Issue Description What happened? With the default System DNS resolver, every outbound message to a recipient whose MX hosts sit under .org (and .io) stalls in the queue. Each attempt logs: INFO IP address lookup failed (delivery.ip-lookup-failed) queueId = ..., domain = "<>", hostname = "mxext1.ma…

Outbound delivery to all .org and .io recipients stalls with "DNSSEC validation failed"

stalwart September 18, 2026, 1:09pm 2

This is hickory bug, added a workaround to limit concurrency to 1 in v0.16.23 (yet to be released).

Topic		Replies	Views
Outbound delivery to .aero / .org / .email fails with "DNSSEC validation failed" — follow-up to #3316 (still present in v0.16.22) Issues	3	68	October 18, 2026
Support.stalw.art Issues	10	252	October 11, 2026
Outbound: "DNSSEC validation failed" on MX host lookup when the recipient domain is signed but its MX hosts are in an unsigned zone (Google Workspace). Still present in 0.16.24 Issues	4	126	October 12, 2026
Transmission problem to outlook.com Questions	20	351	October 11, 2026
MX lookup fails with "DNSSEC validation failed" for signed zone (mail.de, RSA/SHA-512) on 0.16.21, regardless of DANE setting Issues	13	399	October 11, 2026