Error 451 4.4.0: DNS Query Failed - Fix Guide 2025

Delivery has failed to these recipients or groups:

john.smith@external-company.com

Your message wasn't delivered due to a DNS problem.
Exchange will retry delivery for 48 hours.

Diagnostic information for administrators:
Generating server: mail.company.com

Remote Server returned '451 4.4.0 DNS query failed.
The error was: DNS query failed with error ErrorDnsQueryFailed'

# Configure reliable external DNS servers
Set-TransportService $env:COMPUTERNAME -ExternalDNSServers 8.8.8.8,8.8.4.4

# Or use Cloudflare DNS
Set-TransportService $env:COMPUTERNAME -ExternalDNSServers 1.1.1.1,1.0.0.1

# Disable adapter-based DNS for external mail
Set-TransportService $env:COMPUTERNAME -ExternalDNSAdapterEnabled $false

# Restart Transport to apply
Restart-Service MSExchangeTransport

# Verify configuration
Get-TransportService $env:COMPUTERNAME |
  Select-Object ExternalDNSServers, ExternalDNSAdapterEnabled

# Clear Windows DNS cache
Clear-DnsClientCache
ipconfig /flushdns

# Restart DNS Client service
Restart-Service Dnscache

# Clear Exchange Transport DNS cache (restart service)
Restart-Service MSExchangeTransport

# Retry queued messages
Get-Queue | Where-Object {$_.Status -eq "Retry"} | Retry-Queue

# Check existing firewall rules for DNS
Get-NetFirewallRule | Where-Object {$_.DisplayName -like "*DNS*"} |
  Select-Object DisplayName, Enabled, Direction, Action

# Create outbound DNS rule if missing
New-NetFirewallRule -DisplayName "Allow Outbound DNS" `
  -Direction Outbound -Protocol UDP -RemotePort 53 `
  -Action Allow -Profile Any -Enabled True

# Also allow TCP 53 (for large DNS responses)
New-NetFirewallRule -DisplayName "Allow Outbound DNS TCP" `
  -Direction Outbound -Protocol TCP -RemotePort 53 `
  -Action Allow -Profile Any -Enabled True

# Test DNS after firewall change
Resolve-DnsName -Name "gmail.com" -Type MX

# Run on your internal DNS server (requires DNS Server role)
# Add forwarders to public DNS
Add-DnsServerForwarder -IPAddress 8.8.8.8
Add-DnsServerForwarder -IPAddress 1.1.1.1

# Verify forwarders
Get-DnsServerForwarder

# Or configure conditional forwarders for specific domains
# Add-DnsServerConditionalForwarderZone -Name "external-company.com" -MasterServers 8.8.8.8-Name "external-company.com" -MasterServers 8.8.8.8

# Check if domain has MX record
$domain = "problem-domain.com"
Resolve-DnsName -Name $domain -Type MX

# If no MX, Exchange falls back to A record
Resolve-DnsName -Name $domain -Type A

# If neither works, the domain may not accept email
# Or may use implicit MX (A record as mail server)

# Contact recipient to verify their email configuration
# They may need to add MX record: mail.problem-domain.com

# Temporary workaround: Use smart host for that domain
New-SendConnector -Name "SmartHost for problem-domain" `
  -AddressSpaces "SMTP:problem-domain.com;1"1" `
  -SmartHosts "their-known-mailserver.com"-mailserver.com" `
  -DNSRoutingEnabled $false

# In split DNS, internal DNS may not resolve external domains properly

# Option 1: Configure separate DNS for external mail
Set-TransportService $env:COMPUTERNAME `
  -InternalDNSServers 192.168.1.10,192.168.1.11 `
  -ExternalDNSServers 8.8.8.8,1.1.1.1 `
  -InternalDNSAdapterEnabled $false `
  -ExternalDNSAdapterEnabled $false

# Option 2: Configure internal DNS to forward external queries
# On your internal DNS server:
# Add-DnsServerForwarder -IPAddress 8.8.8.8-IPAddress 8.8.8.8

# Option 3: Use conditional forwarders for specific zones
# Add-DnsServerConditionalForwarderZone -Name "gmail.com" -MasterServers 8.8.8.8-Name "gmail.com" -MasterServers 8.8.8.8

# Exchange requires traditional DNS (UDP/TCP 53)
# If your network forces DoH/DoT, create exceptions for Exchange

# Test if Exchange can reach standard DNS
$dnsServers = @("8.8.8.8"8.8.8", "1.1.1.1"1.1.1", "9.9.9.9"9.9.9")
foreach ($dns in $dnsServers) {
    $result = Test-NetConnection -ComputerName $dns -Port 53
    Write-Host "$dns : $($result.TcpTestSucceeded)"$result.TcpTestSucceeded)"
}

# If blocked, work with network team to whitelist Exchange server
# Or configure a local DNS proxy that supports standard DNS

# Monitor DNS resolution over time
$testDomain = "gmail.com"
$results = @()

1..100 | ForEach-Object {
    $start = Get-Date
    try {
        $dns = Resolve-DnsName -Name $testDomain -Type MX -ErrorAction Stop
        $status = "Success"
    } catch {
        $status = "Failed"
    }
    $duration = (Get-Date) - $start

    $results += [PSCustomObject]@{
        Iteration = $_
        Status = $status
        Duration = $duration.TotalMilliseconds
    }
    Start-Sleep -Seconds 5
}

# Analyze results
$results | Group-Object Status | Select-Object Name, Count
$results | Where-Object {$_.Status -eq "Failed"} | Select-Object Iteration, Duration

# If intermittent, check:
# - DNS server load/performance
# - Network latency/packet loss
# - DNS request rate limiting

# Configure multiple DNS servers for failover
Set-TransportService $env:COMPUTERNAME -ExternalDNSServers 8.8.8.8,1.1.1.1,9.9.9.9

# Exchange will try each server in order if one fails

# Verify redundancy
Get-TransportService $env:COMPUTERNAME | Select-Object ExternalDNSServers

# Test failover by blocking primary DNS temporarily
# then verify mail still flows

# 1. Verify DNS resolution works
Resolve-DnsName -Name "gmail.com" -Type MX
Resolve-DnsName -Name "outlook.com" -Type MX

# 2. Check queues are clearing
Get-Queue | Where-Object {$_.MessageCount -gt 0} |
  Select-Object Identity, Status, MessageCount, NextHopDomain

# 3. Force retry of queued messages
Get-Queue | Where-Object {$_.Status -eq "Retry"} | Retry-Queue

# 4. Send test email to external domain
Send-MailMessage -From "admin@company.com" -To "test@gmail.com" `
  -Subject "DNS Fix Test $(Get-Date)" -Body "Testing DNS resolution fix" `
  -SmtpServer localhost

# 5. Check message tracking
Start-Sleep -Seconds 60
Get-MessageTrackingLog -Start (Get-Date).AddMinutes(-5) -EventId SEND |
  Select-Object Timestamp, Sender, Recipients, NextHopDomain

# 6. Verify no DNS errors in queues
Get-Queue | Where-Object {$_.LastError -like "*DNS*"}

# Configure multiple reliable DNS providers
Set-TransportService $env:COMPUTERNAME -ExternalDNSServers 8.8.8.8,1.1.1.1,9.9.9.9

# Mix providers for redundancy:
# - Google: 8.8.8.8, 8.8.4.48.8.8, 8.8.4.4
# - Cloudflare: 1.1.1.1, 1.0.0.11.1.1, 1.0.0.1
# - Quad9: 9.9.9.9, 149.112.112.1129.9.9, 149.112.112.112

# Verify configuration
Get-TransportService $env:COMPUTERNAME | Select-Object ExternalDNSServers

# Run hourly via scheduled task
$testDomains = @("gmail.com", "outlook.com", "yahoo.com")
$failures = @()

foreach ($domain in $testDomains) {
    try {
        Resolve-DnsName -Name $domain -Type MX -ErrorAction Stop | Out-Null
    } catch {
        $failures += $domain
    }
}

if ($failures.Count -gt 0) {
    $body = "DNS resolution failures detected on $env:COMPUTERNAME`n"
    $body += "Failed domains: $($failures -join ', ')`n"-join ', ')`n"
    $body += "Timestamp: $(Get-Date)"

    Send-MailMessage -To "admin@company.com" -From "alerts@company.com" `
      -Subject "Exchange DNS Alert" -Body $body `
      -SmtpServer "backup-smtp.company.com"
}