ServFail
Server Failure
ServFail (2) means the DNS server was unable to process the query due to a problem on the server side. This is not a problem with the query or the queried name – the server encountered an internal failure. ServFail is the most common DNS error seen in production and often indicates a DNSSEC validation failure or a recursive resolver that cannot reach authoritative servers.
RCODE
2
Name
ServFail
Standard
RFC 1035
Description
SERVFAIL covers a range of server-side failures. The most common in modern DNS: DNSSEC validation failure (the zone is signed but the signatures are invalid or expired, and the validating resolver cannot establish a chain of trust). Other causes: the recursive resolver cannot reach any authoritative nameserver for the zone, a temporary internal error, or zone data inconsistency. When troubleshooting SERVFAIL, use 'dig +cd' (checking disabled) to bypass DNSSEC validation and see if the record exists without validation.
Common Causes
- –DNSSEC validation failure (broken or expired signatures)
- –Recursive resolver cannot reach authoritative nameservers
- –Zone data inconsistency on authoritative server
- –Network partition between recursive and authoritative server
- –Authoritative server software error processing zone data