diff --git a/perf/memcensus-util.sh b/perf/memcensus-util.sh
index 0c486e8..b4eeb14 100755
--- a/perf/memcensus-util.sh
+++ b/perf/memcensus-util.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # perf/memcensus-util.sh — live per-app resource census: memory utilization
 # (%-sorted), per-container CPU, host disk + docker space, and 24h
-# memcg-OOM evidence. Read-only. [#685/#731/#757]
+# memcg-OOM evidence. Read-only. [#685/#731/#757/#787]
 #
 # Run (from a checkout):
 #   VM_IP=my.knownelement.com VM_USER=root timeout 300 bash tests/remote.sh vm-file perf/memcensus-util.sh
@@ -74,7 +74,13 @@ for svc in docker containerd; do
     printf '%s up since: %s\n' "$svc" \
         "$(systemctl show -p ActiveEnterTimestamp --value "$svc" 2>/dev/null)"
 done
-printf 'dockerd err/warn lines 24h: %s\n' \
-    "$(journalctl -u docker --since '-24 hours' --no-pager 2>/dev/null | grep -ciE 'error|fail')"
+# dockerd err/warn split per #787: "failed to query external DNS" from the
+# mail container's PTR lookups on hostile SMTP sources is known-noise (the
+# offending ranges' reverse zones are lame; unbound itself is healthy).
+journalctl -u docker --since '-24 hours' --no-pager 2>/dev/null > "$TMP/dockerlog"
+noise=$(grep -c "failed to query external DNS" "$TMP/dockerlog")
+othererr=$(grep -iE 'error|fail' "$TMP/dockerlog" | grep -vc "failed to query external DNS")
+printf 'dockerd resolver noise 24h (mail PTR on hostile rdns — known, #787): %s\n' "$noise"
+printf 'dockerd other err/warn 24h (REAL signal — investigate if trending up): %s\n' "$othererr"
 printf 'pg too-many-clients 24h: %s\n' \
     "$(docker logs postgresql --since 24h 2>&1 | grep -c 'too many clients')"