Where you saw it: A verifier reporting a DNS error rather than an invalid domain, a mail log showing a temporary failure on name resolution, or a lookup tool timing out.
Why it happens
- The domain's authoritative nameservers are unreachable or refusing queries, which makes every record on the domain invisible.
- The zone is misconfigured at the registrar and delegation is broken, so no server will answer authoritatively.
- DNSSEC validation is failing because a signature expired or a key rotation went wrong, and validating resolvers refuse the answer entirely.
- The domain expired. Registrars remove delegation before the name becomes available, and every lookup fails during that window.
- The resolver doing the query is having its own problem, which has nothing to do with the domain.
The fix, in order
Query a different resolver
Run dig MX yourdomain.com @8.8.8.8 and then @1.1.1.1. If one works and another does not, the problem is resolver-side or DNSSEC-related rather than a missing record.
Check delegation from the top
Run dig NS yourdomain.com and confirm the nameservers listed match what your registrar has. A mismatch means delegation is broken and nothing on the domain resolves reliably.
Test DNSSEC
Run dig +dnssec MX yourdomain.com and look for a SERVFAIL. A validation failure looks exactly like an outage to anyone using a validating resolver, and it is invisible to anyone who is not.
Check the registration status
A whois query shows whether the domain expired or is in a hold status. Renewal fixes it and propagation takes hours, not minutes.
Query the authoritative servers directly
Run dig MX yourdomain.com @ns1.theirnameserver.com. A timeout there points at the nameserver itself rather than anything in the path.
How to know it worked
The short version
- dig MX yourdomain.com returns NOERROR with answers from more than one public resolver.
- dig +dnssec returns no SERVFAIL.
- A verification run over addresses at that domain completes without DNS errors.
Questions people ask
How is this different from a missing MX record?
A missing record is a successful query with an empty answer. A failed lookup is a query that never completed. The first is a fact about the domain and the second is a fact about DNS at that moment.
Should addresses be marked invalid when the lookup fails?
No. We mark them unknown and do not bill them, because a DNS outage says nothing about whether the mailboxes exist.
Why does the lookup work for me and fail for my verifier?
Often DNSSEC. A validating resolver refuses an answer with a broken signature, while a non-validating one returns it happily. Both are behaving correctly.