Is DNS_PROBE_FINISHED_BAD_CONFIG the same as NXDOMAIN?

No. DNS_PROBE_FINISHED_NXDOMAIN means the name doesn't exist — the resolver got an authoritative 'no such domain.' BAD_CONFIG means Chrome couldn't complete the lookup at all because something on your side — cache, resolver, or network config — is broken. One is about the domain; the other is about your machine.

The site loads on my phone but not my laptop. Whose problem is it?

Yours, locally. If the domain resolves from another device or network, the records are fine. That points the fix squarely at the failing machine: flush its DNS cache, switch it to a public resolver, or check what DNS its router handed it over DHCP.

What about DNS_PROBE_FINISHED_BAD_SECURE_CONFIG?

Same family, but tied to Secure DNS (DNS-over-HTTPS). It usually means Chrome's 'Use secure DNS' provider is unreachable or misconfigured. Toggle it off under chrome://settings/security, or switch to a known DoH provider, and retest.

Views: 98

DNS_PROBE_FINISHED_BAD_CONFIG Fix

DNS_PROBE_FINISHED_BAD_CONFIG in Chrome? Confirm the domain resolves publicly, then fix the local resolver, cache, or router. Free instant check, no sign-up.

Check your domain for this issue now

Free, no sign-up. Runs the exact check this guide describes and shows what to fix.

Problem

Chrome shows DNS_PROBE_FINISHED_BAD_CONFIG and the page won’t load. The browser ran its DNS probe, and the probe finished with a configuration it couldn’t use.

Symptoms

Chrome (and other Chromium browsers) fail with this exact string on every site, or a specific one.
Other devices on the same network may load the site fine.
It often appears right after a Windows update, a router change, a new VPN, or an antivirus install.

The One Check That Splits This in Two

DNS_PROBE_FINISHED_BAD_CONFIG is almost always a local fault, but “almost always” isn’t a diagnosis. Before you flush anything, answer one question: does the domain actually resolve from the outside?

Run the name through a resolver that isn’t yours. If public resolvers return clean records, the domain is healthy and every fix is on your machine — cache, resolver settings, or router. If the name also fails to resolve publicly, you’re not looking at BAD_CONFIG at all; you’re looking at a real DNS or domain problem (missing records, expired domain, broken nameservers), and clearing your local cache will do nothing.

That split matters because the internet is full of advice telling you to flush your DNS cache when the actual problem is a domain whose nameservers are down. Confirm which side is broken before you spend an hour on the wrong one.

Top 3 Causes (once you’ve confirmed the domain resolves publicly)

A stale or corrupt local DNS cache - Your OS or Chrome cached a bad or half-written record. This is why the same URL works elsewhere but not here, and why flushing fixes it instantly.
A misconfigured resolver, often handed out by the router - The machine is pointed at a DNS server that’s unreachable, wrong, or was set by a VPN/antivirus that has since stopped running. DHCP from a misconfigured router does this to every device it touches.
Network software sitting in the path - A VPN client, firewall, antivirus web-shield, or ad-blocking extension intercepts DNS and answers badly. Chrome sees an unusable config and gives up.

Diagnose with DechoNet

DNS Lookup to confirm the domain resolves to real records from public resolvers — if it does, the problem is entirely on your side.
DNS Propagation to see the answer across several independent resolvers at once, so you can tell a genuinely broken domain from a purely local cache fault.

Resolution Checklist

Confirm the domain resolves publicly (DNS Lookup). If it doesn’t, stop — this is a domain/nameserver issue, not BAD_CONFIG.
Flush the OS DNS cache (ipconfig /flushdns on Windows; sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder on macOS).
Clear Chrome’s own host cache at chrome://net-internals/#dns → “Clear host cache,” then close all sockets under #sockets.
Point the machine at a public resolver (1.1.1.1 or 8.8.8.8) instead of whatever the router handed it.
Reboot the router if every device on the network is affected — the bad config is being distributed over DHCP.
Temporarily disable VPN, antivirus web-shield, and DNS-touching extensions one at a time to find the interceptor.

When to Escalate

If the domain fails to resolve publicly, escalate to whoever runs the domain’s DNS — the fix is on the authoritative side, not your browser.
If every machine on a managed network hits this after a config change, take it to whoever controls the router/DHCP DNS settings; individual cache flushes won’t hold.