diff --git a/app/services/realtime_audit_service.py b/app/services/realtime_audit_service.py
index dd63581..7bcfca7 100644
--- a/app/services/realtime_audit_service.py
+++ b/app/services/realtime_audit_service.py
@@ -75,8 +75,29 @@ BANNER_FILTERS = [
 ]
 
 
+def _ordered_suffixes(hostname):
+    """Ordre des suffixes selon la 2e lettre du hostname (convention SANEF).
+    r=recette, p=prod, i=infra. Les autres suffixes sont tentés en fallback."""
+    all_suffixes = _get_dns_suffixes()
+    second = hostname[1].lower() if len(hostname) > 1 else ""
+    if second == "r":
+        priority = [".sanef-rec.fr", ".sanef.groupe", ".sanef.fr"]
+    elif second in ("p", "i"):
+        priority = [".sanef.groupe", ".sanef-rec.fr", ".sanef.fr"]
+    else:
+        priority = [".sanef.groupe", ".sanef-rec.fr", ".sanef.fr"]
+    ordered = []
+    for suf in priority:
+        if suf in all_suffixes and suf not in ordered:
+            ordered.append(suf)
+    for suf in all_suffixes:
+        if suf not in ordered:
+            ordered.append(suf)
+    return ordered
+
+
 def _resolve(hostname):
-    for suffix in _get_dns_suffixes():
+    for suffix in _ordered_suffixes(hostname):
         target = hostname + suffix
         try:
             sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)