A few days ago I tried signing up for an account on a web forum, and for no apparent reason it spent about half a minute doing nothing and then claimed it had sent me an email with a confirmation link. After attempting to get this email resent a few times, I tried a different address and got the email almost immediately.
There were two things that were happening here: first of all, the website wasn’t actually doing sensible error checking. But more importantly (as I confirmed with an email to one of their administrators), they weren’t finding my DNS records to get the MX servers.
I checked my own ability to connect to the iserve dns servers, and with both of them I was getting timeouts and a traceroute which stopped at firewall-01a.iserve.net.nz; on the other hand, I was still seeing the address coming up on the DNS servers I usually use for DNS lookups. This probably means that iserve (or, since 2009, Orcon) are only allowing a limited set of servers to perform lookups on their servers.
As an aside, while looking into what might be wrong with my email address that was affecting one of my domains but not the other, I set up DKIM and DMARC on my main domain; this turns out to be surprisingly easy, but revealed that iserve can’t handle the length of txt records required for a 2048 bit DKIM key. Other things that iserve doesn’t handle includes DNSSEC records.
After finding the apparent root of my problem, I started looking into domain hosting, and found fairly quickly that free domain hosting is easy to find. So I promptly moved the authoritative nameservers for the domain to cloudflare. This still doesn’t fix the fact that iserve doesn’t handle DNSSEC, but I’ll be looking at moving to a different registrar that handles DS records sometime in the coming few weeks.
Long story short, though? Just because something seems to be working, doesn’t mean it’s not fucked up somewhere you haven’t tested (and in some cases, can’t test).