auth.dmarc.lookup_error
DMARC DNS Lookup Failed
What we check
We query DNS for a TXT record at _dmarc.<domain>. This finding is emitted when the lookup returned an error — a timeout or server failure — rather than a definitive answer, so DMARC status is indeterminate.
What this finding means
A DMARC DNS query didn't complete. This isn't a statement that DMARC is missing or misconfigured — the scanner simply couldn't get a clean answer during this run. Your policy may be published and working; the lookup just failed transiently.
Why it matters
- Usually transient. A one-off timeout typically clears by itself. If it recurs, it points at DNS reliability at the servers authoritative for
_dmarc.<domain>rather than a DMARC problem. - Can affect real evaluation. If receivers hit the same failure, DMARC evaluation is deferred — which can delay disposition and reporting.
- Not a scored fault. Because it's an availability issue, not a configuration defect, it doesn't count against your grade.
How to fix
Re-scan. A transient lookup failure usually won't reproduce.
If it persists, check DNS availability for
_dmarc.<domain>— confirm the authoritative servers answer reliably and aren't rate-limiting:dig +short TXT _dmarc.example.com
How it's graded
A DMARC lookup failure is a warning and carries no point deduction — the result is indeterminate, not a defect. See Grading Methodology for the full scoring model.
Evidence example
$ dig TXT _dmarc.example.com
;; connection timed out; no servers could be reached
DMARC status: indeterminate (DNS lookup failed)