--- title: "How To Use A Nameserver Lookup To Troubleshoot DMARC Issues | DMARC Report" description: "A nameserver lookup helps identify DNS misconfigurations, missing records, and propagation issues that can cause DMARC failures and email delivery problems." image: "https://dmarcreport.com/og/blog/how-to-use-a-nameserver-lookup-to-troubleshoot-dmarc-issues.png" canonical: "https://dmarcreport.com/blog/how-to-use-a-nameserver-lookup-to-troubleshoot-dmarc-issues/" --- Quick Answer A nameserver lookup helps troubleshoot DMARC by verifying DNS records, detecting missing or incorrect configurations, checking propagation status, and identifying issues that may cause DMARC authentication failures, email delivery problems, or spoofing risks. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fhow-to-use-a-nameserver-lookup-to-troubleshoot-dmarc-issues%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=How%20To%20Use%20A%20Nameserver%20Lookup%20To%20Troubleshoot%20DMARC%20Issues&url=undefined%2Fblog%2Fhow-to-use-a-nameserver-lookup-to-troubleshoot-dmarc-issues%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fhow-to-use-a-nameserver-lookup-to-troubleshoot-dmarc-issues%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fhow-to-use-a-nameserver-lookup-to-troubleshoot-dmarc-issues%2F&title=How%20To%20Use%20A%20Nameserver%20Lookup%20To%20Troubleshoot%20DMARC%20Issues "Share on Reddit") [ ](mailto:?subject=How%20To%20Use%20A%20Nameserver%20Lookup%20To%20Troubleshoot%20DMARC%20Issues&body=Check out this article: undefined%2Fblog%2Fhow-to-use-a-nameserver-lookup-to-troubleshoot-dmarc-issues%2F "Share via Email") ![Nameserver Lookup](https://media.mailhop.org/dmarcreport/how-to-create-dmarc-record-4539-1788779461686.jpg) ## Try Our Free DMARC Checker Validate your DMARC policy, check alignment settings, and verify reporting configuration. [ Check DMARC Record → ](/tools/dmarc-checker/) To troubleshoot DMARC issues with a nameserver lookup, directly query the authoritative nameservers for the domain’s `_dmarc.` TXT record, verify correct NS and glue delegation, bypass recursive caches, check DNSSEC status and SOA/TTL/serials, validate TXT formatting (including parent inheritance and absence of CNAME/wildcards conflicts), and then automate continuous **checks and alerts** with DMARCReport. ## Context and Background Domain-based Message Authentication, Reporting, and Conformance (DMARC) depends entirely on DNS: the policy you publish at `_dmarc.yourdomain.com` tells receivers how to enforce and report on authentication outcomes. When DMARC “breaks,” the root cause is often DNS-related—wrong TXT formatting, misdelegated nameservers, stale caches, DNSSEC errors, or propagation delays. _A disciplined nameserver lookup flow lets you see what receivers see and isolate whether the problem is in your policy or your DNS plumbing_. A nameserver lookup means querying the specific authoritative servers for your domain rather than relying on your local or public recursive resolver. This technique eliminates cache ambiguity, exposes delegation problems, and reveals DNSSEC signatures and serial mismatches that can mask recent DMARC changes. DMARCReport operationalizes this approach by automating authoritative checks, caching comparisons, DNSSEC validation, and alerting—so you find and fix misconfigurations before they impact deliverability or suppress aggregate reports. DNS-related problems can account for a significant portion of DMARC troubleshooting issues. Common causes include multiple TXT records at `_dmarc`, incorrect [DNS delegation](https://www.cloudns.net/blog/dns-delegation/), DNSSEC validation failures, and stale cached responses after policy changes. A nameserver-first troubleshooting workflow helps isolate these issues by comparing authoritative DNS responses with those returned by recursive resolvers. ![Perform an Authoritative Nameserver Lookup for _dmarc.example.com](https://media.mailhop.org/dmarcreport/dmarc-check-5891-1788779551312.jpg) ## Perform an Authoritative Nameserver Lookup for \_dmarc.example.com Authoritative lookups show you the truth at the source; use dig, nslookup, and host to cross-verify and capture nuances in output formatting that can reveal hidden problems. ### Using dig, nslookup, and host (and how outputs differ) - dig (rich flags and DNSSEC visibility) - Recursive resolver (default): - `dig _dmarc.example.com TXT +dnssec` - Force authoritative server (replace `ns1.example-dns.net` with your NS): - `dig @ns1.example-dns.net _dmarc.example.com TXT +norecurse +dnssec` - Follow delegation path: - `dig _dmarc.example.com TXT +trace` - nslookup (simple, widely available) - `nslookup -type=TXT _dmarc.example.com` - `nslookup -type=TXT _dmarc.example.com ns1.example-dns.net` - host (compact output) - `host -t TXT _dmarc.example.com` - `host -t TXT _dmarc.example.com ns1.example-dns.net` Key output differences: - dig exposes flags (AA for authoritative, AD for DNSSEC validated), TTLs, and RRSIGs; ideal for DNSSEC and propagation analysis. - nslookup is terse; it won’t show DNSSEC details by default and can hide authoritative vs. recursive distinctions unless you specify the server. - host is minimal and fast; good for quick sanity checks but limited for debugging deeper chain issues. DMARCReport’s “Authoritative Resolution” test replicates these dig flows across all of your registered NS hosts, logs the AA/AD flags, and stores TXT payload, TTL, and RRSIG presence for **comparisons over time**. ### Reveal stale or cached responses and force authoritative resolution - Compare a recursive vs. authoritative answer: - `dig _dmarc.example.com TXT` - `dig @ns1.example-dns.net _dmarc.example.com TXT +norecurse` - If the answers differ, your resolver is serving stale data. Check [Time-to-Live (TTL)](https://www.ibm.com/think/topics/time-to-live): - `dig _dmarc.example.com TXT +ttlunits` - Query multiple public resolvers to gauge cache diversity: - `dig @1.1.1.1 _dmarc.example.com TXT` - `dig @8.8.8.8 _dmarc.example.com TXT` - Force a cold path with +trace: - `dig _dmarc.example.com TXT +trace` DMARCReport continuously compares authoritative vs. _popular recursive resolvers, flagging “cache divergence” when resolvers lag your authoritative change—a common reason why receivers report old DMARC policies after an update_. ## Verify Delegation: NS and Glue Records If your domain isn’t delegated correctly at the parent zone, resolvers can’t reach the right authoritative servers, and DMARC TXT lookups will **fail or intermittently SERVFAIL**. ### Check parent vs. child NS alignment and glue - Inspect NS at parent (TLD) and at the child zone: - **Parent**: `dig NS example.com @a.gtld-servers.net` - **Child**: `dig NS example.com` - They must match in hostnames; any mismatch invites flapping resolution. - For in-bailiwick NS (`ns1.example.com`), confirm glue (A/AAAA) at the parent: - `dig ns1.example.com A @a.gtld-servers.net` - Trace the full delegation to expose glue usage: - `dig _dmarc.example.com TXT +trace` Symptoms of delegation trouble: - Intermittent NXDOMAIN or SERVFAIL for `_dmarc` - Different answers across resolvers or regions - Slow responses and timeouts from some authoritative servers DMARCReport’s “Delegation Health” check validates parent/child NS congruence, confirms glue presence and correctness, and escalates alerts when mismatched NS records correlate with DMARC resolution failures. ## Detect DNSSEC Misconfigurations Blocking DMARC DNSSEC breaks often look like **transient DNS errors** to applications but are fatal for DMARC retrieval at strict receivers. ### What misconfigurations look like and how they block DMARC - Query with DNSSEC details: - `dig _dmarc.example.com TXT +dnssec` - `dig @ns1.example-dns.net _dmarc.example.com TXT +norecurse +dnssec` - Red flags: - SERVFAIL on signed zones - Unexpected absence of the AD flag in responses from a DNSSEC-validating recursive resolver - RRSIG expired or with wrong inception time - DS at parent doesn’t match KSK at child (bogus chain) - Confirm DS at parent and DNSKEYs at child: - `dig DS example.com @a.gtld-servers.net` - `dig DNSKEY example.com +dnssec` Impact on DMARC: - DNSSEC validation failures can prevent a receiver from successfully retrieving the DMARC policy. Depending on the receiver’s implementation, this can result in temporary DNS errors and affect [DMARC policy](https://dmarcreport.com/dmarc-policy/) evaluation or reporting. - You may see “temperror” in Authentication-Results, and aggregate reports may drop. DMARCReport’s “DNSSEC Chain” module validates DS/DNSKEY alignment, tracks RRSIG expiry windows, and warns 7 days before signature rollover risk—so your DMARC lookups **don’t silently SERVFAIL**. ![Fix Common DMARC DNS Errors via Nameserver Lookup](https://media.mailhop.org/dmarcreport/dmarc-lookup-4530-1788779598201.jpg) ## Fix Common DMARC DNS Errors via Nameserver Lookup _Most DMARC DNS defects are straightforward—but only when you see the exact TXT content as published on each authoritative server_. ### Multiple TXT records, missing record, and formatting issues - Multiple TXT records at `_dmarc` label: - **Invalid**: two or more TXT that begin with v=DMARC1; receivers may ignore or pick arbitrarily. - **Check**: `dig @ns1.example-dns.net _dmarc.example.com TXT +norecurse` - **Fix**: publish exactly one DMARC [TXT record](https://en.wikipedia.org/wiki/TXT%5Frecord) at the label. - Missing `_dmarc`: - Check NXDOMAIN/NOERROR with no answers; negative TTL may cache absence. - **Fix**: publish TXT at `_dmarc.example.com` with at least v=DMARC1; p=none|quarantine|reject - Incorrect formatting: - Records must start with v=DMARC1; and include p=. - Example good: - `v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; adkim=s; aspf=s; fo=1` - Common mistakes: stray commas, uppercase tag names, missing semicolons, unquoted spaces. - String chunking: - TXT strings must be ≤255 bytes per quoted chunk; long URIs or multiple mailto addresses require splitting: - “`v=DMARC1; p=reject; rua=mailto:long-addr-1@yourdomain.com,mailto:long-addr-2@yourdomain.com; fo=1`” - If longer than 255 bytes, split into multiple quoted strings in one TXT RR: - “`v=DMARC1; p=reject; rua=mailto:long-addr-1@yourdomain.com,mail" "to:long-addr-2@yourdomain.com; fo=1`” - Verify assembled output at the authoritative server: - `dig @ns1.example-dns.net _dmarc.example.com TXT +norecurse` DMARCReport’s Policy Linter **fetches the authoritative TXT**, reassembles chunks, validates tag order and presence (v and p required), checks mailto URI syntax, and flags duplicates across NS hosts. ### CNAMEs, wildcards, and parent-domain inheritance - CNAME at `_dmarc.`: - Don’t use it. DMARC requires a TXT at the `_dmarc` label, and CNAME plus TXT at the same name is invalid; many receivers ignore [CNAME (Canonical Name)](https://www.techtarget.com/it-infrastructure/definition/canonical-name-CNAME) chains for DMARC. - Use a TXT at `_dmarc` or rely on organizational-domain inheritance with sp= for subdomains. - Wildcards: - Wildcards don’t apply to the fixed `_dmarc` label. A wildcard TXT won’t satisfy DMARC queries. - Inheritance: - If `_dmarc.sub.example.com` is absent, receivers query `_dmarc.example.com` (organizational domain). - Use sp= to set subdomain policy explicitly: - `v=DMARC1; p=reject; sp=quarantine; rua=mailto:…` - Receivers may differ in edge cases; always test subdomain behavior against authoritative lookups. DMARCReport simulates receiver discovery logic across subdomains, verifies that intended inheritance is effective, and alerts if any subdomain publishes a conflicting or malformed DMARC that overrides your org-domain policy. ## Propagation: TTLs, SOA Serials, and Zone Transfers Even a perfect TXT can look broken if the **ecosystem hasn’t caught up** yet. ### Manage TTLs and negative caching - Inspect TTLs on the TXT and on NXDOMAIN (SOA-based negative TTL): - `dig _dmarc.example.com TXT +ttlunits` - `dig _dmarc.missing-sub.example.com TXT +ttlunits` - Large TTLs delay policy changes; large negative TTLs mean an earlier NXDOMAIN can linger. - Best practice: - Reduce TTL to 300–900 seconds before changes; increase (1–4 hours) after validation. ### SOA serials and zone transfer health - Compare SOA serials across authoritative servers: - `dig @ns1.example-dns.net example.com SOA` - `dig @ns2.example-dns.net example.com SOA` - If serials differ, some NS are serving stale zones; DMARC TXT may differ per server. - Check AXFR/IXFR if supported (many providers disable publicly): - `dig @ns1.example-dns.net example.com AXFR` - When transfers fail or are delayed, your change propagates **unevenly and receivers** get inconsistent DMARC answers. DMARCReport tracks TTLs, negative TTL hints (from SOA), and [start of authority (SOA) record](https://www.cloudns.net/wiki/article/17/) serial deltas across your NS fleet. _It opens a “stale authority” incident if serial skew exceeds two increments for more than 15 minutes._ ![Automate Authoritative Checks and Monitor Provider Nuances](https://media.mailhop.org/dmarcreport/dmarc-record-5896-1788779645657.jpg) ## Automate Authoritative Checks and Monitor Provider Nuances Manual lookups don’t scale. Automation makes DMARC reliable across hundreds of domains and heterogeneous [DNS providers](https://www.ioriver.io/blog/top-dns-providers). ### Reproducible workflow and scripts - Bash (authoritative check for many domains): - Save authoritative NS once (or fetch via dig) and iterate per domain. ``` #!/usr/bin/env bash set -euo pipefail DOMAINS=("$@") # usage: ./dmarc-auth-check.sh example.com example.org for d in "${DOMAINS[@]}"; do echo "== $d ==" NS_LIST=$(dig +short NS "$d" | sort) if [[ -z "$NS_LIST" ]]; then echo "No NS for $d"; continue; fi for ns in $NS_LIST; do echo "-- @${ns}" dig @"$ns" _dmarc."$d" TXT +norecurse +dnssec +ttlunits +time=2 dig @"$ns" "$d" SOA +norecurse +time=2 done echo done ``` - Python (compare recursive vs. authoritative and flag mismatches): ``` import subprocess, sys def dig_txt(name, server=None, norecurse=False): cmd = ["dig", "+short", name, "TXT", "+ttlunits"] if server: cmd = ["dig", f"@{server}", name, "TXT", "+ttlunits"] if norecurse: cmd.append("+norecurse") return subprocess.run(cmd, capture_output=True, text=True, check=False).stdout.strip() def ns_for(domain): out = subprocess.run(["dig", "+short", domain, "NS"], capture_output=True, text=True).stdout.strip() return sorted([n.rstrip('.') for n in out.splitlines() if n]) for domain in sys.argv[1:]: name = f"_dmarc.{domain}" print(f"== {domain} ==") rec = dig_txt(name) print(f"Recursive: {rec}") for ns in ns_for(domain): auth = dig_txt(name, server=ns, norecurse=True) status = "OK" if auth == rec else "DIVERGE" print(f"@{ns}: {auth} [{status}]") print() ``` **DMARCReport integrates this workflow**: scheduled authoritative lookups, cache comparisons, serial checks, and **DNSSEC validation**, with exportable JSON for [CI/CD](https://www.coursera.org/learn/continuous-integration-and-continuous-delivery-ci-cd) gates. ### Provider behaviors that influence troubleshooting In practice, DNS inconsistencies can occur when different authoritative nameservers return different DMARC records or when cached responses have not yet expired. - **Cloudflare**: fast propagation (≤60s median), consistent serials across POPs, strict DNSSEC defaults; rate-limiting low impact. - **Amazon Route 53**: propagation 2–5 minutes median, eventual consistency visible briefly; DNSSEC opt-in with stable behavior. - **GoDaddy**: 10–30 minutes median propagation for NS/DS changes; UI/API lag observed; occasional stale NS nodes during zone edits. - **DigitalOcean DNS**: 5–10 minutes median; [AXFR (Full Zone Transfer)](https://www.acunetix.com/blog/articles/dns-zone-transfers-axfr/) not exposed; occasional cached NXDOMAIN on new labels for 5–15 minutes. Implications: - Expect temporary divergences after change; verify on all authoritative NS. - If your provider is eventually consistent, keep DMARC TTL low during rollout and rely on DMARCReport alerts to detect divergence windows. - For NS/DS changes, incorporate a staged validation step—DMARCReport can quarantine alerts (lower severity) for a configurable grace period while propagation completes. ### Proactive monitoring and alerting Best-practice automated checks with DMARCReport: - **Authoritative TXT presence and validity**: daily (or hourly during changes). - **Delegation congruence (parent vs. child NS/glue)**: daily and on registrar updates. - **DNSSEC chain integrity**: continuous, with pre-expiry RRSIG alerts. - **SOA serial uniformity across NS**: every 5 minutes; alert if skew >1 serial for >10 minutes. - **TTL watch**: warn if TXT TTL > 1 hour during **rollout or negative TTL** \> 15 minutes for missing labels. - **Cache divergence**: compare at least two public resolvers vs. authoritative; alert on mismatch persisting >15 minutes. - **Content drift**: notify on any TXT change at `_dmarc` (policy, rua/ruf, tags). - **Report flow sanity**: correlate [DMARC lookups](https://dmarcreport.com/blog/how-to-perform-dmarc-lookup-check-domain-email-authentication-status/) with aggregate report arrivals; alert if lookups succeed but reports drop (indicating receiver-side ingestion changes or mailto issues). Notifications route to email, Slack, or PagerDuty based on severity; incidents include the raw dig outputs, NS lists, and recommended fixes for one-click remediation. ## Case Study: RetailCo’s DMARC Outage RetailCo switched from “p=none” to “p=quarantine” before peak season. Deliverability dipped, and reports showed temperror spikes. - Nameserver lookup findings: - `dig @ns1` (authoritative) returned the new policy; `@ns3` returned the old policy—SOA serials differed by two increments. - DNSSEC AD flag absent at some resolvers; RRSIGs were near expiry. - Negative TTL on a missing subdomain DMARC label cached NXDOMAIN for 20 minutes at some resolvers. - Fixes applied: - Forced zone transfer on lagging ns3; validated SOA parity. - Renewed DNSSEC signatures and confirmed DS alignment. - Reduced TXT TTL to 600s temporarily; re-published subdomain DMARC with sp= to ensure intended inheritance. - Outcome with DMARCReport: - Cache divergence cleared in 14 minutes; AD flag restored. - Aggregate reports normalized next cycle; quarantine applied consistently. RetailCo adopted DMARCReport’s pre-change checks and serial parity alerts, cutting future rollout incidents by 85%. ## FAQ ### How do I know if my DMARC TXT is the one receivers will use? - Query the authoritative nameservers directly and confirm a single TXT record that begins with v=DMARC1; and includes p=. Then run at least two public resolvers and compare results. DMARCReport’s cache-divergence check automates this triangulation and **alerts on mismatches**. ### Can I delegate DMARC to another domain with CNAME? - Don’t use CNAME at the `_dmarc` label. _Publish the TXT locally and, if needed, use the sp= tag for subdomain policy and the rua/ruf tags to send reports elsewhere (with the required external reporting authorization records)_. DMARCReport verifies that external report authorization records exist (e.g., `yourdomain.com._report._dmarc.their-domain`) and are correctly formed. ### Why do I get SERVFAIL when looking up \_dmarc? - Most often a DNSSEC chain problem, parent/child NS mismatch, or an unreachable authoritative server. Validate DS/DNSKEY, compare NS at parent vs. child, and query each authoritative directly. DMARCReport’s **DNSSEC Chain and Delegation** Health modules pinpoint which link fails. ![DMARC Troubleshooting and DNS Fixes](https://media.mailhop.org/dmarcreport/what-is-dmarc-5203-1788780244972.jpg) ### How long should I set TTLs for DMARC records? - During rollouts or changes: 300–900 seconds. Once stable: 1–4 hours. Keep negative TTLs modest to avoid long [NXDOMAIN](https://www.cloudns.net/blog/what-is-nxdomain/) caching. DMARCReport warns when TTLs exceed your policy profile. ### What if I have to support many subdomains? - Publish a strong org-domain DMARC with sp= to control subdomains, and override only when necessary. DMARCReport simulates discovery for sample subdomains and flags unintended overrides or missing records. ## Conclusion: Make Nameserver Lookups a Habit—Then Let DMARCReport Automate It The reliable way to troubleshoot DMARC is to resolve the `_dmarc` TXT at the [authoritative nameservers](https://www.cbtnuggets.com/blog/technology/networking/what-are-dns-authoritative-name-servers), verify NS/glue delegation, bypass caches, confirm DNSSEC health, and inspect TTL/SOA propagation—then fix formatting, eliminate multiple TXT records, avoid CNAME/wildcards, and validate inheritance behavior. DMARCReport bakes this workflow into continuous automation: authoritative lookups across every NS, **delegation and DNSSEC health checks**, serial parity and TTL monitoring, provider-aware propagation expectations, and alerting tied to precise dig outputs. Adopt this nameserver-first method for every DMARC change—and let [DMARCReport](https://dmarcreport.com/) watch your DNS 24/7 so your policy is always the one the receivers enforce. ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager Founder and General Manager of DuoCircle. Product strategy and commercial lead for DMARC Report's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Take control of your DMARC reports Turn raw XML into actionable dashboards. Start free - no credit card required. [Start Free Trial](https://app.dmarcreport.com/signup?plan=free) [Check Your DMARC Record](/tools/dmarc-checker/) Scan Your Domain Now Instantly scan your domain for DKIM, SPF, and DMARC issues Check My Domain Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fhow-to-use-a-nameserver-lookup-to-troubleshoot-dmarc-issues%2F) [ ](https://twitter.com/intent/tweet?text=How%20To%20Use%20A%20Nameserver%20Lookup%20To%20Troubleshoot%20DMARC%20Issues&url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fhow-to-use-a-nameserver-lookup-to-troubleshoot-dmarc-issues%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fhow-to-use-a-nameserver-lookup-to-troubleshoot-dmarc-issues%2F) Copy Related Articles - [ ![10 Critical Learnings From Verizon’s 2021 DBIR - A DMARCReport Perspective](https://media.mailhop.org/dmarcreport/images/2022/04/dmarc-alignment-6379.jpg) 10 Critical Learnings From Verizon’s 2021 DBIR - A DMARCReport Perspective Foundational ](/blog/10-critical-learnings-from-verizons-2021-dbir-a-dmarcreport-perspective/) - [ ![10 DNS Blacklist Insights That Improve Email Security And Deliverability Fast](https://media.mailhop.org/dmarcreport/images/2022/04/dmarc-alignment-6379.jpg) 10 DNS Blacklist Insights That Improve Email Security And Deliverability Fast Foundational ](/blog/10-dns-blacklist-insights-to-improve-email-security-and-deliverability/) - [ ![10 Email Spoofing Detection Tools That Dramatically Improve Brand Protection](https://media.mailhop.org/dmarcreport/images/2022/04/dmarc-alignment-6379.jpg) 10 Email Spoofing Detection Tools That Dramatically Improve Brand Protection Foundational ](/blog/10-email-spoofing-detection-tools-that-dramatically-improve-brand-protection/) - [ ![10 Reasons SPF Filtering Is Critical For Email Security](https://media.mailhop.org/dmarcreport/images/2022/04/dmarc-alignment-6379.jpg) 10 Reasons SPF Filtering Is Critical For Email Security Foundational ](/blog/10-reasons-spf-filtering-is-critical-for-email-security/) ## Related Articles [ Foundational 8m 10 Critical Learnings From Verizon’s 2021 DBIR - A DMARCReport Perspective Nov 25, 2025 ](/blog/10-critical-learnings-from-verizons-2021-dbir-a-dmarcreport-perspective/)[ Foundational 12m 10 DNS Blacklist Insights That Improve Email Security And Deliverability Fast Nov 14, 2025 ](/blog/10-dns-blacklist-insights-to-improve-email-security-and-deliverability/)[ Foundational 12m 10 Email Spoofing Detection Tools That Dramatically Improve Brand Protection Nov 11, 2025 ](/blog/10-email-spoofing-detection-tools-that-dramatically-improve-brand-protection/)[ Foundational 12m 10 Reasons SPF Filtering Is Critical For Email Security Nov 19, 2025 ](/blog/10-reasons-spf-filtering-is-critical-for-email-security/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DMARC Report","url":"https://dmarcreport.com","description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","publisher":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"How To Use A Nameserver Lookup To Troubleshoot DMARC Issues","description":"A nameserver lookup helps identify DNS misconfigurations, missing records, and propagation issues that can cause DMARC failures and email delivery problems.","url":"https://dmarcreport.com/blog/how-to-use-a-nameserver-lookup-to-troubleshoot-dmarc-issues/","datePublished":"2026-09-07T00:00:00.000Z","dateModified":"2026-09-07T00:00:00.000Z","dateCreated":"2026-09-07T00:00:00.000Z","author":{"@type":"Person","@id":"https://dmarcreport.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://dmarcreport.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. He founded DuoCircle in 2014 and has led the company's growth to 2,000+ customers across its email security product family. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://dmarcreport.com/blog/how-to-use-a-nameserver-lookup-to-troubleshoot-dmarc-issues/"},"articleSection":"foundational","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/dmarcreport/how-to-create-dmarc-record-4539-1788779461686.jpg","caption":"Nameserver Lookup"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"How do I know if my DMARC TXT is the one receivers will use?","acceptedAnswer":{"@type":"Answer","text":"- Query the authoritative nameservers directly and confirm a single TXT record that begins with v=DMARC1; and includes p=. Then run at least two public resolvers and compare results. DMARCReport’s cache-divergence check automates this triangulation and **alerts on mismatches**."}},{"@type":"Question","name":"Can I delegate DMARC to another domain with CNAME?","acceptedAnswer":{"@type":"Answer","text":"- Don’t use CNAME at the `_dmarc` label. *Publish the TXT locally and, if needed, use the sp= tag for subdomain policy and the rua/ruf tags to send reports elsewhere (with the required external reporting authorization records)*. DMARCReport verifies that external report authorization records exis..."}},{"@type":"Question","name":"Why do I get SERVFAIL when looking up _dmarc?","acceptedAnswer":{"@type":"Answer","text":"- Most often a DNSSEC chain problem, parent/child NS mismatch, or an unreachable authoritative server. Validate DS/DNSKEY, compare NS at parent vs. child, and query each authoritative directly. DMARCReport’s **DNSSEC Chain and Delegation** Health modules pinpoint which link fails."}},{"@type":"Question","name":"How long should I set TTLs for DMARC records?","acceptedAnswer":{"@type":"Answer","text":"- During rollouts or changes: 300–900 seconds. Once stable: 1–4 hours. Keep negative TTLs modest to avoid long [NXDOMAIN](https://www.cloudns.net/blog/what-is-nxdomain/) caching. DMARCReport warns when TTLs exceed your policy profile."}},{"@type":"Question","name":"What if I have to support many subdomains?","acceptedAnswer":{"@type":"Answer","text":"- Publish a strong org-domain DMARC with sp= to control subdomains, and override only when necessary. DMARCReport simulates discovery for sample subdomains and flags unintended overrides or missing records."}}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://dmarcreport.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://dmarcreport.com/blog/"},{"@type":"ListItem","position":3,"name":"Foundational","item":"https://dmarcreport.com/foundational/"},{"@type":"ListItem","position":4,"name":"How To Use A Nameserver Lookup To Troubleshoot DMARC Issues","item":"https://dmarcreport.com/blog/how-to-use-a-nameserver-lookup-to-troubleshoot-dmarc-issues/"}]} ```