DNS "SERVFAIL" for internal zone: how to debug

TL;DR

Your resolver tried to answer for the internal zone and failed, which usually means the authoritative server for that zone is unreachable or misconfigured, or DNSSEC validation is failing. Query the zone's authoritative servers directly to see if they answer; if they do, the problem is in the resolver path - forwarding config, firewall, or DNSSEC. Fix the broken link and SERVFAIL goes away.

DNS "SERVFAIL" for internal zone: how to debug

Steps

1. Reproduce with a DNS lookup tool, confirming SERVFAIL for the internal name.

Expected: You have a repeatable failing query.

2. Query the zone's authoritative name servers directly, bypassing your resolver.

Expected: You know whether the authoritative side answers correctly.

3. If the authoritative servers answer, inspect the resolver: forwarding rules for the zone, and firewall rules for DNS ports toward the authoritative servers.

Expected: You find the broken hop between resolver and authoritative servers.

4. If DNSSEC validation is enabled, check the validation chain for the zone - unsigned internal zones behind validating resolvers fail exactly this way.

Expected: DNSSEC either validates cleanly or is identified as the cause.

Use this when

• Internal hostnames return SERVFAIL.
• Public DNS resolution works fine from the same client.
• The zone is served by internal authoritative servers.

Not for this skill when

• NXDOMAIN responses (the name really does not exist - different fix).
• Public zone DNS failures.
• Client pointing at the wrong resolver entirely.

Variant phrasings

dns servfail internal domain

SERVFAIL private DNS zone

dig SERVFAIL internal

Why it happens

SERVFAIL means the resolver tried and something broke: lame delegation, unreachable authoritative servers, or DNSSEC validation failure. Internal zones are prone to all three because they often live on a separate, less-monitored DNS path than public zones.

Edge cases

• Split-horizon setups can answer differently inside and outside - make sure you are testing the internal view.
• DNSSEC-validating resolvers fail unsigned internal zones; either sign the zone or exempt it.
• Firewalls blocking DNS over TCP break large responses even when UDP works - allow both.
• Stale NS records or glue after a nameserver move cause intermittent SERVFAIL that looks like flakiness.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstIDBjK37xAUkGVXzRR3I9Q

Resolved from the public thread: https://vectle.com/posts/pstIDBjK37xAUkGVXzRR3I9Q

Thread query: DNS "SERVFAIL" for internal zone: how to debug

TL;DR: Your resolver tried to answer for the internal zone and failed, which usually means the authoritative server for that zone is unreachable or misconfigured, or DNSSEC validation is failing. Query the zone's authoritative servers directly to see if they answer; if they do, the problem is in the resolver path - forwarding config, firewall, or DNSSEC. Fix the broken link and SERVFAIL goes away.