 6: Examine Recent DNS Changes
Find out if there have been any recent changes.
Have you done the following recently?
- Changed the host of the website
- Moved name servers
- Changed DNS provider
- Enabled DNSSEC
- Changed DNS records
- Updated firewall settings
- Transferred or renewed your domain name
Recent changes might help narrow down the issue.
How long does SERVFAIL last?
It varies depending on the case.
Some problems related to temporary network or DNS server issues may vanish shortly. Some configuration error may occur unless it gets fixed. DNS resolvers may keep some of the error information temporarily in cache. According to RFC 2308, SERVFAIL answers cached by DNS resolvers shall never be kept for longer than five minutes.
However, it is not true that all users would be able to get rid of this problem by waiting for five minutes. Different DNS cache servers will provide different results, and even the problem may still persist.
SERVFAIL and NXDOMAIN
The two DNS replies are almost identical.
| Error | Meaning | Typical situation |
| SERVFAIL | DNS resolution failed | DNSSEC problem, server issue, broken delegation, or other resolution failure |
| NXDOMAIN | Domain name does not exist | Requested domain or hostname cannot be found |
| REFUSED | Server refused the request | DNS server policy or configuration prevents the query |
| Timeout | No response was received within the expected time | Network or server connectivity problem |
The key difference is simple enough. NXDOMAIN indicates the nonexistence of the name. SERVFAIL implies that the DNS could not resolve the request.
How Can Website Owners Avoid SERVFAIL?
Impossible to prevent all DNS issues. It is still possible to minimize the risk of experiencing a serious issue.
- Remember to keep the organization of your DNS zones.
- Verify them before making any changes.
- You should use authoritative DNS that you can rely on.
- Configure the delegation of your nameservers.
- Remember to verify DNSSEC settings.
It would also be convenient to track DNS queries from various points. The tool will inform you about unresolved domains before your clients do.
It is also recommended to keep the history of your DNS configuration. Information about how things failed to work out will help you solve the problem faster.
Conclusion
Although it is easy to see that SERVFAIL is a problem with your server, in fact, things about DNS can get much more complex. This message indicates that the DNS resolution failed to occur. The reasons for this may be quite numerous, from configuration/DNSSEC issues to the absence of authoritative servers, incorrect delegation, and any other DNS-related matters.
The good news is that most SERVFAIL errors can be investigated step-by-step. In particular, you have to check the domain name on various resolvers, investigate the authoritative nameservers, check any changes that may have been made recently, and run dig/nslookup.
On the side of Hostonce users and website owners in general, the conclusion is obvious: DNS reliability comes with hosting reliability.
FAQs
Is SERVFAIL a result of my internet connection?
Not necessarily. SERVFAIL is a DNS response, and the root cause can be on the side of the resolver, authoritative DNS, DNSSEC configuration, networking path, or the domain’s DNS configuration.
Is SERVFAIL equivalent to NXDOMAIN?
No. The former means that the DNS resolver was unable to provide a valid response. The latter indicates that the domain name queried does not exist.
Does DNSSEC cause SERVFAIL?
Yes. Broken DNSSEC validation can cause the SERVFAIL status in validating DNS resolvers.
How do I verify a SERVFAIL error?
Using tools for troubleshooting DNS should help you find out why you receive a SERVFAIL response.
Should I switch my DNS provider because of SERVFAIL?
Not yet. Switching DNS providers will hide the problem but not solve it. Find out the cause of SERVFAIL.
Muhammad Usama has had impactful journey of almost a decade exploring the wonders of writing. He is always excited to share relevant knowledge with the community. Usama enjoys reading books and travelling in his free time.
