DIAGNOSTIC PLAYBOOK
Email DNS returns SERVFAIL: isolate the resolver failure
SERVFAIL indicates that a resolver could not complete the query successfully. It differs from a confirmed nonexistent name and can result from DNSSEC, authoritative availability or other resolution problems.
HealthCheck Email editorial team · · Examples are illustrative
How to investigate
- Compare the same query through multiple recursive resolvers and the authoritative servers.
- Check for recent nameserver or DNSSEC changes and inconsistent delegation data.
- Repair the identified authority or validation problem, then verify the complete mail-record set.
What this looks like
ILLUSTRATIVE EXAMPLE
A zone migration leaves a stale parent DS record. Validating resolvers return SERVFAIL while a nonvalidating path appears to work.
A mistake to avoid
Do not call every SERVFAIL a DNSSEC failure. Establish evidence for validation problems before changing signing or delegation.
Keep the result in context
The authoritative DNS service publishes records; recursive resolvers may retain earlier answers until their cache expires. Save the queried name, record type, resolver, answer and time. A website loading correctly does not establish that email records are present or that an SMTP server accepts mail.
Take the next step
Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.
Sources and further reading
The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.