Cybersecurity glossary
What is NXDOMAIN?
Learn what NXDOMAIN means in DNS, how negative caching works, why malware and typos generate NXDOMAIN traffic, and how NXDOMAIN hijacking can mislead users.
Definition
NXDOMAIN is a DNS response code that means the queried domain name does not exist in the DNS namespace known to the authoritative server.
Why missing-domain answers matter
People tend to think of DNS in positive terms: what address did a name resolve to, which mail server was returned, which text policy was found. Negative answers are just as useful. An NXDOMAIN response tells you the requested name does not exist, and that fact carries both operational and security meaning.
For users, NXDOMAIN often looks like a typo or a broken link. For defenders, the pattern behind many NXDOMAIN responses can be a valuable signal: misconfigured software, asset drift, or malware that keeps asking for domains that were never registered.
What NXDOMAIN tells a resolver
NXDOMAIN is more specific than a generic failure. It is not saying the network timed out or that the server refused to answer. It is saying the authoritative path determined that the queried name is absent.
Definitive name absence
The response indicates the queried domain name does not exist at that point in the DNS hierarchy.
Not the same as no data
A host can exist yet lack a requested record type; that is different from NXDOMAIN.
Cacheable for a while
Resolvers may negatively cache the response, reducing repeated failed queries for the same missing name.
Useful security telemetry
Large bursts of NXDOMAIN from one system can expose DGA malware, misrouted software, or discovery attempts.
How an NXDOMAIN answer is produced
A client asks for a domain
The stub resolver or application sends a lookup for a name such as api-typo.example.com.
A recursive resolver follows delegation
It walks the DNS hierarchy toward the authoritative servers for the closest enclosing zone.
Authority checks the name
The authoritative server determines whether the requested owner name exists in the zone.
NXDOMAIN is returned
If the name is absent, the server responds with response code 3, commonly called NXDOMAIN.
The resolver may cache the miss
Negative caching rules let the recursive tier avoid repeating the same failed lookup immediately.
Applications react
Browsers may show an error, services may retry or fail over, and defenders may log the event for analysis.
Common causes and what they usually mean
| Cause | What it looks like | Likely interpretation |
|---|---|---|
| User typo | A person enters exampel.com instead of example.com. | Usually harmless and short-lived unless it reflects a broader phishing or training issue. |
| Broken configuration | An application points at an old hostname removed during a migration. | Signals asset or deployment drift that may affect reliability. |
| DGA malware | One host generates many strange failed lookups on a schedule. | Strong hunt lead for malicious beaconing or automated discovery. |
| Expired or never-created subdomain | Documentation references a host that no longer exists. | May be low risk, or may indicate stale infrastructure that needs inventory review. |
Negative caching is useful, but it shapes troubleshooting
Resolvers do not always forward every repeated miss upstream. Under RFC 2308 rules, they can cache NXDOMAIN results for a limited period. That saves load and speeds up repeated failures, but it also means a name that was just created may still appear absent until negative caches expire.
This is one reason DNS cutovers sometimes feel inconsistent. One user may still see NXDOMAIN from a cached miss while another already sees the newly created record.
- Review NXDOMAIN volume by host, user, and process instead of only looking at domain-level counts.
- Preserve negative-response telemetry because it often reveals problems before a successful malicious connection occurs.
- Account for negative caching during incident response and new-record validation so you do not misread propagation behavior.
- Investigate repeated NXDOMAIN to high-entropy or date-based names as a potential DGA signal.
- Use clean recursive behavior for troubleshooting; resolvers that rewrite NXDOMAIN can hide the true problem.
- Audit old software, scripts, and infrastructure references when a service suddenly produces many misses.
- Watch for internal resolvers or upstream providers that monetize misses by redirecting them to search or ad pages.
- Pair NXDOMAIN analysis with endpoint telemetry when suspicious patterns come from one device repeatedly.
NXDOMAIN hijacking and why it is risky
A proper NXDOMAIN tells the client the name does not exist. Some providers historically replaced that answer with a search page, advertising endpoint, or synthetic response. Malware or captive portals can do something similar for their own purposes.
That practice, often called NXDOMAIN hijacking, creates confusion for users and defenders because the DNS layer is no longer reporting an honest negative result. It can also interfere with software that expects a clean failure.
The practical takeaway
NXDOMAIN is the DNS name-error response that says the queried domain does not exist. It is ordinary, common, and surprisingly informative.
Treat NXDOMAIN as signal, not just noise. It helps explain user errors, migration drift, negative caching behavior, and some of the clearest DNS clues you will get for DGA-style malware activity.
Related security terms
Domain Generation Algorithm (DGA)
DGA malware often produces bursts of NXDOMAIN responses while probing candidate domains.
DNS Resolver
Resolvers cache and return NXDOMAIN answers to clients.
DNS Spoofing (Cache Poisoning)
A compromised path can alter or forge DNS behavior, including misleading negative responses.
Domain Name System (DNS)
NXDOMAIN is one of the core response outcomes defined by DNS.
EDNS
Negative responses still travel through modern resolver behavior that may use EDNS signaling and sizing.
Frequently asked questions
What does NXDOMAIN mean in simple terms?
It means DNS could not find the domain name you asked for because that name does not exist.
Is NXDOMAIN always a problem?
No. It often happens for harmless reasons such as typos, expired links, or querying a host that was never created.
What is the difference between NXDOMAIN and no data?
NXDOMAIN means the name itself does not exist. A no-data answer means the name exists but not for the record type you asked for.
Why do defenders care about NXDOMAIN traffic?
Unusual NXDOMAIN patterns can reveal malware beaconing, broken software configurations, mistyped destinations, or reconnaissance.
What is negative caching?
Negative caching lets resolvers remember NXDOMAIN responses for a limited time so they do not repeat the same failed lookup over and over.
What is NXDOMAIN hijacking?
It is when a resolver, ISP, or malicious intermediary returns some substitute destination or ad page instead of a clean NXDOMAIN response.
Can NXDOMAIN responses be useful in threat hunting?
Yes. Repeated failed lookups to strange domains, especially from a single host, can be an early indicator of DGA-based malware or other suspicious behavior.
References
Explore authoritative guidance and frameworks related to nxdomain.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.