diff --git a/crates/tranquil-comms/src/email/mod.rs b/crates/tranquil-comms/src/email/mod.rs
index 3c57238..b611a6c 100644
--- a/crates/tranquil-comms/src/email/mod.rs
+++ b/crates/tranquil-comms/src/email/mod.rs
@@ -9,6 +9,7 @@ use std::time::Duration;
 
 use async_trait::async_trait;
 use hickory_resolver::TokioAsyncResolver;
+use hickory_resolver::config::{ResolverConfig, ResolverOpts};
 use lettre::message::Mailbox;
 use lettre::transport::smtp::AsyncSmtpTransport;
 use lettre::transport::smtp::PoolConfig;
@@ -128,9 +129,10 @@ fn build_smarthost(
 
 fn build_direct_mx(cfg: &tranquil_config::TranquilConfig) -> Result<SendMode, SendError> {
     let helo = resolve_helo(cfg)?;
-    let resolver = TokioAsyncResolver::tokio_from_system_conf()
-        .map(Arc::new)
-        .map_err(|e| config_invalid("system DNS configuration", e))?;
+    let resolver = Arc::new(TokioAsyncResolver::tokio_from_system_conf().unwrap_or_else(|e| {
+        tracing::warn!("falling back to default DNS resolvers: {}", e);
+        TokioAsyncResolver::tokio(ResolverConfig::default(), ResolverOpts::default())
+    }));
     let max_concurrent = cfg.email.direct_mx.max_concurrent_sends.max(1);
     Ok(SendMode::DirectMx {
         resolver,
diff --git a/crates/tranquil-lexicon/src/resolve.rs b/crates/tranquil-lexicon/src/resolve.rs
index 90d1536..ec50952 100644
--- a/crates/tranquil-lexicon/src/resolve.rs
+++ b/crates/tranquil-lexicon/src/resolve.rs
@@ -85,7 +85,10 @@ pub fn nsid_to_authority(nsid: &str) -> Result<String, ResolveError> {
 }
 
 pub async fn resolve_did_from_dns(authority: &str) -> Result<String, ResolveError> {
-    let resolver = TokioAsyncResolver::tokio(ResolverConfig::default(), ResolverOpts::default());
+    let resolver = TokioAsyncResolver::tokio_from_system_conf().unwrap_or_else(|e| {
+        tracing::warn!("falling back to default DNS resolvers: {}", e);
+        TokioAsyncResolver::tokio(ResolverConfig::default(), ResolverOpts::default())
+    });
 
     let extract_did = |lookup: hickory_resolver::lookup::TxtLookup| -> Option<String> {
         lookup
diff --git a/crates/tranquil-pds/src/handle/mod.rs b/crates/tranquil-pds/src/handle/mod.rs
index 003369e..89a90bf 100644
--- a/crates/tranquil-pds/src/handle/mod.rs
+++ b/crates/tranquil-pds/src/handle/mod.rs
@@ -19,7 +19,10 @@ pub enum HandleResolutionError {
 }
 
 pub async fn resolve_handle_dns(handle: &str) -> Result<String, HandleResolutionError> {
-    let resolver = TokioAsyncResolver::tokio(ResolverConfig::default(), ResolverOpts::default());
+    let resolver = TokioAsyncResolver::tokio_from_system_conf().unwrap_or_else(|e| {
+        tracing::warn!("falling back to default DNS resolvers: {}", e);
+        TokioAsyncResolver::tokio(ResolverConfig::default(), ResolverOpts::default())
+    });
     let query_name = format!("_atproto.{}", handle);
     let txt_lookup = resolver
         .txt_lookup(&query_name)
diff --git a/crates/tranquil-scopes/src/permission_set.rs b/crates/tranquil-scopes/src/permission_set.rs
index 6f981d9..96cf4f1 100644
--- a/crates/tranquil-scopes/src/permission_set.rs
+++ b/crates/tranquil-scopes/src/permission_set.rs
@@ -1,4 +1,5 @@
 use hickory_resolver::TokioAsyncResolver;
+use hickory_resolver::config::{ResolverConfig, ResolverOpts};
 use reqwest::Client;
 use serde::Deserialize;
 use std::collections::HashMap;
@@ -221,8 +222,10 @@ async fn fetch_lexicon_via_atproto(nsid: &str) -> Result<LexiconDoc, ScopeExpans
 }
 
 async fn resolve_lexicon_did_authority(authority: &str) -> Result<String, ScopeExpansionError> {
-    let resolver = TokioAsyncResolver::tokio_from_system_conf()
-        .map_err(|e| ScopeExpansionError::DnsResolution(e.to_string()))?;
+    let resolver = TokioAsyncResolver::tokio_from_system_conf().unwrap_or_else(|e| {
+        tracing::warn!("falling back to default DNS resolvers: {}", e);
+        TokioAsyncResolver::tokio(ResolverConfig::default(), ResolverOpts::default())
+    });
 
     let dns_name = format!("_lexicon.{}", authority);
     debug!(dns_name = %dns_name, "Looking up DNS TXT record");