NXDOMAIN, SERVFAIL, or Silence

Back in Unit 2 you learned the most valuable fork on call: refused (an RST came back — an answer) rules out the network path, while timeout (silence — no answer) rules out nothing but "actively refused." DNS has the exact same fork. A failed lookup is one of three things, and — just like the alphabet — an answer rules things out, while silence does not.

The three ways a lookup fails

dig no-such-name.example.com     # a name nobody owns

;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 42
;; ANSWER: 0

Read the status line — that one word is the whole diagnosis:

NXDOMAIN

An answer: "that name does not exist." An authoritative server was reached and said no. This rules out a broken resolver and a network problem — the DNS system worked; the name is simply wrong (typo, wrong domain, or not created yet).

SERVFAIL

An answer: "I tried and couldn't finish." The resolver reached you but failed upstream — a broken authoritative server, a DNSSEC validation failure, or a dead forwarder. This rules out "the name doesn't exist"; the problem is in the resolution machinery.

Silence / timeout

No answer at all — dig sits, then prints no servers could be reached. The resolver itself is unreachable: wrong resolver IP, firewall on port 53, dead resolver. Rules out nothing about the name.

Map it onto the alphabet you already know

The shape is identical to Unit 2 — which is the point:

Drill this in the app once /author-bank has built Unit 3 — status → what it means → what it rules out is exactly what the Bank grades, and it's the same skill you just practiced on connections.