DMARC DNS baseline — Tiago S. Carvalho
Version: 1.0 | 30 October 2026

PURPOSE
A read-only Windows PowerShell collector for public DNS evidence. No sign-in,
administrator session, DNS writes, mailbox access or message sending is required.

RUN
1. Extract this ZIP into a local folder.
2. Open and review Get-DmarcDnsBaseline.ps1 before running it.
3. In Windows PowerShell, change to that folder and use your OWN sending domain:

   .\Get-DmarcDnsBaseline.ps1 -Domain lab.contoso.com

4. To keep JSON evidence, choose a new file name:

   .\Get-DmarcDnsBaseline.ps1 -Domain lab.contoso.com -Server 1.1.1.1 -OutputPath .\baseline-recursive.json

5. Discover the authoritative servers for the hosting zone:

   Resolve-DnsName contoso.com -Type NS -DnsOnly

6. Run the same collector with -Server set to each authoritative server returned.
   For a delegated subdomain, identify the authoritative servers for that zone.
   Authoritative servers can refuse unrelated recursion; retain such errors.

If local policy blocks scripts, follow your organization's approved procedure.
This kit does not ask you to bypass execution policy.

INTERPRETATION
MultipleCandidates_ReviewRequired: more than one matching TXT resource record.
OneCandidate_NotSyntaxValidated: one candidate, NOT proof that its syntax is valid.
NoCandidateAtQueriedName: no matching candidate in a successful response.
UnknownDueToQueryFailure: retain the error and investigate; do not mark as passed.

A single TXT record may have several strings. The script joins strings within
that record only. It never merges separate policy records.
Review all raw Query records, including malformed policies that did not match
the candidate prefix. For subdomains, no direct DMARC answer does NOT establish
that there is no inherited policy.

LIMITS
This is not an authentication or delivery test. It does not validate the complete
SPF lookup tree, DMARC tags, inherited policies, report authorization, DKIM keys
or message headers. Other providers can use TXT keys or different selectors.
The output may contain operational domain names and report addresses. Keep raw
evidence private and redact before publication.

BEFORE ENFORCEMENT
[ ] Every legitimate sender has an owner and an observed path.
[ ] One intended DMARC record; authoritative and recursive answers reviewed.
[ ] Fresh external headers show aligned authentication for each sending stream.
[ ] Report receipt and reporting period verified.
[ ] Controlled positive and negative tests documented for owned test accounts.
[ ] Recipient handling, exceptions and routing understood.
[ ] Prior DNS value, TTL, rollback owner and change window recorded.
[ ] Promotion approved against evidence, not simply elapsed days.

Reference:
https://learn.microsoft.com/en-us/powershell/module/dnsclient/resolve-dnsname

See the accompanying article for the rollout procedure and Microsoft references.
