Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a method to find a domain's DKIM and DMARC records using dig or nslookup?

I have attempted to do the following:

dig any

returns many records, but not the known DKIM and DMARC text records.

nslookup -type=txt

returns all the text records known except the DKIM and DMARC records.

share|improve this question
DKIM records are applied to arbitrary subdomains (Google Apps uses that you'd have to know/guess to look for. – ceejayoz Aug 29 '14 at 15:38
It depends on the selector prefix used, part of the DKIM header in a signed email – Mathias R. Jessen Aug 29 '14 at 15:57
up vote 16 down vote accepted

To query the TXT record for DMARC, you can use:

dig TXT

To query for a particular record for DKIM, you would need to know the selector prefix. You would then query it as TXT (for example with a google one):

dig TXT
share|improve this answer
Worth mentioning is that in the DKIM-Signature header the selector name is found in the s= value. – andol Aug 29 '14 at 16:50

For DKIM records, if you have received a DKIM-signed email from that domain, look at the DKIM-Signature header line(s).

From the spec:

All DKIM keys are stored in a subdomain named _domainkey. Given a DKIM-Signature field with a "d=" tag of and an "s=" tag of, the DNS query will be for

So in this example, you can then run:

dig TXT

Credit to andol, whose comment led me to this solution.

share|improve this answer

Using Windows built-in tool nslookup

  1. Open Command Prompt (cmd.exe)
  2. Enter nslookup
  3. Enter set type=txt
  4. Enter, replace



Default Server:  localdns

> set type=txt


Non-authoritative answer: text =

    "v=DMARC1; p=none;"

You may use server (Google DNS) before lookup DMARC TXT record.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.