No Clocks Vault

Bash - Using dig for Email DNS Analysis

2 min read

Using dig for Email DNS Analysis

Overview

A script to analyze email-related DNS records including MX, SPF, DKIM, and DMARC for a given domain.

Code

#!/usr/bin/env bash
 
# email dns record analysis
 
DOMAIN="${1:-noclocks.dev}"
 
log() {
    echo -e "\n\n$1\n\n"
}
 
log "DNS Records for $DOMAIN"
 
# mx records
log "MX Record(s):"
dig +short MX "$DOMAIN"
 
# spf records
log "SPF Record(s):"
dig +short txt "$DOMAIN" | grep -i "spf"
 
# dkim - google default selector
log "DKIM Keys - Google:"
dig +short txt "google._domainkey.$DOMAIN"
 
# dkim - common selectors
log "DKIM Keys - Other Common Selectors:"
dig +short txt "s1._domainkey.$DOMAIN"
dig +short txt "s2._domainkey.$DOMAIN"
dig +short txt "k1._domainkey.$DOMAIN"
dig +short txt "k2._domainkey.$DOMAIN"
dig +short txt "selector1._domainkey.$DOMAIN"  # microsoft
dig +short txt "selector2._domainkey.$DOMAIN"  # microsoft
 
# dmarc policy
log "DMARC Policy:"
dig +short txt "_dmarc.$DOMAIN"
 
# useful online tools
log "Useful Online Tools:"
echo "https://dmarcian.com/domain-checker/?domain=$DOMAIN"
echo "https://domain-checker.valimail.com/dmarc/$DOMAIN"
echo "https://mxtoolbox.com/SuperTool.aspx?action=mx:$DOMAIN"

Usage

# analyze default domain
./email-dns-check.sh
 
# analyze specific domain
./email-dns-check.sh example.com

Details

Record Types

RecordPurpose
MXMail exchanger - where to deliver email
SPFSender Policy Framework - authorized senders
DKIMDomainKeys - cryptographic email authentication
DMARCDomain-based Message Authentication

Common DKIM Selectors

  • google - Google Workspace
  • selector1, selector2 - Microsoft 365
  • s1, s2 - Various providers
  • k1, k2 - Various providers

Appendix

Note created on 2025-12-23 and last modified on 2025-12-23.

See Also

(c) No Clocks, LLC | 2025

Graph View

Backlinks