The destination could not be resolved verifiedcritical
No address could be found for the destination; the result field says whether the address is to blame or our own resolver is.
In detail
Measured rather than read: the message went to failure on its first attempt with no further tries. That makes DNS failures unlike every other failure in this list — there is no gradual giving up, and a resolver outage becomes an instant wave of permanent failures. Two very different causes wear this one state, and they are distinguishable, which the vendor documentation does not say anywhere. The stand produced all three variants: a domain that does not exist gives result: error, status 5.4.4, "Lookup failure: domain does not exist"; a domain that exists but has nowhere to deliver gives result: error, status 5.4.4, "Lookup failure: no destination IP address"; and a resolver that does not answer — reproduced by pointing dns-nameserver at an unrouted address — gives result: invalid, status 4.4.3, "Lookup failure: timeout". So the rule for any classifier is simple and does not need statistics: within dns, trust result. error with a 5.x status is the address's fault and may feed a suppression list; invalid with a 4.x status is ours, and suppressing on it would burn good addresses during a resolver outage — exactly the accident this state was flagged for.