How to Verify DNS Records Domain Online: MX, SPF, DKIM & DMARC

Knowing how to verify dns records domain online is a critical technical skill for system administrators, cybersecurity engineers, and web developers. The Domain Name System (DNS) is the backbone of the internet, mapping human-readable domain names like tecnocrypter.com into numerical IP addresses. Beyond basic website resolution, properly configured DNS records govern whether corporate emails reach inboxes or get blocked by anti-phishing filters.

In this technical guide, we will break down core DNS record types, analyze the email security triad (SPF, DKIM, DMARC), explore modern brand protection protocols like BIMI and VMC, troubleshoot resolution failures, inspect reverse DNS PTR requirements, and demonstrate automated verification scripts.

---

Anatomy of Fundamental DNS Records

DNS records are configuration entries hosted on authoritative domain name servers. Each record type fulfills a distinct networking role within domain resolution:

• A Record (Address): Maps a hostname to a 32-bit IPv4 address (e.g., 192.0.2.1).
• AAAA Record: Maps a hostname to a 128-bit IPv6 address.
• CNAME Record (Canonical Name): Creates an alias pointing one domain name to another target domain.
• MX Record (Mail Exchange): Specifies mail servers authorized to accept incoming email for the domain, along with priority values.
• TXT Record (Text): Holds machine-readable plain text data. Used for security authentication (SPF, DKIM, DMARC) and domain ownership verification.
• NS Record (Name Server): Identifies authoritative name servers managing the DNS zone.
• PTR Record (Pointer): Maps an IP address back to a hostname (Reverse DNS), critical for outbound mail server validation.
• SOA Record (Start of Authority): Contains key zone administration parameters including primary name server, admin contact email, and zone refresh timers.

---

The Email Security Triad: SPF, DKIM, and DMARC

To combat email spoofing and phishing attacks, internet standards mandate three complementary protocols based on DNS TXT records:

1. SPF (Sender Policy Framework - RFC 7208)

SPF allows a domain owner to publish an authorized list of IP addresses permitted to send email on behalf of the domain.

• Sample SPF TXT Record:

  v=spf1 ip4:192.0.2.0/24 include:_spf.google.com ~all
  

2. DKIM (DomainKeys Identified Mail - RFC 6376)

DKIM attaches an asymmetric cryptographic signature to email headers. The sending mail server signs messages using a private key, while receiving servers verify authenticity using the public key published in a DNS TXT record (DKIM selector).

3. DMARC (Domain-based Message Authentication - RFC 7489)

DMARC connects SPF and DKIM, instructing receiving mail servers how to handle emails that fail authentication (none, quarantine, or reject):

• Sample DMARC TXT Record (_dmarc.domain.com):

  v=DMARC1; p=reject; rua=mailto:[email protected]; pct=100
  

---

Brand Protection Standards: BIMI and VMC Certificates

Beyond basic authentication, enterprise security mandates BIMI (Brand Indicators for Message Identification). BIMI allows verified corporate brand logos to appear alongside emails in recipient inboxes (Gmail, Apple Mail, Yahoo).

BIMI requires:

1. Enforced DMARC policy set to p=quarantine or p=reject.
2. A DNS TXT record configured at default._bimi.yourdomain.com.
3. A Verified Mark Certificate (VMC) issued by an accredited Certificate Authority like DigiCert.

---

Reverse DNS (PTR Records) and FCrDNS Compliance

While MX, SPF, and DMARC manage inbound and domain authentication rules, PTR records (Pointer Records) handle reverse DNS verification. When your mail transfer agent (MTA) connects to an external mailbox provider, the receiving server performs a Forward-Confirmed Reverse DNS (FCrDNS) check:

1. Resolves the sending server's IP address to a hostname via PTR record query.
2. Resolves that hostname back to an IP address via A record query.
3. Verifies that both IP addresses match identically.

Failing an FCrDNS lookup results in immediate rejection by major enterprise security gateways like Microsoft Exchange Online and Proofpoint.

---

Troubleshooting Common DNS Resolution Failures

When performing DNS record lookups during system outages, administrators frequently encounter standardized DNS error codes:

• NXDOMAIN (Non-Existent Domain): The queried domain name does not exist in the public DNS hierarchy or has expired.
• SERVFAIL (Server Failure): The authoritative DNS server failed to respond or encountered DNSSEC validation errors.
• REFUSED: The target DNS server refused to process the query due to access control lists (ACLs) or rate limiting.
• TIMEOUT: The DNS resolver failed to receive a response within the configured socket timeout window.

---

Verifying DNS Records via Python and CLI

Regularly auditing your DNS zone prevents mail delivery failures and service outages.

Automated DNS Audit in Python with dnspython

The Python script below queries MX, SPF, and DMARC records for any specified domain:

import dns.resolver

def audit_dns_records(domain_name: str) -> None:
    """
    Queries and audits MX, SPF, and DMARC DNS records for a given domain.
    """
    print(f"=== DNS Audit Report for: {domain_name} ===")
    
    # Query MX Records
    try:
        mx_answers = dns.resolver.resolve(domain_name, 'MX')
        print("
📬 MX Records (Mail Servers):")
        for mx in mx_answers:
            print(f"   Priority: {mx.preference} -> Host: {mx.exchange}")
    except Exception as err:
        print(f"❌ MX Lookup error or missing records: {err}")

    # Query SPF TXT Record
    try:
        txt_answers = dns.resolver.resolve(domain_name, 'TXT')
        print("
🛡️ SPF Record:")
        found_spf = False
        for txt in txt_answers:
            txt_str = str(txt)
            if "v=spf1" in txt_str:
                print(f"   {txt_str}")
                found_spf = True
        if not found_spf:
            print("   ⚠️ Valid SPF record not found.")
    except Exception as err:
        print(f"❌ TXT/SPF Lookup error: {err}")

    # Query DMARC Record
    try:
        dmarc_domain = f"_dmarc.{domain_name}"
        dmarc_answers = dns.resolver.resolve(dmarc_domain, 'TXT')
        print("
🔒 DMARC Record:")
        for txt in dmarc_answers:
            print(f"   {str(txt)}")
    except Exception as err:
        print(f"⚠️ DMARC Record missing at {dmarc_domain}: {err}")

audit_dns_records("tecnocrypter.com")

Command-Line DNS Queries with dig

On Linux/macOS terminals, use dig to perform DNS queries:

# Query A IPv4 Address Record
dig +short tecnocrypter.com A

# Query MX Mail Exchange Records
dig +short tecnocrypter.com MX

# Query SPF Record
dig +short tecnocrypter.com TXT

# Query DMARC Record Policy
dig +short _dmarc.tecnocrypter.com TXT

---

Comparison Table: Email Security Protocols

Protocol	Control Mechanism	DNS Record Type	Prevents Spoofing	Uses Cryptographic Keys
SPF	Authorized IP Whitelist	TXT (v=spf1...)	Partial	No
DKIM	Digital Header Signature	TXT (selector._domainkey)	Partial	Yes (Public/Private Key)
DMARC	Policy & Aggregated Reports	TXT (_dmarc.domain)	Full	No (Evaluates SPF/DKIM)
BIMI	Displays Brand Logo	TXT (default._bimi)	Visual	Requires VMC Certificate

---

Instant DNS Inspection with TecnoCrypter

Running manual command-line lookups can be slow when diagnosing live email deliverability issues across global resolvers.

TecnoCrypter created the DNS Verifier tool to inspect A, AAAA, MX, CNAME, TXT, SPF, and DMARC records instantly. Also check out our Email Header Analyzer and our analysis on DNS Zero-Day Attacks.

---

Strategic Recommendations & Best Practices

1. Enforce DMARC Rejection Policy (p=reject): Transition from p=none to p=quarantine and eventually p=reject to block unauthorized mail.
2. Lower TTL Before Infrastructure Migration: Reduce TTL values to 300 seconds 48 hours prior to DNS updates to speed up global propagation.
3. Avoid Exceeding 10 DNS Lookup Limit in SPF: The SPF specification restricts lookups to 10 DNS mechanisms. Exceeding this limit causes an SPF PermError.

---

Conclusion

Regular DNS auditing and proper implementation of SPF, DKIM, and DMARC records form the foundation of email security and domain reputation management.

Use our free online DNS Verifier to audit your domain status in real time. Read our guide on Analyzing Email Headers for more email security insights.

---

References & Authoritative Sources:

• IETF SPF Specification: RFC 7208 - Sender Policy Framework.
• IETF DKIM Specification: RFC 6376 - DomainKeys Identified Mail.
• IETF DMARC Specification: RFC 7489 - Domain-based Message Authentication.