--- title: "A guide to detecting DMARC problems using the pentesting techniques | DuoCircle" description: "A guide to detecting DMARC problems using the pentesting techniques." image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/blog/dmarc/a-guide-to-detecting-dmarc-problems-using-the-pentesting-techniques/" --- Quick Answer Penetration testing finds DMARC misconfigurations a static lookup misses. A tester gathers SPF, DKIM, and DMARC records via dig or nslookup, sends spoofed mail to verify alignment, probes weak SPF mechanisms (like +all) and short DKIM keys, then reviews aggregate reports to confirm which failures actually occur in the wild. A guide to detecting DMARC problems using the pentesting techniques Your browser does not support the audio element. [ Download episode](https://media.mailhop.org/duocircle/images/2024/10/A-guide-to-detecting-DMARC-problems-using-the-pentesting-techniques.mp3) Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fdmarc%2Fa-guide-to-detecting-dmarc-problems-using-the-pentesting-techniques%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=A%20guide%20to%20detecting%20DMARC%20problems%20using%20the%20pentesting%20techniques&url=undefined%2Fblog%2Fdmarc%2Fa-guide-to-detecting-dmarc-problems-using-the-pentesting-techniques%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fdmarc%2Fa-guide-to-detecting-dmarc-problems-using-the-pentesting-techniques%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fdmarc%2Fa-guide-to-detecting-dmarc-problems-using-the-pentesting-techniques%2F&title=A%20guide%20to%20detecting%20DMARC%20problems%20using%20the%20pentesting%20techniques "Share on Reddit") [ ](mailto:?subject=A%20guide%20to%20detecting%20DMARC%20problems%20using%20the%20pentesting%20techniques&body=Check out this article: undefined%2Fblog%2Fdmarc%2Fa-guide-to-detecting-dmarc-problems-using-the-pentesting-techniques%2F "Share via Email") ![DMARC problems](https://media.mailhop.org/duocircle/images/2024/10/email-migration-service-8520.jpg) While DMARC has proven its ability to keep spoofing and phishing attacks at a distance, DMARC records can have errors and misconfigurations. So, if you are seeing multiple instances of false positives, false negatives, delivery issues, etc., then it’s suggested that you check your [DMARC record](/resources/create-dmarc-records) to see if it has issues. This can be done by running your DMARC [TXT record](https://en.wikipedia.org/wiki/TXT%5Frecord) through an **online lookup tool**. You can also come across errors and misconfigurations using penetration testing. [Penetration testing](https://www.ibm.com/topics/penetration-testing) (or pen testing for short) is a method to explore vulnerabilities by performing an authorized and strategized simulated cyberattack. Pen testing requires a **professional pen tester** or white-hat hacker who understands your IT system in and out, followed by creating a thorough plan to attack the system. This simulated and strategized [cyberattack](https://www.bbc.com/news/articles/cd7x5q39z77o) helps the pen tester and you know about all the vulnerabilities in the attacked segment. The whole process allows you to patch the vulnerabilities before a threat actor takes advantage of them. In simpler words, you hire a pen tester to break into your system like a malicious actor to know the existing security loopholes and vulnerabilities. Now, in the context of DMARC, pentesting helps you validate the **configuration and effectiveness** of your DMARC record. With the help of a professional pentester, you can uncover potential issues like policy misconfigurations, improper alignment of SPF and DKIM, weaknesses in [DNS records](https://www.cloudflare.com/learning/dns/dns-records/), etc., by allowing them to break into your email system to send [phishing emails](https://www.bleepingcomputer.com/news/security/phishing-emails-abuse-windows-search-protocol-to-push-malicious-scripts/). ## The three DMARC policies Before we talk about how a **pen tester conducts** the test and brings the vulnerabilities to the surface, it’s important that you clearly know about the three [DMARC policies](/dmarc/a-guide-to-advancing-dmarc-policies-for-enhanced-email-deliverability/). When you create a DMARC record, you have to set one of the three DMARC policies- none, quarantine, or reject. The purpose of the set policy is to instruct the **recipients’ servers** on how they should deal with unauthorized and potentially fraudulent emails sent from your domain. The policies are- ### None This policy instructs recipients’ mail servers to handle unauthorized emails as usual. It is basically just for monitoring how your outgoing emails are being handled by different [email service providers](https://www.activecampaign.com/glossary/email-service-provider). You should use the ‘none’ policy only for the new DMARC records. After **2-4 weeks of monitoring**, it’s better to move to stricter policies that prevent email phishing. ### Quarantine The ‘quarantine’ policy is stricter than the **‘none’ policy**. It tells recipients’ servers to mark unauthorized emails sent from your domain as spam. Such emails don’t get placed in the inboxes but in the [spam or junk folders](https://cybernews.com/news/microsofts-breach-notification-emails-end-up-in-spam-folder/). ### Reject The ‘reject’ policy is the strictest, as it tells recipients’ [mail servers](https://www.techtarget.com/whatis/definition/mail-server-mail-transfer-transport-agent-MTA-mail-router-Internet-mailer) to stop such emails from entering the mailboxes. **Emails subjected to the ‘reject’ policy** [bounce back](https://snov.io/blog/email-bounce-back/) to senders. ## The general approach of pen testers for exploring vulnerabilities in a DMARC record Pen testers follow a **structured approach**, leveraging pentesting techniques for email security and proper [DNS configurations](https://phoenixnap.com/kb/dns-configuration). [![securing your email](https://media.mailhop.org/duocircle/images/2024/10/spf-record-tester-1.jpg)](https://media.mailhop.org/duocircle/images/2024/10/spf-record-tester-1.jpg) ### Reconnaissance and information gathering _The first step a pen tester takes involves understanding the current situation of your email-sending domain by gathering information about SPF, DKIM, and DMARC_. They query DNS records using tools like ‘dig,’ ‘nslookup,’ or online platforms to extract the existing [SPF](/resources/what-is-spf), DKIM, and DMARC records. Then, they see which DMARC policy (none, quarantine, or reject) and SPF rules are applied in these records, along with checking the DKIM key. This helps them understand your **domain’s email protection** configuration and condition. ### SPF and DKIM record testing They analyze the [SPF record](/resources/spf-records) to spot vulnerabilities, such as the use of the +all mechanism or not removing an **ex-vendor’s sending source**. For DKIM, they **inspect key lengths** and [signature algorithms](https://fastercapital.com/keyword/digital-signature-algorithms.html) to ensure they meet the best practices. The objective of this step is to come across misconfigurations or weak SPF and DKIM rules that could allow [threat actors](https://thehackernews.com/2024/07/tag-100-new-threat-actor-uses-open.html) to bypass **DMARC protection**. ### Email spoofing and phishing simulation They send fake emails from your domain to different mailboxes, like work or personal accounts, to see if DMARC is doing its job. If these [fake emails](https://www.darkreading.com/cloud-security/disney-nike-ibm-signatures-3m-fake-emails) get through, it means there’s an issue with your **DMARC setup** or how SPF/DKIM is aligned. ### Alignment testing In the fourth step, pen testers check if the domains used in SPF, [DKIM](/resources/what-is-dkim), and the ‘From’ address align correctly, as DMARC requires. They do this by sending emails in which the SPF and DKIM signatures don’t match properly, like when an **email passes SPF** but fails DKIM or the other way around. They also test cases where the domain in the ‘From’ address doesn’t **match the domains** used in SPF or DKIM to see if DMARC is correctly enforcing these checks. ### Review of DMARC reports and logs Pen testers review the recent DMARC aggregate (RUA) and [forensic (RUF) reports](/resources/what-is-ruf) to see if there is any pattern of unauthorized **email sources**. Analyzing these reports also helps them identify unrecognized servers that are sending potentially fraudulent emails on your behalf. By this step, they know the anomalies, if any. \\[![spoofed emails](https://media.mailhop.org/duocircle/images/2024/10/email-migration-service-8521.jpg)](https://media.mailhop.org/duocircle/images/2024/10/email-migration-service-8521.jpg) ### DNS record manipulation testing The pentester attempts to manipulate DMARC records by exploiting **DNS misconfigurations**, such as improper delegation, weak TTL values, or cache poisoning. [DNS-based attacks](https://www.securitymagazine.com/articles/100736-defeating-current-dns-based-attacks) may also include temporarily altering the SPF, DKIM, or DMARC records to allow [spoofed emails](https://www.bbc.com/news/technology-49857948) to pass authentication checks. The outcome of the step is to be able to see if there are any **DNS-related vulnerabilities** that could defy the purpose of DMARC. ### Report and remediation suggestions _Once the pen tester is done with the simulated attack and has spotted all the vulnerabilities, they compile a report_. The report contains all the vulnerabilities they found in the process, along with the recommendations for **fixing vulnerabilities and hardening** the DMARC policy. They might suggest you to use the stricter [DMARC policy](/resources/dmarc-policy) (quarantine or reject) or leverage the ‘pct’ tag (percentage tag). ## Final words A comprehensive **pentesting approach** gives domain owners valuable insights into the exact situation of their [email security](/) posture. We suggest that you don’t limit the pen testing to just the emailing segment. It’s good to extend it to other parts, as [cybersecurity](/phishing-protection/cybersecurity-basics-that-every-first-time-business-owner-should-know/) requires a holistic and multi-angular approach. ## Topics cyber securityDKIMDMARCemail securityspfUpdates ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) Brad Slavin General Manager General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio. ## Secure your email infrastructure Protect, authenticate, and deliver. Contact our team to find the right solution. [Contact Sales](/contact/) [Explore Products](/products/) ## Related Articles [ DMARC 6m DMARC policy explained: p=none, quarantine, reject Nov 22, 2024 ](/blog/dmarc/dmarc-policy-guide-for-beginners/)[ DMARC 6m How are DMARC enforcement and DMARC reporting different? Dec 5, 2024 ](/blog/dmarc/how-are-dmarc-enforcement-and-dmarc-reporting-different/)[ DMARC 6m How to safeguard your online presence with MFA and DMARC? Apr 2, 2025 ](/blog/dmarc/how-to-safeguard-your-online-presence-with-mfa-and-dmarc/)[ DMARC 17m SPF Record Generator: Create Accurate SPF Records for Email Authentication Apr 1, 2025 ](/blog/dmarc/spf-record-generator-create-accurate-spf-records-for-email-authentication/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"A guide to detecting DMARC problems using the pentesting techniques","description":"A guide to detecting DMARC problems using the pentesting techniques.","url":"https://www.duocircle.com/blog/dmarc/a-guide-to-detecting-dmarc-problems-using-the-pentesting-techniques/","datePublished":"2024-10-03T17:33:14.000Z","dateModified":"2025-08-29T14:36:40.000Z","dateCreated":"2024-10-03T17:33:14.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/dmarc/a-guide-to-detecting-dmarc-problems-using-the-pentesting-techniques/"},"articleSection":"dmarc","keywords":"cyber security, DKIM, DMARC, email security, spf, Updates","wordCount":1029,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2024/10/email-migration-service-8520.jpg","caption":"DMARC problems","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"DMARC"},{"@type":"ListItem","position":3,"name":"A guide to detecting DMARC problems using the pentesting techniques","item":"https://www.duocircle.com/blog/dmarc/a-guide-to-detecting-dmarc-problems-using-the-pentesting-techniques/"}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"DMARC","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"A guide to detecting DMARC problems using the pentesting techniques","item":"https://www.duocircle.com/blog/dmarc/a-guide-to-detecting-dmarc-problems-using-the-pentesting-techniques/"}]} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"A guide to detecting DMARC problems using the pentesting techniques","description":"A guide to detecting DMARC problems using the pentesting techniques.","url":"https://www.duocircle.com/blog/dmarc/a-guide-to-detecting-dmarc-problems-using-the-pentesting-techniques/","datePublished":"2024-10-03T17:33:14.000Z","dateModified":"2025-08-29T14:36:40.000Z","dateCreated":"2024-10-03T17:33:14.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/dmarc/a-guide-to-detecting-dmarc-problems-using-the-pentesting-techniques/"},"articleSection":"dmarc","keywords":"cyber security, DKIM, DMARC, email security, spf, Updates","wordCount":1029,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2024/10/email-migration-service-8520.jpg","caption":"DMARC problems","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ```