There is a way to retrieve ALL (TXT) entries about DNS records of a domain (and subdomains) ?
My goal is to verify the configuration of my domain: www.rosposhop.com where I correctly set multiple SPF and DKIM records for some subdomains
rosposhop.com
md.rosposhop.com (SPF+DKIM)
mg.rosposhop.com (SPF+DKIM)
(so I have a total of 5 TXT items)
Now, if I ask with dig
or host -a
, I got only the first TXT item, instead I was expected to have the complete list of TXT items.
Whre I'm wrong ?
$ dig rosposhop.com TXT
; <<>> DiG 9.9.5-3ubuntu0.1-Ubuntu <<>> rosposhop.com TXT
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14774
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;rosposhop.com. IN TXT
;; ANSWER SECTION:
rosposhop.com. 2362 IN TXT "google-site-verification=udcP944OqB1PldDn1ML"
;; Query time: 65 msec
;; SERVER: ***********
;; WHEN: Sat Dec 27 09:10:43 CET 2014
;; MSG SIZE rcvd: 123
BTW, if I ask puntually for a SUBdomain, now I got again only the first entry:
$ dig md.rosposhop.com TXT
return:
;; ANSWER SECTION:
md.rosposhop.com. 2223 IN TXT "v=spf1 include:spf.man*******"
again I don't get the DKIM info. It's a security/permissions topic ? sorry for my DNS-ignorance.
thanks giorgio
The approach of making a single DNS query to get all that information in one fell swoop is misguided. It assumes that the data for a single zone is a) static and b) managed by a single name server. DNS imposes no such limitations on zone data.
Both SPF and DKIM (and DMARC, if you want to throw that in the mix) use TXT records on specific domains. There is no need to get all the TXT records for a domain and its subdomains to view the relevant configuration.
If you want to get the SPF and DKIM information, just query the appropriate domains. Assuming you're doing Return-Path domains and DKIM signatures on md.rosposhop.com
and mg.rosposhop.com
then you should be interested in TXT records on
md.rosposhop.com
- SPFmg.rosposhop.com
- SPF(selector)._domainkey.md.rosposhop.com
- DKIM(selector)._domainkey.mg.rosposhop.com
- DKIMwhere (selector) is the selector you're using for that DKIM record. You may have more than one selector for each of md.rosposhop.com
and mg.rosposhop.com
domains. TXT records on other domains are irrelevant.