One of my customers wanted to verify their Domain Based Message Reporting Conformance (DMARC) record, and followed the post How To Use Nslookup To Check DNS TXT Record but ran into issues. They were not seeing any results. Hmm strange; the DMARC record had been created and was visible in online diagnostic tools. Why was it not showing up for them in a manual check?
The below is an example of what they saw.
Note that the query type is set to TXT and then we query the tailspintoys.ca domain for it’s record types. The default DNS server was used in this example and can be easily changed with the SERVER option.
set q=txt
tailspintoys.ca
TL;DR What Went Wrong?
In short, the wrong syntax was used. DMARC records are published into DNS with a subdomain label of _DMARC. This means that the DMARC record for the tailspintoys.ca domain will be located in:
_DMARC.tailspintoys.ca
As mentioned in How To Check Exchange Autodiscover SRV Record Using Nslookup, there are two ways to run nslookup – interactive and noninteractive. Noninteractive is good when you know that you only want to query a single piece of data. Interactive allows multiple queries using a single instance of nslookup, and options can be toggled on and off as needed. Examples of both methods are below.
Interactive
In this interactive example we enter into nslookup and then set the query type to be txt.
nslookup.exe
set q=txt
_DMARC.tailspintoys.ca
Non-Interactive
For this example a single command is issued that will perfom the query directly from the cmd shell.
NSLookup.exe -q=txt _DMARC.Tailspintoys.ca
NB - Common Issue
Note that we need to specify the TXT option as that is the record type used for DMARC records as per the specification in RFC 7489.
If we fail to do so, then nslookup defaults to A+AAAA record look up which will not find the DMARC TXT record.
A+AAAA – this allows nslookup to query for both IPv4 and IPv6 A records rather than have to specify both.
If you receive an error saying "Invalid Option" when specifying the record type, ensure that the q in "q=txt" is entered in lower case. Windows does not have many case sensitivity things, but that is one of them.
Cheers,
Rhoderick
