Networking: dig: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL — resolver failed to answer (DNSSEC validation or upstream failure)
The DNS resolver couldn't get a valid answer, often because DNSSEC signatures are broken or the authoritative servers fail.
status: SERVFAILSERVFAIL DNSSEC validation faileddig status SERVFAILDNSSEC bogusvalidation failure SERVFAIL Meaning
Test with checking disabled: dig +cd example.com. If that works, the domain's DNSSEC is broken (expired signatures, DS record mismatch after a provider change). Otherwise the authoritative servers are lame or unreachable. Fix or remove the DS record at the registrar and verify with a DNSSEC debugger.
Common causes
- DS record at the registrar doesn't match the zone's keys
- Expired RRSIG signatures
- Authoritative nameservers down or lame
- Moving DNS providers without updating DS
- Resolver can't reach the authoritative servers
⚡ Quick fix
- Compare
dig example.comanddig +cd example.com - Fix/remove the DS record at the registrar
- Check authoritative servers:
dig +trace example.com
Detailed fix by platform
Linux
- bash
dig example.com +dnssec dig +cd example.com dig +trace example.com
How to diagnose
- +cd result — Works?
- DS record — Matches keys?
- Nameservers — Responding?
🔧 Still not fixed?
Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:
Similar errors
Most viewed in Networking
- Native VLAN mismatch / wrong VLAN, no connectivity Networking: %CDP-4-NATIVE_VLAN_MISMATCH / device on the wrong VLAN can't reach the gateway
- Port err-disabled (psecure-violation) Networking: %PM-4-ERR_DISABLE: psecure-violation error detected on Gi0/5, putting Gi0/5 in err-disable state
- Rogue DHCP server hands out wrong gateway/DNS Networking: Clients receive the wrong default gateway or DNS server — a rogue DHCP server (often a home router) answers first
Other ways to find it
Where this error sits
Origin: Network. Errors that are often confused with or caused by this one (click to open):
🧠 Still stuck? Analyze your error
Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.
💬 What worked for others
No tips yet — did something else fix this for you?
Share what worked for you
Tips are checked by an editor before they appear. Links are removed.
Report a correction or suggest an improvement
Last updated 5 Nov 2026