BlueByte
DNS_PROBE_FINISHED_NXDOMAINWorkaround

Chrome: DNS_PROBE_FINISHED_NXDOMAIN

By Haneul SeoUpdated August 18, 20263 min

Hi, it's BlueByte. NXDOMAIN sounds like the site is down, but it almost never is — the name just didn't resolve, and that's a problem on your side of the lookup. Let's confirm it's DNS, find out whether it's one device or all of them, and fix it in the right place.

What NXDOMAIN actually means

A page fails to load with:

This site can't be reached
DNS_PROBE_FINISHED_NXDOMAIN

NXDOMAIN means the DNS lookup returned "no such domain". The name could not be resolved to an address — a DNS problem, not a problem with the site's server. That distinction matters: nothing you do to the site helps; the fix is on the resolving side — your device, your resolver, or your router.

Why a name fails to resolve

  • A typo in the domain — NXDOMAIN is exactly what a misspelled name returns.
  • A stale or poisoned DNS cache on your device holding a failed lookup.
  • A resolver that is not answering correctly — an ISP resolver having trouble, or a filtering DNS service blocking the name.
  • A hosts-file entry overriding the name to somewhere invalid.
  • A VPN or corporate split-DNS that only resolves internal names and returns NXDOMAIN for the rest.

First, find out where it fails

Narrow it down before touching anything. Try the same site on another device on the same network:

  • If only one device fails, the cause is local to it — cache, resolver, or hosts file.
  • If every device fails, fix it on the router or resolver.

Then confirm it really is DNS by resolving the name directly against a public server:

nslookup example.com 8.8.8.8

If a public resolver answers but your normal one does not, your resolver is the problem. If even 8.8.8.8 returns NXDOMAIN, the domain genuinely does not exist — recheck the spelling.

Fix it cheapest-first

  1. Check the address for a typo — the cheapest fix.

  2. Flush the DNS cache.

Windows:

ipconfig /flushdns

macOS:

sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder
  1. Switch to a public resolver — set your network's DNS to 8.8.8.8 and 1.1.1.1 and reload.

  2. Check the hosts file (C:\Windows\System32\drivers\etc\hosts on Windows, /etc/hosts on macOS/Linux) for a stale entry pointing the domain somewhere wrong, and remove it.

A real case: one laptop, stale resolver

One laptop cannot open a site that loads fine on your phone on the same Wi‑Fi. Because only the laptop fails, the problem is local to it. nslookup example.com 8.8.8.8 answers with an address, so DNS itself works — your laptop's cache or resolver is stale. You run ipconfig /flushdns, reload, and it still fails, so you set the adapter's DNS to 1.1.1.1. The page loads. The old ISP resolver had cached a failed lookup; pointing at a public resolver bypassed it.

Confirm it loads, and note what fixed it

Reload the page. If it loads, note which step fixed it. You can also clear Chrome's own cache at chrome://net-internals/#dns → Clear host cache and retry, to rule out a browser-level stale entry.

Keep it from recurring

Use a reliable resolver (a public one or a well-run internal server), keep the hosts file free of leftover test entries, and remember that a VPN or filtering DNS service can start returning NXDOMAIN for names it does not like — disable it briefly to test when a single name fails.

How this differs from a connection error

DNS_PROBE_FINISHED_NXDOMAIN is resolution failing. ERR_CONNECTION_REFUSED and ERR_CONNECTION_TIMED_OUT happen after the name resolves — the server was found but did not accept the connection — so those are reachability problems, not DNS. When you see NXDOMAIN, check the resolver, not the site.

Related questions

Only my computer fails; my phone loads the site. Why?

The problem is local to that computer — a stale DNS cache, a bad resolver setting, or a hosts-file entry. Flush the cache and switch to a public resolver.

Is a VPN or ad blocker related?

It can be. A VPN or filtering DNS service may fail to resolve certain names. Disable it briefly to test, then adjust its settings.

The OS flush didn't help.

Clear Chrome's own DNS cache at chrome://net-internals/#dns → Clear host cache. Chrome caches separately from the OS.

Every device on my network fails for one site.

Fix it on the router: change the router's DNS servers to a public resolver, or check whether a network-wide filter is blocking the name.

Even 8.8.8.8 returns NXDOMAIN. Now what?

The domain genuinely does not resolve — it may be misspelled, expired, or not yet propagated. Recheck the spelling and, for a new domain, wait for DNS propagation.

References

Haneul Seo

Infrastructure engineer · 10+ years running Linux fleets

More in this category

Start request repeated too quicklyFixed

systemd: Start request repeated too quickly

systemd refuses to start a unit that was started more than StartLimitBurst times (default 5) within StartLimitIntervalSec (default 10s), and Restart= counts against that limit. With the 100 ms default RestartSec a crashing service burns all five attempts in under a second. Find the real crash in the journal, fix it, run reset-failed, and give restarts room with RestartSec.

systemd
Too many authentication failuresFixed

SSH: Received disconnect ... Too many authentication failures

Your agent is offering more keys than the server will let you try. Every public key sshd looks at burns one of the MaxAuthTries attempts — six by default, often three on a hardened host — so the right key never gets its turn and the server hangs up before you type anything. IdentitiesOnly=yes with an explicit IdentityFile pins the connection to one key and the attempt count drops to one.

OpenSSH
1722Fixed

Active Directory: replication fails with error 1722, The RPC server is unavailable

RPC reports 1722 (0x6ba, RPC_S_SERVER_UNAVAILABLE) when a lower layer fails to connect, so the real fault is almost never RPC itself — it is DNS, a blocked port, or a host-side setting on one of the two domain controllers. repadmin tells you which partner is failing, dcdiag /test:dns rules out name resolution, and Test-NetConnection plus the dynamic port range settle the firewall question. The most common miss is a rule that allows TCP 135 but not 49152–65535.

Windows Server Active Directory
Windows Server RDSFixed

Windows Server RDS: The remote session was disconnected because there are no Remote Desktop License Servers available to provide a license

The 120-day RD Licensing grace period ended and the session host has no usable license server, so it refuses sessions. GetGracePeriodDays returning DaysLeft 0 and an empty SpecifiedLSList confirm it in seconds. The fix is a real, activated license server with CALs that are new enough for the host — a 2019 CAL cannot serve a 2022 session host — configured through the deployment or the Licensing policies, plus RPC ports open between the two.

Windows Server RDS
0x80070035 / Event ID 31017Workaround

Windows 11: "Your organization's security policies block unauthenticated guest access" when opening a NAS share (0x80070035)

The SMB client on Windows 10 Enterprise/Education/Pro for Workstations, Windows 11 Pro and Windows Server 2019+ refuses guest logons by default, and Windows 11 24H2 Enterprise/Pro/Education also requires SMB signing, which guest sessions can't do. A NAS share that only offers guest access therefore fails with the 'block unauthenticated guest access' dialog, Error code 0x80070035, or System error 3227320323, and Event ID 31017 'Rejected an insecure guest logon' lands in the SmbClient/Security log. The fix Microsoft recommends is a real account on the NAS and signing support in its firmware; Set-SmbClientConfiguration -EnableInsecureGuestLogons $true (plus -RequireSecuritySignature $false on 24H2) is the escape hatch, and it costs you signing and encryption on that client.

Windows (SMB client)
E: Could not get lock /var/lib/dpkg/lock-frontendFixed

Ubuntu/Debian: E: Could not get lock /var/lib/dpkg/lock-frontend — who holds it and how to wait for it

Another package manager, usually Ubuntu's unattended-upgrades fired by a persistent systemd timer at boot, holds the dpkg frontend lock while your apt-get runs. apt-get gives up at once while apt waits because Ubuntu ships binary::apt::DPkg::Lock::Timeout "120" for the apt binary only. Read the PID from the message, let the run finish or pass -o DPkg::Lock::Timeout=<seconds> to apt-get, run dpkg --configure -a only after a genuinely interrupted run, and never delete the lock file: it is an fcntl lock the kernel releases when the holder exits.

APT (Ubuntu/Debian)