What is SERVFAIL?

SERVFAIL (server failure) is the DNS response code meaning the server couldn't produce an answer, such as when nameservers are down or DNSSEC fails.

SERVFAIL is response code 2 in the DNS header. It differs from the other common failures:

• NXDOMAIN (code 3) is a definite answer that the name doesn't exist.
• REFUSED (code 5) means the server won't answer this client or question, for example a resolver queried from outside its allowed networks.
• SERVFAIL means the server tried and couldn't get a trustworthy answer.

On a recursive resolver the usual causes are that none of the zone's authoritative servers responded, the delegation points at servers that don't actually serve the zone, or DNSSEC validation failed: an expired RRSIG, a DS that doesn't match the zone's key, or signatures missing where they're expected. Validating resolvers deliberately return SERVFAIL instead of an answer they can't verify. An authoritative server can return it too, for example a secondary whose copy of the zone has expired.

Because one code covers so many faults, troubleshooting means narrowing it down. Repeating the query with dig +cd (checking disabled) asks the resolver to skip validation: if an answer now comes back, the problem is DNSSEC. Querying the authoritative servers directly with dig @server shows whether they respond at all. Modern resolvers also attach Extended DNS Errors (EDE), so dig may print a reason such as "DNSKEY Missing" or "No Reachable Authority". Resolvers cache failures for a short time, so after fixing the cause you may need to flush the resolver's cache, for example with rec_control wipe-cache on the PowerDNS Recursor. The PowerDNS on Debian lesson produces and diagnoses three different SERVFAILs.