DNS Response Codes Explained: NOERROR, NXDOMAIN, SERVFAIL

A practical reference for interpreting the status codes returned by every DNS query.

Core Concept

Every DNS response includes a status code indicating the outcome of the query, from a clean success to various categories of failure.

Reading these codes correctly is often the fastest way to distinguish between a genuinely nonexistent domain, a misconfiguration, and a temporary server issue.

Insight: DNS response codes carry precise, distinct meanings — treating every failure as a generic error discards useful diagnostic information.

Success and Non-Existence Codes

The two most common codes cover the baseline success and absence cases.

NOERROR — the query succeeded, though the answer section may be empty
NXDOMAIN — the queried domain doesn't exist at all
NOERROR with an empty answer often means the domain exists but lacks that record type

NOERROR Doesn't Mean 'Found'

A NOERROR response with no actual records is a common source of confusion — it means the domain exists, not that the specific record was found.

Server and Configuration Failure Codes

Several codes point specifically toward server-side or configuration problems rather than the domain itself being invalid.

SERVFAIL — the server encountered an internal error processing the query
REFUSED — the server declined to process the query, often due to policy
FORMERR — the query itself was malformed

Limitation: SERVFAIL is often transient, but a persistent SERVFAIL frequently indicates a DNSSEC validation failure or an unreachable authoritative server.

Diagnosing With Response Codes

A methodical read of the response code narrows down the likely cause quickly.

NXDOMAIN points toward a registration or zone configuration issue, while SERVFAIL more often points toward the nameserver infrastructure or DNSSEC itself.

Narrowing the Search

The response code alone often eliminates entire categories of possible causes before any deeper investigation is needed.

Common Misreadings

A few response code confusions come up repeatedly in practice.

Treating NXDOMAIN and SERVFAIL as interchangeable failure states
Missing that an empty NOERROR answer isn't actually an error
Overlooking that REFUSED can indicate a legitimate access restriction, not a bug

Insight: REFUSED responses are sometimes intentional — some authoritative servers deliberately refuse queries from unrecognized sources as a security measure.

Real-World Implementation

Response code analysis is a routine part of DNS troubleshooting and monitoring.

Monitoring tools alerting differently based on the specific response code
Support teams using response codes to triage domain issues quickly
DNS providers surfacing response codes directly in diagnostic dashboards

Learning to read response codes precisely, rather than treating every failure the same, meaningfully speeds up DNS troubleshooting.

Common Mistakes to Avoid

A few common mistakes lead to misreading DNS response codes during troubleshooting.

Treating every failure response the same regardless of the specific code returned.
Confusing a NOERROR response with an empty answer for an actual error.
Assuming NXDOMAIN and SERVFAIL point to the same category of underlying problem.
Overlooking that REFUSED can be an intentional security measure, not a bug.
Not checking the response code before jumping to deeper, more time-consuming diagnostics.
Overlooking less common response codes like NOTIMP and YXDOMAIN.
Assuming response codes carry the same meaning across all DNS query types.
Failing to correlate response codes with corresponding server-side logs during investigation.
Overlooking that EDNS-related errors can produce unusual, less familiar response behavior.
Assuming response code meaning is identical across every DNS software implementation.
Failing to log response codes systematically for later troubleshooting reference.
Overlooking that response code interpretation can be affected by an intervening DNS firewall.

Best Practices Checklist

These practices make response-code-based DNS troubleshooting faster and more accurate.

Read the specific response code first before pursuing deeper diagnostic steps.
Treat SERVFAIL as a signal to check nameserver infrastructure or DNSSEC validation.
Treat NXDOMAIN as a signal to check domain registration or zone configuration.
Distinguish an empty NOERROR response from an actual error condition.
Document which response codes commonly show up for known, expected scenarios.
Familiarize yourself with less common response codes for complete troubleshooting coverage.
Correlate response codes with server-side logs when diagnosing a persistent issue.
Document which response codes are expected for specific, known configurations.
Familiarize yourself with EDNS-related error patterns for more complete troubleshooting coverage.
Verify response code interpretation against the specific DNS software in use.
Log response codes systematically to support later troubleshooting and pattern analysis.
Consider intervening DNS firewalls or filters as a possible source of unexpected response codes.

Frequently Asked Questions

Frequently asked questions about DNS response codes.

What does NXDOMAIN actually mean?

It means the queried domain doesn't exist at all, which typically points toward a registration or zone configuration issue.

Is SERVFAIL always a serious problem?

Not necessarily — it's often transient, but a persistent SERVFAIL frequently indicates a DNSSEC validation failure or unreachable authoritative server.

Why would a query return NOERROR with no actual records?

This means the domain exists but simply lacks the specific record type being queried, which is different from an error.

What does a REFUSED response indicate?

It means the server declined to process the query, which can be an intentional security measure rather than a misconfiguration.

Can response codes help narrow down a DNS problem quickly?

Yes — reading the specific code often eliminates entire categories of possible causes before any deeper investigation is needed.

What does a NOTIMP response code mean?

It indicates the server doesn't support the type of query requested, which is relatively uncommon in standard DNS operation.

Are response codes consistent across all types of DNS queries?

Generally yes, though certain specialized query types can produce codes that require additional context to interpret correctly.

Why would correlating response codes with server logs help diagnosis?

Because the response code alone tells you the outcome, while server-side logs can reveal the underlying cause behind that outcome.

Can EDNS cause unusual DNS error behavior?

Yes — EDNS-related misconfigurations or incompatibilities can produce response patterns that are less familiar than standard, well-known error codes.

Is response code meaning consistent across DNS software?

Largely standardized, but subtle implementation differences can exist, making it worth verifying against your specific software when troubleshooting.

Can a DNS firewall alter response codes?

Yes — a filtering DNS firewall can return a different response code than the authoritative server would, worth ruling out during diagnosis.

Check DNS Response Status

Run a DNS analysis to see the exact response codes returned for a domain's records.

Launch Tool →