DNS SERVFAIL: find the cause and fix it

What the message looks like

;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 41234

Common causes

• The DS record at the registry no longer matches the zone's DNSKEY after a provider change.
• Expired RRSIG signatures because automatic re-signing stopped.
• Lame delegation: listed nameservers are not authoritative for the zone or unreachable.
• Nameservers answer incorrectly or block TCP/EDNS (large responses).

Check

1. Query with DNSSEC data
   dig example.com A +dnssecCopy
2. Same query with checking disabled – if it works, DNSSEC is the problem
   dig example.com A +cdCopy
3. Query the DS record at the parent zone
   dig +short DS example.com @a.gtld-servers.netCopy
4. Query DNSKEY directly at the authoritative server
   dig +short DNSKEY example.com @ns1.example-dns.comCopy
5. Show the validation chain with a reason
   delv example.com ACopy

Fix

• Delete the wrong DS record at the registrar or replace it with the matching one; mind the DS TTL.
• When moving a DNSSEC-signed domain, remove the DS first, wait out the TTL, then move and re-sign.
• Check and fix automatic re-signing at the DNS provider or in BIND/PowerDNS.
• Align NS records at the registry and in the zone.
• Flush resolver caches after the fix, e.g. unbound-control flush_zone example.com.

FAQ

Why does it work for some users but not others?

Only validating resolvers (e.g. 1.1.1.1, 8.8.8.8, many ISPs) return SERVFAIL. Non-validating resolvers still hand out the answer.

How long after the fix until it works?

As long as the TTL of the DS record or of cached negative answers – often one to 24 hours.