DNS_PROBE_FINISHED_BAD_CONFIG

What’s actually happening

Every site fails the same way, including ones you reached five minutes ago. Chrome runs its built-in DNS probe, can't get a usable answer from the resolver your OS handed it, and gives up with BAD_CONFIG. The tell is that it's machine-wide: a phone on the same Wi-Fi loads fine, but this device can't resolve anything. Refreshing does nothing because the problem is the resolver setting, not the page.

Common causes

• A static DNS server was set manually (e.g. a typo'd 8.8.8.8 as 8.8.8.0) and that IP isn't actually answering queries
• A VPN or security client edited the adapter's DNS and left a stale or internal-only resolver behind after disconnecting
• Malware or a rogue app rewrote network settings to point DNS at a dead or hijacked server
• The DHCP lease expired or the router rebooted and the device is holding an old resolver address that no longer responds
• Corrupted TCP/IP or DNS client state in the OS after a crash or bad update

How to fix it

1. Flush Chrome's internal DNS cache firstOpen chrome://net-internals/#dns, click Clear host cache, then chrome://net-internals/#sockets and Flush socket pools. This clears Chrome's own resolver state without touching the OS. Reload the tab. If it sticks, the problem is below Chrome.
2. Reset the OS resolver to automatic (DHCP)Windows: ncpa.cpl > adapter Properties > IPv4 > 'Obtain DNS server address automatically'. macOS: System Settings > Network > Details > DNS, remove any manually listed servers so it inherits from DHCP. This undoes the most common cause — a bad manual or leftover-VPN resolver.
3. Flush the OS DNS cache and renew the leaseWindows: 'ipconfig /flushdns' then 'ipconfig /release' and 'ipconfig /renew'. macOS: 'sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder'. This drops cached bad entries and pulls a fresh resolver from the router.
4. Reset the network stack if it still failsWindows: 'netsh winsock reset' and 'netsh int ip reset', then reboot. This rebuilds the Winsock catalog, which a misbehaving VPN or AV filter driver commonly corrupts.
5. Set a known-good public resolver as a testTemporarily set DNS to 1.1.1.1 or 8.8.8.8. If sites load, your router's or ISP's resolver was the dead one; if it still fails, suspect a local filter driver, firewall, or malware and scan the machine.