DNS_PROBE_FINISHED_NXDOMAIN (domain not resolving)

What’s actually happening

Chrome shows "This site can't be reached" with DNS_PROBE_FINISHED_NXDOMAIN; Firefox words it as "We can't connect to the server." The page never loads because DNS returned NXDOMAIN — there's no A/AAAA record to connect to. It may hit some visitors and not others while a change propagates, which makes it look intermittent.

Common causes

• The domain's nameservers at the registrar still point at an old DNS host (or the default parking nameservers), so your records are never consulted
• The A/AAAA record for the apex or the www host simply doesn't exist in the active zone, or you created it in the wrong zone
• A CNAME points at a target that itself doesn't resolve (e.g. a deleted load balancer or a typo'd *.herokudns.com / *.cloudfront.net hostname)
• The domain expired or was suspended, so the registry pulled it from the root and every lookup returns NXDOMAIN
• A recent nameserver or record change is still propagating; old NXDOMAIN answers are cached up to the record/SOA TTL

How to fix it

1. Confirm it's really NXDOMAIN and wheredig example.com +short and dig www.example.com +short. Empty output with status: NXDOMAIN in the full dig means no record exists. Compare against a public resolver: dig @8.8.8.8 example.com and dig @1.1.1.1 example.com. If 8.8.8.8 resolves but your machine doesn't, it's local cache, not the zone.
2. Verify the delegation (nameservers)dig NS example.com +trace, or whois example.com | grep -i 'name server'. The NS records at the registrar must match the DNS provider where you're actually editing records. A mismatch here is the #1 cause — you're editing a zone nobody queries. Fix the nameservers at the registrar.
3. Add or correct the missing recordIn the zone that the live nameservers serve, create an A record (apex → server IP) and the www host (A or CNAME → apex). For apex CNAME-style setups use your provider's ALIAS/ANAME. Double-check there's no trailing-dot or wildcard typo in the value.
4. Rule out an expired domainwhois example.com and read the Registry Expiry Date and status (look for clientHold/serverHold or pendingDelete). If it lapsed, renew it — no DNS edit will resolve a domain the registry has put on hold.
5. Flush caches and wait out the TTLLocally: chrome://net-internals/#dns → Clear host cache, then ipconfig /flushdns (Windows) or sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder (macOS). Globally, propagation can take up to the old TTL (commonly minutes to a few hours, occasionally 24–48h for nameserver changes). Verify with a multi-region checker rather than refreshing your own browser.