What is it?
This finding means DNS lookups returned errors such as timeout, SERVFAIL, refused answers, malformed responses, or inconsistent resolver behavior. It belongs to the DNS probe.
Why does it matter?
DNS is the first dependency for web, TLS, and mail checks. Resolver errors can make a working service appear unavailable, slow down clients through retries, or hide more specific problems such as broken DNSSEC, bad delegation, or unreachable authoritative nameservers.
How to fix it?
Check the authoritative nameservers and compare answers from more than one resolver.
dig example.com A
dig example.com SOA
dig +trace example.com
dig @ns1.provider.example example.com SOAIf DNSSEC is enabled, validate the chain. Remove stale glue records, fix unreachable nameservers, and make sure the zone is served consistently by every delegated nameserver.