NXDOMAIN, SERVFAIL and REFUSED

Read DNS errors such as NXDOMAIN, SERVFAIL and REFUSED along the stub resolver → recursive resolver → delegation → authoritative nameserver path. A recursive resolver can answer from cache, so a user response is not necessarily fetched directly from the authoritative server. TTL, record type and response code explain where the result came from and how long it can remain usable.

How to check the DNS result

Check the name and query type first, then the authoritative answer, then the chosen recursive resolver. NXDOMAIN, SERVFAIL, REFUSED and timeout represent different conditions. After a DNS change, compare authoritative data with several resolvers; clearing a local cache helps only when the stale answer is actually local.

The detail that matters

NXDOMAIN means the queried name does not exist in the DNS view that answered; SERVFAIL means resolution failed to produce a usable answer; REFUSED means the server declined the operation. A timeout is different again because no valid DNS response arrived within the client’s waiting period. You can repeat the DNS check with 2ip DNS response check.