DNS_PROBE_FINISHED_BAD_CONFIG

What this error means & how to recognize it

• Chrome or Edge shows “This site can’t be reached” with DNS_PROBE_FINISHED_BAD_CONFIG.
• Several websites fail to load on the same device or network.
• The error begins after changing DNS settings, connecting to a VPN, configuring a proxy, or changing network drivers.
• One particular domain fails while other websites continue to work.
• The same domain remains unreachable from unrelated devices and networks when its nameserver delegation is the underlying problem.

Root causes, ordered by likelihood

1. Incorrect or unreachable custom DNS settings — a DNS address entered on the device or router may be mistyped, unavailable, or unsuitable for the current network.
2. VPN or proxy DNS settings — VPN and proxy software can redirect DNS requests to a server that is unavailable or incorrectly configured.
3. Network adapter or local configuration problems — changes to the operating system, drivers, or network settings can leave DNS resolution unusable.
4. Stale local DNS cache — cached information can continue affecting lookups after a network setting changes.
5. Broken DNS delegation for one domain — the domain’s NS records may point to nameservers that do not respond correctly. This differs from NXDOMAIN, where the nameservers respond but report that the requested name does not exist.

How to fix it

1. Determine whether the problem is local or domain-specific

On the affected device and network, open a different well-known website.

• Several websites fail: investigate the device, network, router, VPN, or proxy.
• Only one domain fails: test that domain from another device or unrelated network before changing working DNS settings.

This comparison is the fastest way to avoid treating a domain-side problem as a computer problem.

2. Restore DNS to automatic assignment

A manually entered DNS address is a common cause of this error. Before changing settings, record any intentional custom DNS configuration and make sure you have permission to modify the device or router.

• Windows: Open the active network connection’s DNS settings and set DNS server assignment to Automatic (DHCP), unless you intentionally use a known-working custom DNS service.
• macOS: Open System Settings → Network, select the active connection, open its DNS settings, and remove incorrect or unreachable custom DNS entries.
• Router: If DNS is configured centrally on the router, inspect its DNS settings instead of changing every device individually.

Reconnect to the network and test the affected site. If the error affects multiple users, coordinate changes with the network administrator.

3. Flush the local DNS cache

After correcting DNS settings, clear cached DNS information so the device performs a fresh lookup. These commands affect local DNS cache state; use an administrator-authorized terminal where required.

• Windows: Open Command Prompt and run:

`text

ipconfig /flushdns

`

• macOS: Open Terminal and run:

`text

sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

`

Close and reopen the browser, then test again. Flushing the cache will not fix an incorrect DNS server address or broken domain delegation by itself.

4. Test without the VPN or proxy

Disconnect from the VPN temporarily and retry the site. If a manually configured proxy is in use, disable it for the test only if you are authorized to change that setting.

• Works without the VPN: the VPN is likely supplying or enforcing the failing DNS configuration. Review its DNS or split-tunneling settings, or contact the VPN administrator.
• Still fails without the VPN: continue checking the device, router, and domain scope rather than changing unrelated network settings.

5. Isolate the affected device from the network

Reconnect Wi-Fi or Ethernet and test again. If multiple devices cannot resolve websites, an authorized network administrator can restart the router or other network equipment during an appropriate maintenance window. A restart interrupts connectivity and should not be used as the first step when only one device is affected.

• Only one device fails: focus on that device’s DNS, adapter, VPN, proxy, and cache.
• Several devices fail: investigate the router, DHCP-provided DNS, ISP connection, or network-wide filtering.

6. Test one failing domain from another network

If other websites load but one domain does not, test it using a mobile connection or another unrelated network.

• Works elsewhere: investigate the original network’s DNS settings, filtering, router configuration, or VPN.
• Fails everywhere: the domain’s nameserver delegation or authoritative DNS service may be the problem.

7. Check the domain’s nameserver delegation

For a domain that fails consistently across multiple unrelated networks, the domain owner or administrator should verify that the registrar’s NS records point to the intended nameservers and that those nameservers respond correctly. This is a domain-side issue that an individual visitor normally cannot repair through browser or device settings.

Prevention & how to verify the fix

• Avoid manually entering DNS addresses unless there is a specific reason; use automatic assignment or a known-working DNS service.
• Review DNS settings after installing, removing, or reconfiguring VPN and proxy software.
• Flush the local DNS cache after correcting a DNS configuration problem or making significant network changes.
• Keep a record of intentional custom DNS settings before resetting a device or router to automatic assignment.
• If you manage a domain, verify that delegated nameservers respond correctly rather than relying only on a registrar status showing that they are active.

Frequently asked questions