Hello,
I have already found several posts through the search but none was confirmed to work by the OP.
I did setup two records for testing purposes now one for my root and one for the subdomain where the mailserver resides.
TXT _dmarc.mail.mydomain.de "v=DMARC1; p=none; rua=mailto:postmaster@mydomain.de; ruf=mailto:postmaster@mydomain.de; sp=none; ri=86400"
TXT _dmarc.mydomain.de "v=DMARC1; p=none; rua=mailto:postmaster@mydomain.de; ruf=mailto:postmaster@mydomain.de; sp=none; ri=86400"
But when I use DiG on these domains I won’t receive the TXT record.
dig _dmarc.mydomain.de txt
; <<>> DiG 9.20.18-1ubuntu2.1-Ubuntu <<>> _dmarc.mydomain txt
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 23929
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; EDE: 3 (Stale Answer)
;; QUESTION SECTION:
;_dmarc.mydomain. IN TXT
;; AUTHORITY SECTION:
mydomain.de. 149 IN SOA get.desec.io. get.desec.io. 2026083258 86400 3600 2419200 3600
;; Query time: 0 msec
;; SERVER: 172.23.224.1#53(172.23.224.1) (UDP)
;; WHEN: Mon Aug 03 11:45:27 CEST 2026
;; MSG SIZE rcvd: 138
I use the mailserver below which worked fine before I was using deSEC. What caught my eye is, that deSEC doesn’t allow for a . at the end of the record as in _dmarc.example.com.
According to the RFC 7489 it should end with a dot?
I also added a record with only `_dmarc` to test if it works.