If a website opens by IP address but not by its domain name, the server is probably reachable and the failure is in the hostname path: DNS records, delegation, cached answers, DNSSEC, or (after DNS succeeds) the web server’s host, TLS, firewall, or IPv6 configuration. Work through the checks below in order. They identify whether the fault is on your device, a recursive resolver, the domain’s authoritative DNS, or the origin server.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What the symptom proves—and what it does not
Entering https://203.0.113.20 can reach an IP address without asking DNS to translate a name. Entering https://example.com first requires a resolver to find an address, then requires the web server to select the correct site for that hostname. A successful IP test therefore proves only that one address is reachable with the protocol and port you tested. It does not prove that example.com or www.example.com has a valid record, that the domain is delegated to the DNS provider you edited, or that the server has a certificate and virtual host for the name.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
Use the exact hostname that fails. The zone apex (example.com) and a subdomain (www.example.com, blog.example.com) are separate DNS names and can have different records. Also note whether the working test used HTTP or HTTPS and whether it used IPv4 or IPv6; those details affect the later diagnosis.
| Browser or command result | Most likely layer | What to check first |
|---|---|---|
DNS_PROBE_FINISHED_NXDOMAIN |
The resolver received a definitive “name does not exist” answer. | A missing record, wrong zone, expired domain, or incorrect delegation. |
DNS_PROBE_POSSIBLE or a generic name-resolution failure |
The lookup could not obtain a usable answer. | A/AAAA/CNAME records, resolver differences, and authoritative responses. |
SERVFAIL |
An authoritative, DNSSEC, or protocol problem prevented validation. | DS/DNSKEY, signatures, server consistency, and TCP fallback. |
| The name resolves to the expected IP but the page fails | HTTP, TLS, virtual-host, firewall, or address-family issue. | Certificate, Host header, web-server binding, ports 80/443, and IPv6. |
1. Verify the hostname and its DNS records
Check the spelling and the complete URL
Remove browser autocomplete and type the hostname manually. Confirm that you did not omit www, add an extra label, or use a development or staging name. A browser may also retain an HTTPS upgrade or cached redirect, so test both the exact failing URL and a command-line lookup.
#1 Best Overall
- VERSATILE CABLE TESTING: Cable tester for data (RJ45) terminated cables and patch cords, ensuring comprehensive testing capabilities
- LARGE BACKLIT LCD: Backlit LCD display enables easy reading of pin-to-pin wiremap results, even in low-lit areas
- COMPREHENSIVE FAULT DETECTION: Test for Open, Short, Miswire, Split-Pair faults, Cross-over, and Shield, providing thorough fault detection
- INTUITIVE USER INTERFACE: User-friendly interface with three buttons and simple, easy-to-identify test responses, ensuring a smooth testing experience
- MULTIPLE TONE GENERATOR STYLES: Tone on a single wire, wire pair, or all 8 conductor wires using the multiple style tone generator (solid/warble); requires probe Cat. No. VDV500-123 (sold separately)
Inspect the apex and every active subdomain
In the authoritative DNS control panel, inspect the zone for the apex and the requested subdomain. The web address may be served by an A record (IPv4), an AAAA record (IPv6), or a CNAME that points to another hostname. Compare each value with the current origin address supplied by your hosting service. Remove obsolete values only after confirming that no other service uses them.
Cloudflare’s DNS troubleshooting guidance notes that missing records can produce DNS_PROBE_POSSIBLE; it recommends checking the zone apex, active subdomains, and origin IP. Cloudflare also defines DNS_PROBE_FINISHED_NXDOMAIN as a completed lookup whose result is that the domain does not exist. An NXDOMAIN response is different from a temporary timeout: it generally means the resolver was told that no such name or delegated zone exists.
Query records from your computer
Run both A and AAAA queries, then follow a CNAME if one is returned. Replace the example name with the failing hostname.
dig example.com A
dig example.com AAAA
dig www.example.com CNAME
nslookup example.comAn empty answer section is significant, but read the status and authority sections too. An A record may be present while an AAAA record points to an unreachable IPv6 address; browsers can prefer IPv6 and appear to ignore the working IPv4 path. A CNAME must point to a name that itself resolves, and a CNAME cannot coexist with other data at the same owner name in the usual DNS configuration.
2. Compare independent recursive resolvers
Your device normally asks a recursive resolver supplied by the network, router, VPN, or internet provider. That resolver may have a stale cache, a broken forwarding path, or a policy problem. Query several public resolvers to separate a local or resolver-specific fault from a domain-wide fault.
Rank #2
- VERSATILE CABLE TESTING: Cable tester tests voice (RJ11/12), data (RJ45), and video (coax F-connector) terminated cables, providing clear results for comprehensive testing on unenergized Ethernet cables (not designed to test PoE)
- EXTENDED CABLE LENGTH MEASUREMENT: Measure cable length up to 2000 feet (610 m), allowing for precise cable length determination
- COMPREHENSIVE FAULT DETECTION: Test for Open, Short, Miswire, or Split-Pair faults, ensuring thorough fault detection and identification
- BACKLIT LCD DISPLAY: Backlit LCD screen displays cable length, wiremap, cable ID, and test results, ensuring easy readability in various lighting conditions
- EFFICIENT CABLE TRACING: Trace cables, wire pairs, and individual conductor wires using the multiple style tone generator (requires analog probe Cat. No. VDV500-123, sold separately), simplifying cable tracing tasks
dig @8.8.8.8 example.com A
dig @1.1.1.1 example.com A
dig @9.9.9.9 example.com A
dig @208.67.222.222 example.com AThese addresses represent Google Public DNS, Cloudflare 1.1.1.1, Quad9, and OpenDNS respectively. You can perform the same comparison with nslookup by placing the resolver address after the hostname:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsnslookup example.com 8.8.8.8
nslookup example.com 1.1.1.1Interpret the pattern
- All public resolvers fail in the same way: the domain, its delegation, or its authoritative servers are the probable source. Google’s Public DNS troubleshooting guidance uses this pattern to distinguish domain-side failures from a single resolver path.
- Only your normal resolver fails: retry over a different network, temporarily configure another resolver, and report the failing name and response code to the affected resolver operator. Do not change authoritative records to compensate for a recursive-cache problem.
- Answers differ between resolvers: suspect TTLs, recently changed delegation, multiple active DNS providers, or inconsistent authoritative servers. Record the answer, status, and time from each query before making changes.
3. Confirm registrar delegation and the authoritative zone
Find the delegated name servers
Ask a resolver for the domain’s NS records and then query each returned server directly:
dig example.com NS
dig @ns1.example-dns.net example.com SOA
dig @ns2.example-dns.net example.com SOA
dig @ns1.example-dns.net www.example.com AUse the actual authoritative names shown by the NS query. The SOA serial and record answers should be coherent across every authoritative server. If one server returns an old address or fails while another returns the new one, the zone is not being served consistently.
Match the registrar to the DNS provider
The registrar’s delegated name-server list must exactly match the active DNS provider’s assigned names, including every required server. Editing a hosted zone has no effect if the registrar still delegates the domain to a former provider. Cloudflare identifies mismatched registrar name servers as a cause of failed resolution. DigitalOcean lists incomplete name-server propagation, incorrect registrar configuration, and multiple active DNS providers among common causes.
After a DNS-service migration, check for duplicate hosted zones. AWS explains that an old zone can continue answering when the registrar delegation was never changed, while edits made in the new provider appear to do nothing. Make one provider authoritative, remove accidental duplicate delegations, and keep a written record of which zone is live.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- Multifunctional NOYAFA NF-8508 Network Cable Tester: There are nine features to meet your needs. Continuity Testing, Cable Scan, Port Flash, Length Measurement, POE Power Supply Test, QC testing, Optical Power Meter, VFL and NVC function.It is perfectly suited for various engineering cabling projects, network troubleshooting, network equipment maintenance and testing scenarios. Its precise cable scanning and fault localization capabilities help you effortlessly pinpoint the root cause of issues.
- 7 WAVELENGTHS OPTICAL POWER METER: NF-8508 network cable tester can measure 7 standard wavelengths, 850/1300/1310/1490/1550/1625/1650, power detecting range(dBm): -70 ~ +10. Its power detection range spans from -70 dBm to +10 dBm, supporting FC/SC/ST connectors. It enables precise fiber optic power measurement, helping users efficiently assess fiber signal strength and ensure healthy fiber link operation. It effortlessly detects attenuation issues within fibers, thereby safeguarding fiber network stability.
- High Efficiency Visual Fault Locator: Easy identification of fiber breakpoints, poor connections, bending or cracking. Excellent for finding the right fiber to splice or quickly finding a break. Emmiting Energy: standard wavelenth: 650nm. Fast flashing, slow flashing, high precison.The built-in self-calibration ensures stable long-term performance, and Class IIIa laser (output<5mW) ensures safe daily operation.
- PORT FLASHING:The indicator light on the connection port in the NF-8508 device flashes to help accurately locate the cable. Displays port information, including operating speed, duplex mode, and negotiation settings. Port lights flash on the same screen to show the port's operating speed, making it easy to pinpoint lines and ports.
- PoE Testing and Cable Length Test: PoE testing can check cable mapping polarity and voltage of PoE network switches, withstand 60VDC. Automatically detects and switches between 10M/100M/1000M modes, Includes cable tracking, short circuit test, interruption of circuit test and etc The RJ45 cable tester can quickly measure the length of the cable with a range of 200m. Not only network cables, but also phone lines and BNC cables.
Check the domain and nameserver status
Confirm that the registration has not expired, that the domain is not suspended, and that the delegated nameservers themselves resolve to reachable addresses. If the parent zone has no NS delegation for the domain, recursive resolvers can return NXDOMAIN even when a provider’s control panel contains a perfectly configured zone.
4. Account for TTL and cached answers
Every DNS record has a TTL (time to live), measured in seconds. AWS Route 53 documentation describes TTL as the period during which resolvers may cache information such as a web server’s IP address. A resolver can therefore continue returning an old address after you correct the authoritative record, until that cached TTL expires.
Determine whether you are seeing an old value
Compare the answer from several resolvers and note the remaining TTL shown by dig. If authoritative servers already return the new address but a recursive resolver returns the old one, wait for the old TTL rather than repeatedly editing the record. Lowering a TTL affects future caching; it cannot recall answers already cached under the previous value.
Flush local and intermediate caches
Once authoritative data is correct, clear the operating system’s DNS cache, restart the browser, and retry from a separate network. Routers, VPN clients, enterprise forwarders, and security software can maintain their own caches. Google documents cache-flush tooling for its Public DNS service; a local flush does not force an upstream resolver to discard an unexpired answer.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchDigitalOcean’s 2026 support guidance says nameserver changes usually take 24–48 hours to update completely. That is a typical window, not a universal timer: the actual delay depends on the old TTLs, parent-zone delegation caches, resolver behavior, and whether the change was made at the registrar or only inside a hosted zone.
Rank #4
- Automatically runs all tests and checks for continuity, open, shorted and crossed wire pairs. Visible LED status display.
- Cable state testing (2-wire): Line DC detecting, anode and cathode determination,Ringing signal detecting open, short and cross circuit testing
- Cable Type: RJ11 Telephone cable and RJ45 LAN cable
- Connectors: Ethernet Cat 5, Ethernet Cat 5e, Ethernet Cat 6, Ethernet Cat 7, RJ11 6P and RJ45 8P
- Power Source: DC9V Battery Required (not included)
5. Diagnose DNSSEC when the response is SERVFAIL
DNSSEC adds signatures that allow validating resolvers to detect altered DNS data. A broken chain commonly appears as SERVFAIL, even though a non-validating lookup may appear to work. Google’s Public DNS guidance recommends comparing a validating query with a query that does not validate; if dns.google returns SERVFAIL while non-DNSSEC queries succeed, investigate DNSSEC.
Common DNSSEC breakpoints
- A stale DS record remains at the registrar after moving DNS providers or generating a new signing key.
- The parent DS record does not match the child zone’s DNSKEY.
- A signature has expired because the authoritative signer stopped renewing it.
- An authoritative response is too large for UDP and the server or firewall fails to support TCP retry.
- Only some authoritative servers publish the new key or signatures.
Validate the chain
Check the registrar’s DS records against the DNS provider’s DNSKEY values and confirm that every authoritative server returns the same data. DNSViz and DNSSEC Analyzer are useful visual validation tools recommended in Google’s troubleshooting material. If you intentionally disabled DNSSEC during a migration, remove the DS record at the registrar only after following the provider’s documented order; leaving a DS record for an unsigned zone causes validating resolvers to reject it.
6. Test authoritative-server reliability and transport
A domain can have correct records yet fail intermittently if an authoritative server is offline, gives different answers, blocks resolver traffic, or mishandles large responses. Query each authoritative server directly several times from different networks. Check that all servers return the same SOA serial, A/AAAA/CNAME data, and DNSSEC records when enabled.
Google advises that authoritative servers should handle UDP truncation correctly and accept the TCP retry that follows a truncated response. Firewalls that permit UDP port 53 but block TCP port 53 can break DNSSEC and other large replies. Excessive rate limits or geographic blocking can also prevent recursive resolvers from completing a lookup. The remedy is usually at the authoritative DNS host or network firewall, not on the web server.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. When DNS resolves but the website still fails
Once dig returns the expected address from independent resolvers, stop changing DNS records and test the application layer. A hostname can resolve correctly while the origin rejects the request.
Best Value
- Multi-Function Network Cable Tester: Supports RJ45 (CAT5, CAT5e, CAT6, CAT6A, CAT7) and RJ11 telephone cables. Quickly detects continuity, short circuits, open wires, miswiring, and cable shielding status, ensuring your LAN or phone lines are correctly wired and ready to use.
- Fast/Slow Mode with LED Indicators: Switch between fast and slow scan speeds to identify wiring issues more precisely. LED lights on both master and remote units show wire order, making it easy to spot errors like open pairs or misaligned pins at a glance.
- Split-Type Design for Long-Distance Testing: Master and remote units can be detached and used separately, allowing you to test both ends of a long cable run, ideal for wall-mounted ports, long runs, or structured cabling. Perfect for home, office, or professional IT setups.
- Compact, Lightweight & Durable: Ergonomically designed with sturdy ABS housing, this pocket-sized tester is ideal for on-the-go network engineers, DIYers, and electricians. It’s your go-to toolkit for cable maintenance, upgrades, or new installations.
- Safe & Easy to Use: Simple one-button operation makes testing quick and hassle-free. LED indicators clearly show wiring status, while the G light instantly identifies shielded (FTP/STP) or unshielded (UTP) cables. Supports safe testing of telephone lines with typical voltages under 48-72V, ideal for both home and professional use.
Verify TLS and the hostname
HTTPS certificates are issued for names, not bare IP addresses. Browsing to an IP may show a certificate warning or a default site even when the domain’s certificate is valid. Test the hostname so the client sends the correct Server Name Indication (SNI):
curl -Iv https://example.com
openssl s_client -connect 203.0.113.20:443 -servername example.comLook for an expired certificate, a missing SAN entry, an incomplete intermediate chain, or a certificate installed on a different virtual host. Renew or bind the certificate to the hostname rather than accepting a browser exception.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Check virtual-host and Host-header routing
Web servers commonly host several sites on one IP and select the site from the HTTP Host header (and TLS SNI for HTTPS). An IP request can therefore show a default site while the domain request returns an error, redirect loop, or blank page. Confirm that the exact apex and www names are listed in the server block, site binding, reverse proxy, and application’s allowed-host list.
Check ports, firewalls, and IPv6
Confirm that ports 80 and 443 are open at the host firewall, cloud security group, load balancer, and local network edge. If an AAAA record exists, test IPv6 explicitly:
curl -6 -Iv https://example.com
curl -4 -Iv https://example.comIf IPv4 succeeds but IPv6 fails, repair the IPv6 route, listener, firewall rule, or AAAA record. Removing an outdated AAAA record is safer than leaving browsers to repeatedly choose an unreachable address, but do so only when IPv6 is not intentionally serving the site.
8. A compact recovery runbook
- Write down the exact failing hostname, URL scheme, browser error, and the IP address that worked.
- Query A, AAAA, and CNAME records locally and against 8.8.8.8, 1.1.1.1, 9.9.9.9, and 208.67.222.222.
- If answers are missing or NXDOMAIN appears, inspect the apex and subdomain records, domain status, and active zone.
- Query the delegated NS records and each authoritative server; correct registrar delegation or duplicate-provider mistakes.
- Compare authoritative answers, SOA serials, and TTLs; allow cached old answers to expire and flush local caches.
- If the status is SERVFAIL, validate DS/DNSKEY, signatures, and UDP-to-TCP fallback with DNSViz or DNSSEC Analyzer.
- After DNS is correct, test HTTPS, certificate/SNI, virtual-host bindings, firewall rules, and IPv4 versus IPv6.
- Capture command output and timestamps when contacting the registrar, DNS host, resolver operator, or hosting provider. The response code and which server supplied it usually determine ownership of the fix.
Choosing or changing a DNS provider
If repeated incidents expose operational weaknesses, evaluate providers on the functions that affect this failure mode rather than on brand reputation alone.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →| Evaluation axis | Questions to ask |
|---|---|
| Registrar and delegation workflow | Are assigned nameservers clear, and is the migration order documented? |
| Record support | Are A, AAAA, CNAME, ALIAS/ANAME where applicable, TXT, MX, and wildcard records supported without conflicting limitations? |
| DNSSEC | Can you create, rotate, and remove DS/DNSKEY data safely, with validation diagnostics? |
| TTL controls | Can records use the TTLs your deployment and failover plan require? |
| Resolver visibility | Are query logs, status codes, propagation views, and authoritative test tools available? |
| Authoritative reliability | Does the service operate multiple consistent nameservers and support UDP truncation plus TCP retry? |
| Migration handling | Can you import the complete zone, compare it before cutover, and preserve old answers during TTL expiry? |
| Monitoring and support | Can it alert on NXDOMAIN, SERVFAIL, DNSSEC expiry, and nameserver inconsistency, with support that understands delegation? |
No neutral provider ranking follows from these checks. The right choice depends on your registrar, application architecture, DNSSEC policy, monitoring needs, and tolerance for migration risk.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
