mx.lookup_error
MX DNS Lookup Failed
What we check
We query DNS for MX records at the domain. This finding is emitted when the lookup returns an error (SERVFAIL, timeout, or other transient failure) instead of a definitive answer. We cannot determine whether MX records exist.
What this finding means
The DNS query for MX records failed with a transient error. This does not mean MX records are absent — it means the authoritative DNS servers for the domain did not produce a usable answer at the time of the scan. The MX configuration is indeterminate.
Why it matters
- Intermittent delivery failures. If the domain's DNS is unreliable, sending servers may fail to look up MX records and defer or bounce messages.
- Incomplete scan results. Without a successful MX lookup, downstream checks (STARTTLS, TLS certificates, SMTP session) cannot run against the correct targets.
- DNS infrastructure problem. Repeated lookup failures point to misconfigured authoritative nameservers, an expired domain, or network issues between the scanner and the domain's DNS.
How to fix
Check that the domain's authoritative nameservers are reachable and responding:
dig +trace MX example.comVerify NS records are correct and point to active nameservers:
dig +short NS example.comCheck for DNSSEC validation failures — a broken DNSSEC chain causes SERVFAIL:
dig +dnssec MX example.comRe-run the scan after fixing DNS issues to get a complete result.
How it's graded
A DNS lookup error is an informational finding with no grading penalty. The scan result is incomplete rather than negative. See Grading Methodology for the full scoring model.
Evidence example
$ dig MX example.com
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 12345
;; ANSWER SECTION:
(empty — authoritative nameserver did not respond)