What is NXDOMAIN?

NXDOMAIN (Non-existent domain) is the DNS response code that means the name you asked about does not exist at all, a definite answer rather than a failure.

Every DNS response carries a response code (RCODE). NOERROR (0) means the query was answered, SERVFAIL (2) means the server couldn't get an answer, and NXDOMAIN (3) means the authoritative servers for the zone say the name doesn't exist. It applies to the whole name, for every record type. That's different from NODATA, a NOERROR response with an empty answer section, which means the name exists but has no records of the type you asked for, for example a name with an IPv4 address but no IPv6 one. Resolvers cache negative answers too, for a time taken from the zone's SOA record (RFC 2308), so a name that was just created can keep returning NXDOMAIN for a while if someone looked it up just before it existed. With DNSSEC, an NXDOMAIN can be proven with signed NSEC or NSEC3 records.

Telling the statuses apart is one of the quickest wins in troubleshooting. dig shows the status in its header. NXDOMAIN usually points at a typo, a record that was never created, or a query sent to the wrong zone, and it is not fixed by retrying. SERVFAIL points at a broken resolver path, unreachable authoritative servers or a DNSSEC validation failure, and a timeout means the resolver itself didn't answer. Search domains can confuse things: a stub resolver may try a short name with several suffixes and report NXDOMAIN for the last one. Some ISP resolvers have also rewritten NXDOMAIN into an advertising page, which breaks applications that expect it. The Linux Network Connectivity lesson shows how to read DNS statuses while troubleshooting.