DNS_PROBE_FINISHED_BAD_CONFIG: what it is and how to fix it

What DNS_PROBE_FINISHED_BAD_CONFIG means

When a page fails because Chrome cannot resolve its hostname, Chrome runs a short DNS probe to guess why. The probe asks for the A record of google.com twice: once through the DNS servers your device is configured to use, and once through Google Public DNS (8.8.8.8 and 8.8.4.4). Each lookup gets one attempt and skips Chrome's cache, and Chrome keeps the result for about five seconds. Chrome then names the error after the combination it got:

• Your configured DNS answered: the label is DNS_PROBE_FINISHED_NXDOMAIN. Chrome assumes the name you typed does not exist.
• Your configured DNS failed, but Google Public DNS answered: the label is DNS_PROBE_FINISHED_BAD_CONFIG. Chromium's source comment says Chrome then assumes the DNS config is bad, "or perhaps the DNS servers are down or broken".
• Your configured DNS failed and Google Public DNS was unreachable: the label is DNS_PROBE_FINISHED_NO_INTERNET.
• Your DNS failed and Google Public DNS answered with errors or wrong results: Chrome treats the result as inconclusive. The source suggests a captive portal, a firewall that rewrites DNS traffic, or a failing public server.

Two details matter for troubleshooting. First, the probe tests google.com, not the site you wanted, so the label says nothing about that site. If you see the error on every site, the same cause applies to all of them. Second, the probe sends its own DNS queries with Chrome's built-in DNS client and does not ask the operating system's resolver. A DNS problem can therefore show up in Chrome while other programs seem fine.

If Chrome's secure DNS setting names a specific provider, the label changes to DNS_PROBE_FINISHED_BAD_SECURE_CONFIG, and the provider is the first suspect. On platforms where Chrome cannot read the system's DNS settings (the source comment gives Android as the example), Chrome reports NXDOMAIN whenever Google Public DNS answers. You are therefore more likely to see this label on a computer than on a phone.

How the error appears

Chrome shows a "This site can't be reached" page that says the site's server IP address (older versions: DNS address) could not be found, with the code DNS_PROBE_FINISHED_BAD_CONFIG below it. On Windows the page also suggests running Windows Network Diagnostics. The suggestions in Chromium's code for this error are to check the DNS configuration, the firewall and the proxy settings. Edge shows the same code, because it is built on Chromium. Firefox words the failure differently.

The command line shows the same split between the two kinds of DNS server. This is typical output on Windows when the configured server does not answer:

nslookup google.com
DNS request timed out.
    timeout was 2 seconds.
Server:  UnKnown
Address:  192.168.1.1

DNS request timed out.
    timeout was 2 seconds.
*** Request to UnKnown timed-out

Running nslookup google.com 8.8.8.8 in the same window then returns an address for google.com from the server named dns.google. That pair of results is what Chrome's probe sees.

DNS_PROBE_FINISHED_BAD_CONFIG vs similar errors

Chrome picks the label after the probe, so the neighbors differ in which of the two lookups worked. The last row is a Windows message, not a Chrome one.

Error	What happened at the network or protocol level	Where to look first
DNS_PROBE_FINISHED_BAD_CONFIG	Your configured DNS servers failed the probe, and Google Public DNS passed it.	DNS server settings on the device, the router, the VPN and security software.
DNS_PROBE_FINISHED_BAD_SECURE_CONFIG	The same result, with Chrome's secure DNS set to a named provider.	Use secure DNS at chrome://settings/security.
DNS_PROBE_FINISHED_NXDOMAIN	Your DNS works for google.com, so Chrome assumes the requested name does not exist.	The spelling, then the domain's registration and records.
DNS_PROBE_FINISHED_NO_INTERNET	Your DNS failed and Google Public DNS could not be reached either.	The connection itself: Wi-Fi, cable, router, ISP.
ERR_NAME_NOT_RESOLVED	The lookup failed and no probe result narrowed it down.	Compare your resolver's answer with a public resolver's.
"DNS server not responding"	Windows Network Diagnostics reports that a name query got no reply from the DNS server.	The DNS server address on the adapter and the router.

What causes DNS_PROBE_FINISHED_BAD_CONFIG

• A wrong DNS server on the adapter. A fixed address from an old network or a typo means every lookup goes to a server that does not exist or does not answer.
• A stuck DNS forwarder in the router. Many home routers forward DNS queries to the ISP. The forwarder can hang while the rest of the network works.
• Failing ISP DNS servers. The servers are reachable but slow, overloaded or broken.
• A VPN that left its DNS settings behind. After a disconnect or a crash, the adapter can keep private DNS addresses that are only reachable inside the tunnel.
• An unreachable IPv6 DNS server. A network can announce an IPv6 DNS server that your device cannot reach.
• Security software that filters DNS. A firewall, antivirus or parental control tool can block or rewrite DNS traffic to the configured server. Chrome lists the firewall among its suggestions for this error.
• Damaged network settings on Windows. After removing a VPN client or a security product, the Winsock catalog or the TCP/IP settings can be left in a broken state.
• A failing secure DNS provider. This produces the BAD_SECURE_CONFIG variant.

How to fix DNS_PROBE_FINISHED_BAD_CONFIG

Find out which DNS server fails

List the servers your adapter uses, then ask them and a public server the same question. On Windows, in Command Prompt:

ipconfig /all | findstr /C:"DNS Servers"
nslookup google.com
nslookup google.com 8.8.8.8

In PowerShell the same test is Resolve-DnsName google.com against Resolve-DnsName google.com -Server 8.8.8.8. On macOS and Linux use dig google.com, which prints the server it asked on the SERVER line, and dig @8.8.8.8 google.com +short.

If the first lookup fails and the second works, you have confirmed the problem: the configured DNS server is the broken part. A message such as "Server failed" or "Query refused" means the server is reachable but cannot or will not answer. A timeout means nothing answered at all.

Quick checks that work on every system

1. Restart the router. Unplug it for 30 seconds, plug it in again and wait until it is online. This clears a stuck DNS forwarder.
2. Try another network. Use mobile data or a phone hotspot. If the site loads there, the DNS of your first network (router or ISP) is the cause.
3. Disconnect your VPN. Reload the page. If it works now, the VPN left DNS settings behind or filters DNS.
4. Pause security software. Turn off the web protection or firewall of your antivirus for one test and reload. Turn it on again afterwards, and add an exception for Chrome if this was the cause.

Windows

1. Open Command Prompt as administrator, then clear the resolver cache and renew the network lease:

   ipconfig /flushdns
   ipconfig /release
   ipconfig /renew

   Microsoft documents all three options for ipconfig. The guide on how to flush the DNS cache explains what each one clears.
2. Set a working DNS server. Press Win+R, run ncpa.cpl, open the properties of your Wi-Fi or Ethernet adapter, select Internet Protocol Version 4 (TCP/IPv4), choose Properties and enter the DNS addresses by hand. Or use the command line, with the adapter name from netsh interface show interface:

   netsh interface ipv4 set dnsservers name="Wi-Fi" static 8.8.8.8 primary
   netsh interface ipv4 add dnsservers name="Wi-Fi" address=1.1.1.1 index=2

   To go back to the addresses your router hands out, run netsh interface ipv4 set dnsservers name="Wi-Fi" source=dhcp.
3. If DNS still fails, reset the network stack and restart the computer:

   netsh winsock reset
   netsh int ip reset

   Microsoft describes netsh winsock reset as resetting the Winsock catalog to a clean state to resolve problems caused by corrupted Winsock settings.
4. Check the proxy: Settings, Network & internet, Proxy. Turn off "Use a proxy server" unless your network requires it.
5. As a last step, use Settings, Network & internet, Advanced network settings, Network reset. It removes and reinstalls your network adapters, so you may have to reconnect to Wi-Fi networks and reinstall VPN software.

Chrome

1. Open chrome://settings/security and look at "Use secure DNS". If a named provider is selected, switch to "With your current service provider" or turn the setting off for a test.
2. Clear Chrome's own host cache at chrome://net-internals/#dns and press Clear host cache.
3. Open the page in a private window to test without extensions. A VPN or proxy extension can change how Chrome looks up names.
4. Compare with another browser. If Edge or Firefox load the page but Chrome does not, look at Chrome-specific settings: secure DNS, extensions, and any firewall rule that treats Chrome differently from other programs.

macOS, Linux and ChromeOS

• macOS: list the servers in use with scutil --dns | grep nameserver and show the configured ones with networksetup -getdnsservers Wi-Fi. Set public servers with sudo networksetup -setdnsservers Wi-Fi 8.8.8.8 1.1.1.1. To undo it, run sudo networksetup -setdnsservers Wi-Fi Empty. Flush the cache with sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder.
• Linux with systemd-resolved: resolvectl status shows the DNS server for each interface, resolvectl query google.com tests it and sudo resolvectl flush-caches clears the cache. With NetworkManager, set the servers on the connection itself:

  nmcli con mod "Wired connection 1" ipv4.dns "8.8.8.8 1.1.1.1"
  nmcli con mod "Wired connection 1" ipv4.ignore-auto-dns yes
  nmcli con up "Wired connection 1"

• ChromeOS: select the time at the bottom right, select the network, open Network and set the name servers to Google name servers or to custom ones.

Router and ISP

Open the router's admin page (the address is often 192.168.0.1 or 192.168.1.1, and it is printed on the router's label). Look for the DNS servers in the Internet or WAN settings. If they point at an old internal address, set them to automatic or enter a public pair. If the problem appears only on your home network, and a public DNS server fixes it, your ISP's resolvers are the likely cause. You can keep the public servers until the ISP confirms a repair.

If you run the website

You cannot fix this error from your server. The probe never asked about your domain. What you can do is confirm that your domain resolves for everyone else, then help the affected visitor:

dig +short example.com @8.8.8.8
dig +short example.com @1.1.1.1
dig NS example.com +short

If these return your addresses and nameservers, send the visitor a short note: try mobile data or another network, restart the router, and set the DNS servers of the device to 8.8.8.8 and 1.1.1.1. Keep a note of the country and the ISP of each report, because several reports from one ISP may point to a failure in its resolvers.

How it looks from the outside

A check from outside uses its own DNS lookup, not your visitor's. That makes it a good test for this error, because the label only says that the visitor's resolver is failing. The patterns:

• The name resolves and the site loads from every location. The problem is on the visitor's side: their device, router, VPN or ISP resolver.
• Reports come from one country or ISP, and the other locations are fine. That ISP's resolvers are probably failing. Nothing is broken on your side.
• The name fails to resolve from every location. This is a domain problem, and it is a different error for visitors. Their own DNS still works for google.com, so Chrome shows DNS_PROBE_FINISHED_NXDOMAIN or ERR_NAME_NOT_RESOLVED.

The DNS query check resolves a name from many locations and shows what each one returned. The guide on DNS propagation explains why answers differ between places after a change. HostTracker runs checks from 300+ checkpoints in 158 cities, so a site that is up for every location while a visitor reports this error suggests a problem in that visitor's resolver.

Frequently asked questions

Is DNS_PROBE_FINISHED_BAD_CONFIG a problem with the website?

No. Chrome's test used google.com, not the site you opened. The error says that your configured DNS servers failed a test that Google Public DNS passed. The same website may open normally for other people and on other networks.

Why does Chrome fail when other programs work?

Chrome's probe sends DNS queries with its own DNS client and does not use the operating system's resolver. Chrome also has settings of its own, such as secure DNS and extensions. If nslookup works but Chrome fails, check secure DNS, extensions, the proxy and firewall rules for Chrome.

How is it different from DNS_PROBE_FINISHED_NXDOMAIN?

With NXDOMAIN, your DNS servers work for google.com, so Chrome blames the name. With BAD_CONFIG, your DNS servers fail the test, so Chrome blames the configuration. The guide on DNS_PROBE_FINISHED_NXDOMAIN covers the first case.

Will flushing the DNS cache fix it?

Only sometimes. A flush removes old answers from a cache. This error is about the servers your device asks, so a bad or unreachable server stays bad after a flush. Combine the flush with a router restart or a change of DNS server.

Is it safe to switch to 8.8.8.8 or 1.1.1.1?

Both are public resolvers run by large companies, and you can undo the change at any time. The resolver operator sees the host names you look up, so choose one you trust and read its privacy policy.

Why did it start after I used a VPN?

A VPN client can replace the DNS servers of your adapter while it is connected. If the client closes badly, the adapter may keep addresses that only work inside the tunnel. Reconnect and disconnect cleanly, or set the DNS servers again by hand.

Can I see this error on a phone?

It is less likely. On Android, Chrome may be unable to read the phone's DNS settings, and in that case a comment in Chromium's source says it reports NXDOMAIN instead. If a DNS error appears on a phone, check Private DNS and any VPN or ad-blocking app.

How long should I wait before trying again?

Chrome keeps a probe result for about five seconds, so a reload after a change retests at once. If you restarted the router, wait until it is online first.

Sources and further reading

• Chromium source: DNS probe service: the rules that pick between the DNS_PROBE_FINISHED labels.
• Chromium source: DNS probe runner: the lookup of google.com that the probe performs.
• Microsoft Learn: ipconfig: the /flushdns, /release and /renew options.
• Microsoft Learn: netsh winsock: what winsock reset does.