diff --git a/logging/grafana-dashboards/yealink-phones.json b/logging/grafana-dashboards/yealink-phones.json
index ad4c7a8..e6b3894 100644
--- a/logging/grafana-dashboards/yealink-phones.json
+++ b/logging/grafana-dashboards/yealink-phones.json
@@ -78,7 +78,7 @@
     {
       "type": "stat",
       "title": "Active LDAP failures (15m)",
-      "description": "Distinct phones that could not bind/contact the LDAP directory in the last 15 minutes. This can break directory search and caller-name lookup, but does not by itself indicate a SIP calling outage.",
+      "description": "Distinct phones that could not resolve or contact the LDAP directory in the last 15 minutes. Verbose evidence identifies short-name DNS resolution of SERVERPDC as the cause. This can break directory/caller-name lookup, but not SIP calling itself.",
       "gridPos": { "h": 4, "w": 4, "x": 8, "y": 5 },
       "id": 3,
       "datasource": { "type": "loki", "uid": "${datasource}" },
@@ -86,7 +86,7 @@
         {
           "refId": "A",
           "datasource": { "type": "loki", "uid": "${datasource}" },
-          "expr": "count(count by (mac) (count_over_time({job=\"syslog\", mac=~\"$phone\"} |~ \"ldap_sasl_bind_s|Can't contact LDAP server\" [15m])))",
+          "expr": "count(count by (mac) (count_over_time({job=\"syslog\", mac=~\"$phone\"} |~ \"Domain name resolution failed|ldap_sasl_bind_s|Can't contact LDAP server\" [15m])))",
           "queryType": "instant"
         }
       ],
@@ -178,7 +178,7 @@
     {
       "type": "bargauge",
       "title": "Phones by operational-signal events",
-      "description": "Top phones for the narrow signals this dashboard can interpret: LDAP connectivity, internal database faults, provisioning/download failures, and SIP DNS timeouts. Keyed on MAC so DHCP changes do not split identity.",
+      "description": "Top phones for the narrow signals this dashboard can interpret: LDAP DNS/connectivity, internal database faults, provisioning/download failures, and SIP DNS timeouts. Keyed on MAC so DHCP changes do not split identity.",
       "gridPos": { "h": 9, "w": 12, "x": 0, "y": 9 },
       "id": 7,
       "datasource": { "type": "loki", "uid": "${datasource}" },
@@ -186,7 +186,7 @@
         {
           "refId": "A",
           "datasource": { "type": "loki", "uid": "${datasource}" },
-          "expr": "topk(10, sum by (mac) (count_over_time({job=\"syslog\", mac=~\"$phone\"} |~ \"ldap_sasl_bind_s|Can't contact LDAP server|database disk image is malformed|Null Virtual Machine pointer|Invalid scalar query|tftp to file failed|no config Provisioning Server|DURL<3[+]error|Timeout while contacting DNS servers\" [$__range])))",
+          "expr": "topk(10, sum by (mac) (count_over_time({job=\"syslog\", mac=~\"$phone\"} |~ \"Domain name resolution failed|ldap_sasl_bind_s|Can't contact LDAP server|database disk image is malformed|Null Virtual Machine pointer|Invalid scalar query|tftp to file failed|no config Provisioning Server|DURL<3[+]error|Timeout while contacting DNS servers\" [$__range])))",
           "queryType": "instant",
           "legendFormat": "{{mac}}"
         }
@@ -227,7 +227,7 @@
     {
       "type": "timeseries",
       "title": "Operational signals over time",
-      "description": "Narrow, interpretable signals separated from firmware error-severity noise. LDAP affects directory lookup; internal DB affects local apps; provisioning should settle after boot; SIP DNS timeouts can prevent registration.",
+      "description": "Narrow, interpretable signals separated from firmware error-severity noise. LDAP short-name DNS failure affects directory lookup; internal DB affects local apps; provisioning should settle after boot; SIP DNS timeouts can prevent registration.",
       "gridPos": { "h": 8, "w": 12, "x": 0, "y": 18 },
       "id": 9,
       "datasource": { "type": "loki", "uid": "${datasource}" },
@@ -235,7 +235,7 @@
         {
           "refId": "A",
           "datasource": { "type": "loki", "uid": "${datasource}" },
-          "expr": "sum(count_over_time({job=\"syslog\", mac=~\"$phone\"} |~ \"ldap_sasl_bind_s|Can't contact LDAP server\" [$__interval]))",
+          "expr": "sum(count_over_time({job=\"syslog\", mac=~\"$phone\"} |~ \"Domain name resolution failed|ldap_sasl_bind_s|Can't contact LDAP server\" [$__interval]))",
           "queryType": "range",
           "legendFormat": "LDAP directory"
         },
@@ -310,7 +310,7 @@
     {
       "type": "logs",
       "title": "Operational signals — investigate these first",
-      "description": "LDAP connectivity, internal database faults, provisioning/download failures, and SIP DNS timeouts. LDAP affects directory features but not calls; provisioning bursts during reboot are expected unless they persist. Labels show stable MAC and current source IP.",
+      "description": "LDAP DNS/connectivity, internal database faults, provisioning/download failures, and SIP DNS timeouts. LDAP affects directory features but not calls; verbose phones identify SERVERPDC short-name resolution as the current LDAP cause. Labels show stable MAC and current source IP.",
       "gridPos": { "h": 10, "w": 24, "x": 0, "y": 26 },
       "id": 11,
       "datasource": { "type": "loki", "uid": "${datasource}" },
@@ -318,7 +318,7 @@
         {
           "refId": "A",
           "datasource": { "type": "loki", "uid": "${datasource}" },
-          "expr": "{job=\"syslog\", mac=~\"$phone\"} |~ \"ldap_sasl_bind_s|Can't contact LDAP server|database disk image is malformed|Null Virtual Machine pointer|Invalid scalar query|tftp to file failed|no config Provisioning Server|DURL<3[+]error|Timeout while contacting DNS servers\"",
+          "expr": "{job=\"syslog\", mac=~\"$phone\"} |~ \"Domain name resolution failed|ldap_sasl_bind_s|Can't contact LDAP server|database disk image is malformed|Null Virtual Machine pointer|Invalid scalar query|tftp to file failed|no config Provisioning Server|DURL<3[+]error|Timeout while contacting DNS servers\"",
           "queryType": "range"
         }
       ],
@@ -458,6 +458,6 @@
   "timezone": "browser",
   "title": "Yealink IP phones — syslog health",
   "uid": "yealink-phones",
-  "version": 3,
+  "version": 4,
   "weekStart": ""
 }