Mail not delivered DNSSEC

We have mail (password reset) which is received by the protector but it is not deliverd to our mail server.

If we change the MX record, which has exactly the same routing for delivery, then everything works.

In de mail log we see strange things happening, but cannot explain it.

Below the example of the mail with id which is received with the protector but is NOT received by exchange.

We expect the following problem:

dsn=4.0.0, stat=Deferred: Name server: exchange.example.com.: host name lookup failure

But only mail coming from …@gaia-hosted.bounces.google.com gives this error.

The destination is [e-mail]

Can you see or explain what is going wrong?

Why is all other mail to example@example working and delivered?

MX record change and bypassing the protector works, mail is delivered.

Sending the same password reset to a mail address not handled by the protector also works.

If the protector is handling the incoming mail for xxx.xxx then everything works, EXCEPT the mail coming from gaia-hosted.bounces.google.com

The mail is not marked as spam and is not delivered.

Even if I release the clean mail again then it not delivered.

In the log we see: Name server: example.com.:host name lookup failure

But we cannot explain why xxx.xxx is used as a DNS server ? the setting is 8.8.8.8 en 8.8.4.4

We have found the problem. Dnssec for example.com was invalid and the protector used 8.8.8.8 and 8.8.4.4 which doesn’t resolve if the dnssec is invalid.