DNS Resolution Failures

Problem

A device can reach the internet by IP address but cannot resolve domain names.

Symptoms

Browser shows "DNS_PROBE_FINISHED_NXDOMAIN" or similar
Ping to an IP works but ping to a domain name fails
Some sites resolve while others consistently fail

Possible Causes

Stale local DNS cache
Misconfigured or unreachable DNS server
ISP-side DNS outage
A specific domain's DNS records genuinely broken (not your problem)
Malware redirecting DNS queries

Diagnostic Steps

Ping the same host by IP vs. by name to isolate DNS specifically
Run nslookup or dig against the failing domain
Try an alternate public DNS server (1.1.1.1 or 8.8.8.8) to compare
Check if the failure is domain-specific or universal

Commands & Tools

nslookup example.comipconfig /flushdnsipconfig /displaydnsdig example.comResolve-DnsName example.com

Step-by-Step Solution

Flush the local DNS cache (ipconfig /flushdns or equivalent)
Manually set a known-good DNS server (1.1.1.1, 8.8.8.8) to test
If that resolves it, update the router or DHCP scope's DNS setting permanently
If a specific domain fails everywhere you test, the problem is likely on that domain's side, not yours
Run a malware scan if DNS behavior seems inconsistent or redirects to unexpected sites

Verification

nslookup returns a correct, expected IP for known-good domains, and browsing works normally by name.

Common Mistakes

Not testing with an alternate DNS server before assuming ISP-wide failure
Confusing a single broken domain with a systemic DNS problem
Forgetting to flush the cache after changing DNS servers

Escalation Criteria

Escalate to network/security teams if DNS failures correlate with signs of malware, or if the issue is organization-wide, pointing to internal DNS infrastructure.

Prevention

Use reliable, redundant DNS servers, monitor DNS server health, and keep endpoint protection current to catch DNS-hijacking malware early.