Can't get DMARC to work

Managed DNS Hosting
1

Hello,

I have already found several posts through the search but none was confirmed to work by the OP.

I did setup two records for testing purposes now one for my root and one for the subdomain where the mailserver resides.

TXT _dmarc.mail.mydomain.de "v=DMARC1; p=none; rua=mailto:postmaster@mydomain.de; ruf=mailto:postmaster@mydomain.de; sp=none; ri=86400"

TXT _dmarc.mydomain.de "v=DMARC1; p=none; rua=mailto:postmaster@mydomain.de; ruf=mailto:postmaster@mydomain.de; sp=none; ri=86400"

But when I use DiG on these domains I won’t receive the TXT record.

dig _dmarc.mydomain.de txt

; <<>> DiG 9.20.18-1ubuntu2.1-Ubuntu <<>> _dmarc.mydomain txt
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 23929
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; EDE: 3 (Stale Answer)
;; QUESTION SECTION:
;_dmarc.mydomain.     IN      TXT

;; AUTHORITY SECTION:
mydomain.de.     149     IN      SOA     get.desec.io. get.desec.io. 2026083258 86400 3600 2419200 3600

;; Query time: 0 msec
;; SERVER: 172.23.224.1#53(172.23.224.1) (UDP)
;; WHEN: Mon Aug 03 11:45:27 CEST 2026
;; MSG SIZE  rcvd: 138

I use the mailserver below which worked fine before I was using deSEC. What caught my eye is, that deSEC doesn’t allow for a . at the end of the record as in _dmarc.example.com.

According to the RFC 7489 it should end with a dot?

I also added a record with only `_dmarc` to test if it works.

2

Seems like it works now, I’m gonna play around with the records and write the working one below.

TXT _dmarc "v=DMARC1; p=none; rua=mailto:postmaster@mydomain.de; ruf=mailto:postmaster@mydomain.de; sp=none; ri=86400"
3

Two notes. RFC7489 is deprecated and replaced by RFC9989. The ri tag has been deprecated in RFC9989, so you should remove it from the record (and nearly no provider honored it anyway). I also would not use an sp=none unless you need to define a separate policy. It will inherit the p= policy by default.