DMARCwise normally scans your domains every 3 hours to detect changes in the SMTP TLS reporting (TLSRPT) record, with more frequent scans during the initial setup.

To view the record history, open a domain and select SMTP TLS → History.

The timeline highlights record changes, record counts when more than one record was found, and periods without a TLSRPT record.

Select a validation issues badge to review that version’s errors and warnings, with explanations and suggested fixes. Valid means the displayed record passed syntax validation.

DNS response details

DMARCwise scans your domain’s authoritative nameservers directly instead of going through a public DNS resolver, to see what they publish and whether their answers agree. In the process, CNAME targets that delegate the record to another domain are followed.

To inspect these answers, open DNS details on a record to view the recorded observations and what each nameserver responded with. Note that consecutive identical scans share one observation, extending its duration.

This view helps you investigate the differences when nameservers disagree on a TXT or CNAME record: in this case, you’ll see a Nameservers disagree warning with the differences highlighted in yellow, making it easy to compare the responses and locate the problem.

When a failure or a lookup limit prevented a complete result, you’ll see a Lookup incomplete warning.

DNS details are available for records observed from November 2026.

Not all nameservers are always queried:

  • If a nameserver has only IPv6 addresses, these are not currently queried and the nameserver is marked as skipped.
  • When a domain uses a recognized anycast DNS provider, only one nameserver is queried and the other ones are marked as redundant. Currently, the scanner detects Cloudflare, Amazon Route 53, Azure DNS, Google Cloud DNS, NS1, Bunny DNS, Gcore.
  • When a domain doesn’t exist and the lookup reaches the registry nameservers, only one nameserver is queried and the other ones are marked as redundant.

Multiple records and nameserver disagreements

Publishing multiple TLSRPT records is an invalid configuration. In that situation, the timeline shows one representative record, which usually corresponds to the first record after sorting the DNS answer.

When nameservers disagree, the scanner tries to keep the timeline stable by keeping the current representative record if it still matches. The disagreement opens a TLSRPT record health alert, which stays open until the nameservers agree again.

When a lookup fails or is incomplete, the previous record is preserved and the lookup problem is shown in the DNS details section.