Skip to content
RU

ERR_DNS_MALFORMED_RESPONSE

Key idea:

ERR_DNS_MALFORMED_RESPONSE — Chrome DNS resolver received a response that does not conform to DNS wire format. Causes: upstream resolver bug (rare), DNSSEC validation failure, DoH (DNS-over-HTTPS) endpoint serving HTML error page instead of DNS response, DNS poisoning attempts. Fix: change DNS provider or disable DoH.

Below: causes, fixes, FAQ.

Check your domain's DNS →

Common Causes

  • DoH endpoint (1.1.1.1/dns-query) returning 503 HTML instead of DNS
  • DNSSEC validation failure — upstream stripped DS/RRSIG records
  • Cached response with DNSSEC mismatch
  • DNS poisoning attempt (rare)
  • Browser-level resolver bug (specific Chrome version)

Step-by-Step Fix

  1. chrome://settings/security → disable "Use secure DNS"
  2. Try other DoH provider: Google 8.8.8.8/dns-query, Quad9 9.9.9.9
  3. Flush DNS: chrome://net-internals/#dns → Clear host cache
  4. Windows: ipconfig /flushdns; macOS: dscacheutil -flushcache
  5. Check domain DNSSEC: Enterno DNS checker

Check DNS records →

Related SSL Errors

TL;DR: Fixing ERR_DNS_MALFORMED_RESPONSE

The ERR_DNS_MALFORMED_RESPONSE error occurs when a browser receives an invalid DNS reply, often due to misconfigured DNS settings or server responses. To resolve this issue, check your DNS configuration, clear your browser cache, and use tools like nslookup or dig to troubleshoot DNS queries. Ensure your DNS servers are responsive and correctly configured.

Understanding ERR_DNS_MALFORMED_RESPONSE

The ERR_DNS_MALFORMED_RESPONSE error indicates that the DNS response received by the browser is malformed or not compliant with DNS standards. This can occur for several reasons, including:

  • Misconfigured DNS records.
  • Issues with the DNS server responding incorrectly.
  • Corrupted browser cache or DNS cache.

When a browser sends a DNS request, it expects a well-formed response that adheres to the Domain Name System (DNS) protocols. If the response deviates from expected formats, the browser will trigger this error.

Common symptoms include the inability to access websites, loading delays, and inconsistent connectivity. Depending on the browser and operating system, users may encounter different error messages, but the underlying issue remains the same.

To diagnose the problem, you may consider the following:

  1. Check if the DNS server is reachable using ping or traceroute.
  2. Utilize nslookup or dig commands to examine the DNS records returned for your domain.
  3. Look for discrepancies in the DNS records, such as incorrect IP addresses or missing records.

Practical Steps to Resolve the Issue

To effectively resolve the ERR_DNS_MALFORMED_RESPONSE error, follow these practical steps:

1. Check DNS Configuration

Start by verifying your DNS configuration. If you manage your own DNS server, ensure that it is correctly set up. Use the following command to check your DNS records:

dig example.com ANY

Replace example.com with your domain. Look for any malformed records. You should see a response with properly formatted records.

2. Clear Browser and DNS Cache

Cached data may lead to persistent errors. Clear your browser cache and DNS cache:

  • For Windows, open Command Prompt and run:
ipconfig /flushdns
  • For macOS, use:
sudo killall -HUP mDNSResponder

3. Change DNS Servers

If the problem persists, consider changing your DNS servers. Public DNS servers like Google DNS (8.8.8.8 and 8.8.4.4) or Cloudflare DNS (1.1.1.1) can often resolve these issues more effectively than ISP-provided DNS servers. To change DNS settings:

  1. Open your network settings.
  2. Select your network connection.
  3. Access the properties and find the DNS settings.
  4. Input the new DNS server addresses.

4. Contact Your DNS Provider

If all else fails, reach out to your DNS hosting provider. They can provide insights and support for any underlying issues with their infrastructure.

By following these steps, you can systematically address the ERR_DNS_MALFORMED_RESPONSE error and restore normal browsing functionality.

A / AAAAIPv4 and IPv6 host addresses
MX RecordsDomain mail servers
TXT / SPFVerification & anti-spoofing
NS / SOAName servers & zone authority

Why teams trust us

12
DNS record types
SPF+DKIM
email protection
<1s
DNS response
3
check regions

How it works

1

Enter domain

2

Select record type

3

Get DNS response

What are DNS Records?

DNS (Domain Name System) translates domain names into IP addresses. DNS records are instructions that define where to route traffic, email, and how to verify domainownership.

Complete Lookup

Query all record types — A, AAAA, MX, NS, TXT, CNAME, SOA — in a single request.

Instant Results

Direct queries to authoritative servers. Results in milliseconds, no caching.

Security Checks

SPF, DKIM, and DMARC analysis to evaluate email protection against spoofing and phishing.

Export & History

Save check results. Compare DNS records before and after registrar changes.

Who uses this

DevOps

DNS check after deploy

Email marketers

SPF/DKIM/DMARC audit

SEO

DNS config audit

Sysadmins

DNS zone control

Common Mistakes

Missing SPF recordWithout SPF, emails may land in spam. Add a v=spf1 TXT record.
Single NS serverIf the only NS fails, the domain becomes unreachable. Use at least 2 NS servers.
CNAME conflicting with other recordsCNAME cannot coexist with MX or TXT on the same name — this violates RFC.
TTL set too highWith 86400s TTL, DNS changes take a full day. Lower TTL to 300 before migrations.
Missing PTR recordMail servers check PTR. Without it, emails may be rejected.

Best Practices

Set up SPF + DKIM + DMARCThe trio of records that protects your email from spoofing and improves deliverability.
Use 2+ NS serversDistribute NS servers across different networks for redundancy.
Lower TTL before migrationSet TTL to 300 at least 24-48 hours before an IP change for fast propagation.
Verify DNS after changesAfter updating records, confirm changes propagated correctly and no errors remain.
Add a CAA recordCAA restricts which Certificate Authorities can issue SSL certificates for your domain.

Get more with a free account

DNS check history, API keys and DNS change monitoring.

Sign up free

Learn more

Frequently Asked Questions

DoH vs Do53?

DoH (DNS-over-HTTPS): queries over HTTP/2 to resolver. Do53: classic UDP 53. DoH encrypted, private; but middleboxes may interfere.

DNSSEC debug?

dig +dnssec domain. If AD flag set = validated. Otherwise — chain broken somewhere.

Chrome Secure DNS list?

Settings → Security → advanced. Providers: automatic, Cloudflare, Google, Quad9, NextDNS, CleanBrowsing.

Monitor DNS?

Enterno DNS checks records + DNSSEC validation chain. Scheduled monitors alert on DNS changes.

Try the live tool that powered this guide

Free plan — 10 monitors, checks every 5 min, no card required. Upgrade for 1-minute interval and multi-region monitoring.