Find DKIM and DMARC Records?

Question

Is there a method to find a domain's DKIM and DMARC records using dig or nslookup?

I have attempted to do the following:

dig somedomain.org any

returns many records, but not the known DKIM and DMARC text records.

nslookup -type=txt somedomain.org

returns all the text records known except the DKIM and DMARC records.

DKIM records are applied to arbitrary subdomains (Google Apps uses `google._domainkey.example.com`) that you'd have to know/guess to look for. — ceejayoz, Aug 29 '14 at 15:38
It depends on the selector prefix used, part of the DKIM header in a signed email — Mathias R. Jessen, Aug 29 '14 at 15:57

score 59 · Accepted Answer · edited Mar 11 '21 at 22:00

To query the TXT record for DMARC, you can use:

dig TXT _dmarc.example.org

To query for a particular record for DKIM, you would need to know the selector prefix. You will find it in the s value in an email's DKIM-Signature.

For example:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.org;
s=google; t=1615461277;
[…]

You would then query it as TXT:

dig TXT google._domainkey.example.org

score 10 · Answer 2 · answered Jan 21 '16 at 14:46

For DKIM records, if you have received a DKIM-signed email from that domain, look at the DKIM-Signature header line(s).

From the spec:

All DKIM keys are stored in a subdomain named _domainkey. Given a DKIM-Signature field with a "d=" tag of example.com and an "s=" tag of foo.bar, the DNS query will be for foo.bar._domainkey.example.com.

So in this example, you can then run:

dig TXT foo.bar._domainkey.example.com

Credit to andol, whose comment led me to this solution.

Talal Al-Khalifa · Answer 3 · 2017-02-14T18:53:18.693

7

You should use +short with dig to get the DMARC record only.

dig +short TXT _dmarc.domain.com

edited Feb 14 '17 at 18:53

answered Feb 14 '17 at 18:43

Talal Al-Khalifa

648
5
12

score 3 · Answer 4 · answered Jan 18 '16 at 11:22

Using Windows built-in tool nslookup

Open Command Prompt (cmd.exe)
Enter nslookup
Enter set type=txt
Enter _dmarc.somedomain.org, replace somedomain.org

Example:

C:\Users\user>nslookup

Default Server:  localdns
Address:  192.168.1.1

> set type=txt

> _dmarc.somedomain.org

Non-authoritative answer:
_dmarc.somedomain.org text =

    "v=DMARC1; p=none; rua=mailto:postmaster@somedomain.org"

You may use server 8.8.8.8 (Google DNS) before lookup DMARC TXT record.

Wouldn't `nslookup -type=txt _dmarc.somedomain.org [8.8.8.8]` be simpler? — mwfearnley, Nov 05 '19 at 10:42

score 0 · Answer 5 · answered Sep 29 '21 at 21:23

0

We also built a tool called Gappie that allows you to check your SPF, DKIM and DMARC records in Slack or Telegram at no cost.

You can use Gappie to

Check IP Reputation
Validate domain records (SPF, DKIM, DMARC, MX records)

answered Sep 29 '21 at 21:23

Jesse Hernandez

21
1

Find DKIM and DMARC Records?

5 Answers5