SERVFAIL diagnosis: is DNSSEC the cause

servfail diagnosis

A resolver answers SERVFAIL for this name. Is a broken DNSSEC chain the cause, or did the authority not answer?

isitdns.net/#dig: the same question over DoT, Do53 over TCP and UDP, IPv6, or at any public resolver address.

read

GO NOERROR with ad: the resolver validated the answer (RFC 4035 section 3.2.3).
NO GO SERVFAIL with DO set and NOERROR with CD set at the same resolver, EDE 6 to 10: DNSSEC is the cause (RFC 8914 section 4.7 to 4.11; CD, RFC 4035 section 3.2.2) -> zone operator: the key or signature the EDE names; the chain walk shows the link.
NO GO SERVFAIL with CD set too, or EDE 22 or 23: the authority did not answer (RFC 8914 section 4.23, 4.24) -> zone operator: nameserver consistency, then delegation trace. A failure stays cached up to 5 minutes (RFC 9520 section 3.2), so a fix answers SERVFAIL until then.
NOT RUN NOERROR without ad: the zone is not signed, or the resolver does not validate; this read cannot tell which. DNSSEC chain check reads whether the chain is signed.

example

dnssec-failed.org A, DO set, read 2026-10-18T22:02:05Z:

  isitdns · dig · dnssec-failed.org A
  ;; asked 2026-10-18T22:02:05.894Z over DoH (dnssec on) from the Cloudflare edge, not your network

  ;; @cloudflare (cloudflare-dns.com) over DoH · 19 ms · 103 bytes · SERVFAIL · flags: qr rd ra
  ;; asked 2026-10-18T22:02:05.894Z from the Cloudflare edge (IAD), remote address unavailable from this vantage
  ;; SERVFAIL: resolver failed (https://isitdns.net/wiki/troubleshooting/servfail)
  ;; EDE 9 (DNSKEY Missing): no SEP matching the DS found for dnssec-failed.org.

  ;; the same question from your own machine: dig +https @cloudflare-dns.com dnssec-failed.org A +dnssec

  next: dnssec_chain dnssec-failed.org A
  browser: https://isitdns.net/dig?name=dnssec-failed.org&type=A&resolver=cloudflare

dnssec-failed.org A, the same resolver with CD set, read 2026-10-18T22:02:06Z:

  isitdns · dig · dnssec-failed.org A
  ;; asked 2026-10-18T22:02:06.258Z over DoH (dnssec on, cd) from the Cloudflare edge, not your network

  ;; @cloudflare (cloudflare-dns.com) over DoH · 51 ms · 232 bytes · NOERROR · flags: qr rd ra cd
  ;; asked 2026-10-18T22:02:06.258Z from the Cloudflare edge (IAD), remote address unavailable from this vantage
  ;; ANSWER (2)
  dnssec-failed.org.               300  IN  A      96.99.227.255
  dnssec-failed.org.               300  IN  RRSIG  A 13 2 300 20261022015706 20261014225206 32784 dnssec-failed.org. MbVsfYRE7lIpzMnzhOrfcRnAxSfSOOnuxKdoXYst4lwycwSGkIsVbovAD9M1pez18hcmM8kBDFi7SOfwnllkEw==  ; key tag 32784, inside its window, expires 3 d after this read (the signature itself is not checked here)
  ;; EDE 9 (DNSKEY Missing): no SEP matching the DS found for dnssec-failed.org.

  ;; the same question from your own machine: dig +https @cloudflare-dns.com dnssec-failed.org A +dnssec +cdflag

  browser: https://isitdns.net/dig?name=dnssec-failed.org&type=A&resolver=cloudflare

from your own machine

dig +https @cloudflare-dns.com dnssec-failed.org A +dnssec

dig +https @cloudflare-dns.com dnssec-failed.org A +dnssec +cdflag

Two questions, the same resolver: the second asks it not to validate. Both on this page: DO set · CD set.

the manual

What does SERVFAIL mean, and who is failing
Check DNSSEC validation with dig: +cd, the EDE, then delv
Extended DNS Errors: every code
RFC 8914: Extended DNS Errors · RFC 4035 section 3.2.2: the CD bit · RFC 9520 section 3.2: resolution failures are cached

other jobs