criticalIntermediateSymptom-first#dns#servfail#zone#dnssec#resolver

DNS SERVFAIL -- resolver cannot answer, misconfigured zone or broken DNSSEC

dig returns status: SERVFAIL for one or more domains

Likely source:connectivityavailability

Focused incident mode — strips away everything but this runbook.

Symptoms

  • dig returns status: SERVFAIL for one or more domains
  • Applications log 'Temporary failure in name resolution'
  • nslookup returns 'DNS server failure'

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • SERVFAIL confirmation

    dig <domain> +noall +comments

  • Zone SOA and DNSSEC status

    dig <domain> SOA +dnssec +short

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • Validating resolvers (e.g. 8.8.8.8) return SERVFAIL but non-validating resolvers work
  • dig +dnssec shows missing or expired RRSIG records

Confirm before fixing

dig <domain> @8.8.8.8 +dnssec +short
READ

Query a validating resolver to trigger DNSSEC validation

Expected: SERVFAIL or missing RRSIG

Fix

dig <domain> DS +short
READ

Verify the DS record at the parent matches the KSK; re-sign the zone if RRSIG expired

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
dig <domain> +noall +comments
READ

Confirm the SERVFAIL

2
dig <domain> @<authoritative-ns> +noall +answer +comments
READ

Check the authoritative NS directly

3
dig <domain> +dnssec +short
READ

Verify DNSSEC signatures

4
dig <zone> NS +short
READ

Verify nameservers are reachable

Prevention

  • Monitor DNSSEC expiration with delv or a dedicated monitoring service.
  • Ensure SOA refresh/retry/expire values are reasonable (refresh ~1h, expire ~1w).
  • Always have at least two reachable authoritative nameservers.
  • Set up alerting on SERVFAIL rates from your internal resolvers.

Related runbooks

Same stack, same failure family — worth a skim.

DNS returns NXDOMAIN for a record that exists -- stale resolver or propagation delayhigh

dig/nslookup returns NXDOMAIN for a domain that was recently updated

NetworkingIntermediate3 causes
Open runbook
DNS resolution failing inside pods — CoreDNS issuescritical

curl: Could not resolve host inside pods

KubernetesIntermediate2 causes
Open runbook

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.