fix(sso): state what a failed DNS lookup tells us instead of assigning blame

Author: waleedlatif1

apps/sim/app/api/organizations/[id]/domains/[domainId]/verify/route.test.ts

@@ -88,7 +88,9 @@ describe('verify org domain route', () => {
     mockCheckDomainTxtRecord.mockResolvedValue('unavailable')
     const res = await POST(createMockRequest('POST'), routeContext)
     expect(res.status).toBe(503)
-    expect(await res.json()).toMatchObject({ error: expect.stringContaining('on our side') })
+    expect(await res.json()).toMatchObject({
+      error: expect.stringContaining("couldn't complete the DNS lookup"),
+    })
     expect(mockRecordAudit).not.toHaveBeenCalled()
   })
 

apps/sim/app/api/organizations/[id]/domains/[domainId]/verify/route.ts

@@ -71,13 +71,14 @@ export const POST = withRouteHandler(
     }
 
     const lookup = await checkDomainTxtRecord(row.domain, row.verificationToken)
-    // 503, not 422: the record may well be correct, so this must not read as the
-    // admin's mistake or they will go hunting through DNS for a fault that is ours.
+    // 503, not 422: we learned nothing about their record, so this must not read
+    // as a missing one. SERVFAIL can mean either a fault of ours or a broken zone
+    // of theirs, so the message states what we know rather than assigning blame.
     if (lookup === 'unavailable') {
       return NextResponse.json(
         {
           error:
-            "We couldn't complete the DNS lookup — this is a problem on our side, not with your record. Try again in a few minutes.",
+            "We couldn't complete the DNS lookup, so we can't tell yet whether your record is published. Try again in a few minutes — if it keeps failing, check that your domain's nameservers are responding.",
         },
         { status: 503 }
       )