--- title: An NSLOOKUP Primer (Part 3) – DMARC & DKIM description: DMARC & DKIM TXT records which are also highly encouraged to help add additional layers of security to your email domain --- [![looking-point_LogoWhite _ Presidio-1](https://www.lookingpoint.com/hubfs/looking-point_LogoWhite%20_%20Presidio-1.svg) ![LOOKINGPOINT](https://www.lookingpoint.com/hs-fs/hubfs/Theme%20Oct%202019/images/logo@mobile.png?width=444&height=86&name=logo@mobile.png) ](https://www-lookingpoint-com.sandbox.hs-sites.com/-temporary-slug-c10ae2f5-f23e-43f2-8214-f73884fb09ae) - [Solutions](https://www.lookingpoint.com) - [Collaboration](https://www.lookingpoint.com/it-solutions-collaboration) - [Security ](https://www.lookingpoint.com/it-solutions-security) - [Networking ](https://www.lookingpoint.com/it-solutions-networking) - [Data Center ](https://www.lookingpoint.com/data-center) - [Cloud](https://www.lookingpoint.com/cloud) - [Managed Services](https://www.lookingpoint.com/it-support-services) - [Lifecycle Management](https://www.lookingpoint.com/lifecycle-management-acela) - [Services](https://www.lookingpoint.com/en/solutions-services) - [Assess and Design ](https://www.lookingpoint.com/assess-and-design-it-solutions) - [Deployment](https://www.lookingpoint.com/deployment-it-services-solutions) - [Support](https://www.lookingpoint.com/it-support-services) - [Wireless Surveys Assessments](https://www.lookingpoint.com/en-us/wireless-surveys-assessments) - [Project Management ](https://www.lookingpoint.com/project-management) - [Integration Center](https://www.lookingpoint.com/integration-services) - [Lifecycle Support](https://www.lookingpoint.com/it-lifecycle-support) - [Locations Serviced](https://www.lookingpoint.com/it-consulting-san-francisco-bay-area) - [Customer Success](https://www.lookingpoint.com/services-customer-success) - [Partners](https://www.lookingpoint.com/partner) - [Blog](https://www.lookingpoint.com/blog) - [Solutions](https://www.lookingpoint.com) - [Collaboration](https://www.lookingpoint.com/it-solutions-collaboration) - [Security ](https://www.lookingpoint.com/it-solutions-security) - [Networking ](https://www.lookingpoint.com/it-solutions-networking) - [Data Center ](https://www.lookingpoint.com/data-center) - [Cloud](https://www.lookingpoint.com/cloud) - [Managed Services](https://www.lookingpoint.com/it-support-services) - [Services](https://www.lookingpoint.com/en/solutions-services) - [Assess and Design](https://www.lookingpoint.com/assess-and-design-it-solutions) - [Deployment](https://www.lookingpoint.com/deployment-it-services-solutions) - [Support](https://www.lookingpoint.com/it-support-services) - [Wireless Survey Assessment](https://www.lookingpoint.com/en-us/wireless-surveys-assessments) - [Project Management ](https://www.lookingpoint.com/project-management) - [Lifecycle Management](https://www.lookingpoint.com/lifecycle-management-acela) - [Integration Center](https://www.lookingpoint.com/integration-services) - [Locations Serviced](https://www.lookingpoint.com/it-consulting-san-francisco-bay-area) - [Customer Success](https://www.lookingpoint.com/services-customer-success) - [Partners](https://www.lookingpoint.com/partner) - [Blog](https://www.lookingpoint.com/blog) - [+1 925-566-3480](tel:+1%20925-566-3480) - [DO NOT SHARE OR SELL MY PERSONAL INFORMATION](https://na1.hs-data-privacy.com/request/TrvvEe3VpnlESmYolHn3xw) - [![phone@2x](https://www.lookingpoint.com/hubfs/Theme%20Oct%202019/fonts/phone@2x.png) +1 925-566-3480 ](tel:+19255663480) - [![user@2x](https://www.lookingpoint.com/hubfs/Theme%20Oct%202019/fonts/user@2x.png) Acela Portal ](https://my.lookingpoint.com/) - [Free Consultation](https://www.lookingpoint.com/blog/an-nslookup-primer-part-3-dmarc-dkim#get-free-popup) Let’s Connect [Home](https://www.lookingpoint.com/) [Blog](https://www.lookingpoint.com/blog) An NSLOOKUP Primer (Part 3) – DMARC & DKIM # Blog Feb 22 An NSLOOKUP Primer (Part 3) – DMARC & DKIM Posted by [Ryan Alibrando](https://www.lookingpoint.com/blog/author/ryan-alibrando) [**1](https://www.lookingpoint.com/blog/an-nslookup-primer-part-3-dmarc-dkim#comments-listing) ** Share - [**](https://www.facebook.com/sharer/sharer.php?u=https://www.lookingpoint.com/blog/an-nslookup-primer-part-3-dmarc-dkim&title=An%20NSLOOKUP%20Primer%20(Part%203)%20–%20DMARC%20&%20DKIM&picture=&description=DMARC%20&%20DKIM%20TXT%20records%20which%20are%20also%20highly%20encouraged%20to%20help%20add%20additional%20layers%20of%20security%20to%20your%20email%20domain) - [**](https://twitter.com/intent/tweet?source=https://www.lookingpoint.com/blog/an-nslookup-primer-part-3-dmarc-dkim&text=An%20NSLOOKUP%20Primer%20(Part%203)%20–%20DMARC%20&%20DKIM) - [**](https://plus.google.com/share?url=https://www.lookingpoint.com/blog/an-nslookup-primer-part-3-dmarc-dkim) - [**](http://www.linkedin.com/shareArticle?mini=true&url=https://www.lookingpoint.com/blog/an-nslookup-primer-part-3-dmarc-dkim&title=An%20NSLOOKUP%20Primer%20(Part%203)%20–%20DMARC%20&%20DKIM&summary=DMARC%20&%20DKIM%20TXT%20records%20which%20are%20also%20highly%20encouraged%20to%20help%20add%20additional%20layers%20of%20security%20to%20your%20email%20domain) - [**](mailto:?subject=An%20NSLOOKUP%20Primer%20(Part%203)%20–%20DMARC%20&%20DKIM&body=An%20NSLOOKUP%20Primer%20(Part%203)%20–%20DMARC%20&%20DKIM%20https://www.lookingpoint.com/blog/an-nslookup-primer-part-3-dmarc-dkim) [opendns](https://www.lookingpoint.com/blog/topic/opendns) [dns](https://www.lookingpoint.com/blog/topic/dns) [IP Address](https://www.lookingpoint.com/blog/topic/ip-address) [IT Solutions](https://www.lookingpoint.com/blog/topic/it-solutions) [NSLlookup](https://www.lookingpoint.com/blog/topic/nsllookup) [nslookup locally](https://www.lookingpoint.com/blog/topic/nslookup-locally) [troubleshooting DNS](https://www.lookingpoint.com/blog/topic/troubleshooting-dns) [SPF](https://www.lookingpoint.com/blog/topic/spf) [TXT](https://www.lookingpoint.com/blog/topic/txt) [Email DNS](https://www.lookingpoint.com/blog/topic/email-dns) [MX Records](https://www.lookingpoint.com/blog/topic/mx-records) [Sender Policy Framework](https://www.lookingpoint.com/blog/topic/sender-policy-framework) [Domain-based Message Authentication](https://www.lookingpoint.com/blog/topic/domain-based-message-authentication) [Reporting and Conformance](https://www.lookingpoint.com/blog/topic/reporting-and-conformance) # Introduction This will be the final installment in this NSLOOKUP Primer series. Last time, I talked about MX & SPF TXT records [here](https://www.lookingpoint.com/blog/an-nslookup-primer-part-2-email-dns), but I didn’t touch on DMARC & DKIM TXT records which are also highly encouraged to help add additional layers of security to your email domain. # Definition **DKIM** = DomainKeys Identified Mail               DKIM helps detect forged (spoofed) email addresses by adding a cryptographic digital signature linked to a domain name and publishing a public key in DNS that mail recipients can compare to check for authenticity.   **DMARC** = Domain-based Message Authentication, Reporting and Conformance               A DMARC is designed to protect against spoofing by extending SPF & DKIM. A policy is published in DNS which specifies what mechanisms are used (SPF, DKIM, or both) by an email sender and suggests what a recipient should do with a message that fails a test of the specified mechanisms.   # Information   ## DKIM Even though DKIM is ultimately a DNS-published key, different email providers have different methods of enabling DKIM. The official documentation suggests using _domainkey.[domain], however I’m going to focus on Microsoft’s Exchange Online due to how common it is. When you configure DKIM for Exchange Online, you’re asked to create CNAME entries in your domain’s DNS to point to TXT entries in Microsoft’s DNS. This allows you to request a DKIM key rotation from your admin portal without having to touch your own DNS. The format of the entries are like below, where [domain] is the domain you’re checking, although I’m assuming .com for the first level.   CNAME = selector1._domainkey.[domain].com => selector1-[domain]-com._domainkey.[domain].onmicrosoft.com CNAME = selector2. _domainkey.[domain].com => selector2-[domain]-com._domainkey.[domain].onmicrosoft.com   So let’s follow take a look using cisco.com as our example to look up a DKIM entry. 1. Select an external DNS server (I don’t see DKIM entries set on internal DNS servers) 2. Set type to CNAME 3. Use the format above to lookup a domain that’s utilizing MS Exchange Online DKIM ![An NSLOOKUP Primer (Part 3) – DMARC & DKIM](https://www.lookingpoint.com/hubfs/image-png-Dec-19-2022-10-20-02-4832-PM.png) 1. 1. 1. Follow the trail to the Microsoft text record ![An NSLOOKUP Primer (Part 3) – DMARC & DKIM](https://www.lookingpoint.com/hubfs/image-png-Dec-19-2022-10-20-16-6053-PM.png) If we break down the record we see, it specifies the following: **v=DKIM1** – This is the version of DKIM              **k=rsa** - This is the key type **p=[public key]** – This is the public key data in base64 Although this record is a good representation of what I usually see, there are more options available in a DKIM record. More information on other syntax can be found at the RFC section 3.6.1 [here](https://www.rfc-editor.org/rfc/rfc6376#section-3.6.1). What we can see from our results is that the selector1 record has a DKIM key, but not selector2 which I am assuming is because it’s there as a “just-in-case” or “for future use”.   ## DMARC Now that we’ve looked up a DKIM record (and an SPF record in a previous post), let’s take a look at a DMARC record. Typically, DMARC records are a DNS TXT record with the format _dmarc.[domain].com. To keep consistent with our previous example, let’s look at _dmarc.cisco.com. ![An NSLOOKUP Primer (Part 3) – DMARC & DKIM](https://www.lookingpoint.com/hubfs/image-png-Dec-19-2022-10-20-53-6727-PM.png) Let’s break down each of the tags in the TXT record:               **v=DMARC1** – this is the version of DMARC (at this time it’s always DMARC1)               **p=quarantine** – this is the policy and can be none, quarantine, or reject               **pct=0** – this is the percentage of messages that the policy should be applied to (0 – 100)               **fo=1** – this is the failure reporting options (paired with ruf) and can be 0, 1, d, or s                            0 = Generate a failure report if all auth mechanisms fail to pass                            1 = Generate a failure report if any auth mechanisms return something not pass                            d = Generate a DKIM failure report if message signature failed                            s = Generate an SPF failure report if SPF evaluation failed               **ri=3600** – this is the interval between aggregate reports in seconds               **rua=mailto:[address]** – comma separated list of email addresses to receive aggregate feedback               **ruf=mailto:[address]** – comma separated list of email addresses to receive failure information It’s not in our example, but there’s another tag, “sp=” which is a subdomain policy that will allow you to set a different policy for email sent from subdomains. It’s also important to note that the tags must be in a specific order for it to work properly. For more information on the format of DMARC records, check out RFC 7489 section 6.3 [here](https://www.rfc-editor.org/rfc/rfc7489.html#section-6.3). So I’m not sure if you caught that, but based on the DMARC record above, Cisco is asking mail servers receiving mail from them to quarantine 0% of their email from the cisco.com domain. Now they’re a big company, so they may have other DMARC records for any number of subdomains, but that’s how I’m interpreting that record. Also worth noting is that if you don’t have SPF and/or DKIM already configured, DMARC won’t do anything. It should be thought of as an extension of those methods to define the policy you’d like mail recipient servers to take when mail doesn’t pass the checks. **NOTE: these policies aren’t forced, they’re requested.   # Conclusion Well hopefully this was a fun exercise you were able to follow along with to learn a little more about NSLOOKUP and DNS-based mail security at the same time. As I conclude my NSLOOKUP primer series, I dream of people reading over these 3 articles and feeling more comfortable with the tool as something quick and useful that’s built in to most operating systems for verifying DNS entries both internal and external. It just so happens that LookingPoint offers multiple IT services if you’re interested. Want more information, give us a call! Please reach out to us at [sales@lookingpoint.com](mailto:sales@lookingpoint.com) and we’ll be happy to help! [![Contact Us](https://no-cache.hubspot.com/cta/default/2215854/7814218f-8d49-4d01-9a8c-095c00c0b08d.png)](https://cta-redirect.hubspot.com/cta/redirect/2215854/7814218f-8d49-4d01-9a8c-095c00c0b08d) Written By: Ryan Alibrando, Managed Services Team Lead SHARE: - [**](https://www.facebook.com/sharer/sharer.php?u=https://www.lookingpoint.com/blog/an-nslookup-primer-part-3-dmarc-dkim&title=An%20NSLOOKUP%20Primer%20(Part%203)%20–%20DMARC%20&%20DKIM&picture=&description=DMARC%20&%20DKIM%20TXT%20records%20which%20are%20also%20highly%20encouraged%20to%20help%20add%20additional%20layers%20of%20security%20to%20your%20email%20domain) - [**](https://twitter.com/intent/tweet?source=https://www.lookingpoint.com/blog/an-nslookup-primer-part-3-dmarc-dkim&text=An%20NSLOOKUP%20Primer%20(Part%203)%20–%20DMARC%20&%20DKIM) - [**](https://plus.google.com/share?url=https://www.lookingpoint.com/blog/an-nslookup-primer-part-3-dmarc-dkim) - [**](http://www.linkedin.com/shareArticle?mini=true&url=https://www.lookingpoint.com/blog/an-nslookup-primer-part-3-dmarc-dkim&title=An%20NSLOOKUP%20Primer%20(Part%203)%20–%20DMARC%20&%20DKIM&summary=DMARC%20&%20DKIM%20TXT%20records%20which%20are%20also%20highly%20encouraged%20to%20help%20add%20additional%20layers%20of%20security%20to%20your%20email%20domain) - [**](mailto:?subject=An%20NSLOOKUP%20Primer%20(Part%203)%20–%20DMARC%20&%20DKIM&body=An%20NSLOOKUP%20Primer%20(Part%203)%20–%20DMARC%20&%20DKIM%20https://www.lookingpoint.com/blog/an-nslookup-primer-part-3-dmarc-dkim) ### Topics - [cisco](https://www.lookingpoint.com/blog/topic/cisco) - [security](https://www.lookingpoint.com/blog/topic/security) - [cybersecurity](https://www.lookingpoint.com/blog/topic/cybersecurity) - [Cisco ISE](https://www.lookingpoint.com/blog/topic/cisco-ise) - [collaboration](https://www.lookingpoint.com/blog/topic/collaboration) - [ISE](https://www.lookingpoint.com/blog/topic/ise) - [webex](https://www.lookingpoint.com/blog/topic/webex) - [IT Solutions](https://www.lookingpoint.com/blog/topic/it-solutions) - [cisco webex](https://www.lookingpoint.com/blog/topic/cisco-webex) - [SD-WAN](https://www.lookingpoint.com/blog/topic/sd-wan) ### Latest Tweets ** ### subscribe to our blog ## Get New Unique Posts ![looking-point_LogoWhite _ Presidio-1](https://www.lookingpoint.com/hubfs/looking-point_LogoWhite%20_%20Presidio-1.svg) 391 Taylor Blvd. Suite 120 Pleasant Hill, California 94523 [Call Us +1 925-566-3480](tel:+19255663480) [sales@lookingpoint.com](mailto:sales@lookingpoint.com) - [**](https://www.facebook.com/lookingpoint?fref=ts) - [**](https://twitter.com/lookingpoint) - [**](https://www.linkedin.com/company/lookingpoint) - [**](https://www.instagram.com/lookingpoint/) SOLUTIONS - [Collaboration](https://www.lookingpoint.com/it-solutions-collaboration) - [ Security](https://www.lookingpoint.com/it-solutions-security) - [Networking ](https://www.lookingpoint.com/it-solutions-networking) - [Cloud](https://www.lookingpoint.com/cloud) - [Data Center ](https://www.lookingpoint.com/data-center) - [Project Management ](https://www.lookingpoint.com/project-management) - [Lifecycle Management](https://www.lookingpoint.com/lifecycle-management-acela) - [Wireless Surveys Assessments](https://www.lookingpoint.com/en-us/wireless-surveys-assessments) MANAGED SERVICES - [Assess and Design](https://www.lookingpoint.com/assess-and-design-it-solutions) - [Deployment](https://www.lookingpoint.com/deployment-it-services-solutions) - [Support](https://www.lookingpoint.com/it-support-services) - [Integration Center](https://www.lookingpoint.com/integration-services) - [Lifecycle Support](https://www.lookingpoint.com/it-lifecycle-support) - [Locations Serviced](https://www.lookingpoint.com/it-consulting-san-francisco-bay-area) - [Customer Success](https://www.lookingpoint.com/services-customer-success) COMPANY - [Contact Us](https://www.lookingpoint.com/contact-us) - [Career](https://www.lookingpoint.com/career) - [About Us](https://www.lookingpoint.com/about-us) - [ FAQ](https://www.lookingpoint.com/faq) - [ Partners](https://www.lookingpoint.com/partner) - [Blog](https://www.lookingpoint.com/blog) - [Privacy Policy](https://www.lookingpoint.com/privacy-policy) - [DO NOT SELL OR SHARE MY PERSONAL INFORMATION](https://na1.hs-data-privacy.com/request/TrvvEe3VpnlESmYolHn3xw) GET IN TOUCH Join our mailing list to stay up to date and get notices about our new releases! Looking Point Inc. 2026 Cookie Settings