DNS_PROBE_FINISHED_BAD_CONFIG: what it means and how to fix it

Kofi Agyem, Founder and CEO, CloudzyroPublished November 1, 2026 · 5 min read

On this page

1. The short answer
2. What you'll see
3. What causes it
4. Fixes, quickest first
5. For site owners
6. A worked example
7. How to check
8. Sources

DNS_PROBE_FINISHED_BAD_CONFIG means the DNS server your device uses isn't working. How to fix it on Windows, Mac, Linux, Android and your router.

1. The short answer

DNS_PROBE_FINISHED_BAD_CONFIG means the DNS server your device uses isn't working. Chrome failed to look up a site, then tested your DNS settings with a name that certainly exists, and that failed as well. The site is probably fine; your device, router or VPN is pointing at a DNS server that's down, unreachable or misconfigured.

The fix is almost always one of three things: restart the router, switch to a public DNS resolver, or remove settings a VPN or other software left behind. For how DNS works, see What is DNS?.

2. What you'll see

Chrome and Edge: This site can't be reached, with a suggestion to check your DNS settings, and the code DNS_PROBE_FINISHED_BAD_CONFIG.
A close relative: DNS_PROBE_FINISHED_BAD_SECURE_CONFIG, when Chrome's Use secure DNS setting names a provider it can't reach.
Firefox: Hmm. We're having trouble finding that site, the same message it uses for any failed lookup.
Safari: Safari Can't Find the Server.

Chrome uses three probe results on this page. DNS_PROBE_FINISHED_NXDOMAIN means your DNS works and the site's name doesn't exist. DNS_PROBE_FINISHED_NO_INTERNET means you're offline. BAD_CONFIG sits in between: you're online, but DNS isn't working.

3. What causes it

Your router's DNS has stalled. Most home devices use the router as their DNS server, and routers' DNS forwarders can hang.
A wrong DNS address set by hand, such as a typo, an old company server or a resolver that's been shut down.
A VPN that left its settings behind, pointing DNS at a server only reachable while the VPN is up.
Security or filtering software that intercepts DNS and has crashed or expired.
A custom Secure DNS or Private DNS provider that can't be reached from your network.
Your internet provider's resolver is down for a while.
Malware or unwanted software that changed your DNS settings.

4. Fixes, quickest first

Restart your router and your device. This clears a stalled DNS forwarder more often than anything else.
Disconnect any VPN and try again. If it only works with the VPN off, update or reinstall the VPN app.
Check Chrome's secure DNS. Settings, Privacy and security, Security, Use secure DNS. If it names a custom provider, choose your current provider or switch it off to test.
Flush the DNS cache and renew your network address (commands below).
Set a public DNS resolver by hand: 1.1.1.1 and 1.0.0.1 (Cloudflare), 8.8.8.8 and 8.8.4.4 (Google) or 9.9.9.9 (Quad9). On Windows: Settings, Network and internet, your connection, DNS server assignment, Edit. On a Mac: System Settings, Network, your connection, Details, DNS.
Reset Windows networking: netsh winsock reset and netsh int ip reset in an administrator Command Prompt, then restart.
On Android, set Private DNS to Automatic, or to one.one.one.one or dns.google.
Check your router's DNS settings in its admin page. If they're addresses you don't recognize, set your provider's or a public resolver and change the router's admin password.
Scan for malware if your DNS settings keep changing back by themselves.

# Windows (administrator Command Prompt)
ipconfig /flushdns
ipconfig /release
ipconfig /renew

# macOS
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

# Linux with systemd-resolved: flush, then show which DNS servers are in use
resolvectl flush-caches
resolvectl status

5. For site owners

If a visitor reports DNS_PROBE_FINISHED_BAD_CONFIG, your site is very unlikely to be the cause. The error means their DNS failed for a name that should always work. Ask whether other sites load for them, and point them at the fixes above.

If many visitors report it at once from the same internet provider or company network, that network's resolvers are probably having trouble. There's nothing to change in your own DNS. If your own domain gives a different error, such as DNS_PROBE_FINISHED_NXDOMAIN for everyone, that one is yours to fix. For a site on Cloudzyro Sites & Apps, the site's Domains tab tells you whether your records are right.

6. A worked example

A visitor's laptop shows DNS_PROBE_FINISHED_BAD_CONFIG on every site that isn't already open, while their phone on the same Wi-Fi works fine.

ipconfig /all on the laptop shows its DNS server is 10.8.0.1, an address from a VPN that was uninstalled last week.
nslookup example.com times out; nslookup example.com 1.1.1.1 answers straight away. So the network is fine and the DNS setting is the problem.
They set the network adapter's DNS back to automatic, run ipconfig /flushdns, and every site loads again.

The phone worked because it took its DNS settings from the router, while the laptop still had the address the VPN left behind. Comparing two devices on the same network is often the quickest way to find this kind of fault.

7. How to check

Compare your configured DNS server with a public one. If the public one answers and yours doesn't, your settings are the problem.

# macOS and Linux: your default resolver, then a public one
dig example.com
dig example.com @1.1.1.1

# Windows: which DNS servers you're using
ipconfig /all
nslookup example.com
nslookup example.com 1.1.1.1

# Windows PowerShell
Get-DnsClientServerAddress
Resolve-DnsName example.com -Server 8.8.8.8

A timeout or connection timed out; no servers could be reached from your default resolver, with a normal answer from 1.1.1.1, confirms it: change the DNS server your device or router uses.

8. Sources

Questions

Does restarting my computer fix DNS_PROBE_FINISHED_BAD_CONFIG?

Sometimes, if the DNS service on your device had stalled. Restarting the router as well is more likely to help, because most home devices use the router for DNS. If neither works, set a public DNS resolver by hand.

What does DNS_PROBE_FINISHED_BAD_CONFIG mean?

Chrome couldn't load a site, tested your DNS by looking up a name that certainly exists, and that failed too. So the DNS server your device is set to use isn't answering properly. The site itself is probably fine.

Is it a problem with the website?

Almost never. BAD_CONFIG is about your device's or network's DNS settings. If other people can open the site, the fix is on your side.

What's the fastest fix?

Restart your router, then set your DNS to a public resolver such as 1.1.1.1 and 1.0.0.1 or 8.8.8.8 and 8.8.4.4, and flush your DNS cache.

Can a VPN cause DNS_PROBE_FINISHED_BAD_CONFIG?

Yes. VPNs replace your DNS settings while connected and sometimes leave them behind after disconnecting or crashing. Reconnect and disconnect the VPN cleanly, or reinstall it, and check your DNS settings afterwards.

What's the difference between BAD_CONFIG and NXDOMAIN?

With NXDOMAIN, your DNS works and says that one site's name doesn't exist. With BAD_CONFIG, your DNS isn't working at all, so every site that isn't already cached is likely to fail.

Could malware change my DNS settings?

It can. Some malware and unwanted software set DNS to their own servers. If your DNS settings keep changing back to addresses you don't recognize, run a malware scan and check your router's DNS settings too.