DIAGNOSTIC PLAYBOOK
Internal DNS passes but public email checks fail
Split-horizon DNS can return different answers inside and outside an organization. External senders use publicly visible records, so an internal successful lookup may not test their delivery path.
HealthCheck Email editorial team · · Examples are illustrative
How to investigate
- Run the same record query from an internal resolver and an independent public resolver.
- Identify whether the difference is intentional private routing or an outdated external zone.
- Correct the public record set for internet mail and retest from an external receiving or sending path.
What this looks like
ILLUSTRATIVE EXAMPLE
Employees resolve mail.example.com to a private server address, while the public zone contains a retired target. Internal tests pass and outside customers cannot deliver.
A mistake to avoid
Do not publish private infrastructure addresses simply to make answers match. Internal and external designs can differ intentionally.
Keep the result in context
The authoritative DNS service publishes records; recursive resolvers may retain earlier answers until their cache expires. Save the queried name, record type, resolver, answer and time. A website loading correctly does not establish that email records are present or that an SMTP server accepts mail.
Take the next step
Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.
Sources and further reading
The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.