# Networking: dig: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL — resolver failed to answer (DNSSEC validation or upstream failure)

**Code:** `dig: status: SERVFAIL (DNSSEC validation failed)` · **Category:** Networking · **Seen on:** Linux, Networking

The DNS resolver couldn't get a valid answer, often because DNSSEC signatures are broken or the authoritative servers fail.

## Meaning

Test with checking disabled: `dig +cd example.com`. If that works, the domain's DNSSEC is broken (expired signatures, DS record mismatch after a provider change). Otherwise the authoritative servers are lame or unreachable. Fix or remove the DS record at the registrar and verify with a DNSSEC debugger.

## Common causes

- DS record at the registrar doesn't match the zone's keys
- Expired RRSIG signatures
- Authoritative nameservers down or lame
- Moving DNS providers without updating DS
- Resolver can't reach the authoritative servers

## Quick fix

1. Compare `dig example.com` and `dig +cd example.com`
2. Fix/remove the DS record at the registrar
3. Check authoritative servers: `dig +trace example.com`

## Detailed fix by platform

### Linux

1. 

```bash
dig example.com +dnssec
dig +cd example.com
dig +trace example.com
```


## How to diagnose

1. **+cd result** — Works?
2. **DS record** — Matches keys?
3. **Nameservers** — Responding?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/networking/dns-servfail-dnssec-validation-failed)