What is NXDOMAIN?

When DNS filtering blocks a domain, it can respond in two ways:

• NXDOMAIN response: The resolver returns "domain not found" — the simplest blocking method. The browser shows its default error page
• Redirect to block page: The resolver returns an IP address that points to a custom block page explaining why access was denied

CleanBrowsing supports both approaches. NXDOMAIN blocking is lightweight and fast, while block page redirects are more informative for users who need to understand why a site is blocked.

• NXDOMAIN: Silent blocking — users see a generic "site can't be reached" browser error. No additional infrastructure needed. Best for security-focused blocking where no explanation is required
• Block page: Informative blocking — users see a branded page explaining why the domain was blocked, potentially with a request-access option. Requires a web server to host the block page. Best for organizations that need accountability and user communication

Some ISPs controversially redirect NXDOMAIN responses to their own search pages — intercepting legitimate "domain not found" responses to serve ads. This practice (called NXDOMAIN hijacking) breaks expected DNS behavior and can interfere with applications that rely on accurate NXDOMAIN responses.

If you're getting unexpected NXDOMAIN responses:

• Check if the domain is blocked: The domain may be on your blocklist or in a filtered category — check your CleanBrowsing dashboard
• Verify the domain exists: Use command-line DNS tools to query a non-filtering resolver and confirm the domain is registered
• Clear DNS cache: Stale NXDOMAIN responses can be cached — clear your DNS cache and try again
• Check your spelling: Typos in domain names are a common cause of legitimate NXDOMAIN responses