I've seen this failure:

  When I do a TCP DNS lookup of "torproject.org"
  Failed to resolve torproject.org:
  Using domain server:
  Name: 208.67.222.222
  Address: 208.67.222.222#53
  Aliases:

  torproject.org has address 86.59.30.40
  torproject.org has address 82.195.75.101
  torproject.org has address 38.229.72.16
  torproject.org has address 154.35.132.70
  torproject.org has address 138.201.14.197
  torproject.org has IPv6 address 2620:0:6b0:b:1a1a:0:26e5:4810
  torproject.org has IPv6 address 2001:41b8:202:deb:213:21ff:fe20:1426
  torproject.org has IPv6 address 2a01:4f8:172:1b46:0:abba:5:1
  torproject.org has IPv6 address 2001:858:2:2:aabb:0:563b:1e28
  Host torproject.org not found: 2(SERVFAIL)
  .
  is not true. (Test::Unit::AssertionFailedError)
  ./features/step_definitions/firewall_leaks.rb:21:in `/^I do a TCP DNS lookup of "(.*?)"$/'
  features/tor_enforcement.feature:32:in `When I do a TCP DNS lookup of "torproject.org"'

i.e. A and AAAA were successfully queried, but the MX query failed.

Here, we don't care about the query type whatsoever: once *one* DNS
query is out, what we are really interested in is the next step,
i.e. "the firewall leak detector has detected leaks".

So, let's avoid such failures by sending a simpler DNS query.