TXT Record Lookup
View all TXT DNS records for a domain — including SPF, DKIM, DMARC, domain verification, and ownership tokens.
Did this tool work for you?
How to use this calculator
- 1
Enter the domain name you want to check.
- 2
Click "Check Now" to retrieve all TXT records.
- 3
Results show all TXT records including SPF, DKIM keys, DMARC policy, and verification tokens.
Frequently asked questions
What does the table show?
One row per TXT record at the exact name you entered, with Name, Value and TTL, and a "Records found" count. Quotation marks are removed. When a record was published in several quoted pieces, the pieces are joined end to end with nothing between them, which is how SPF and DKIM readers reassemble long values.
Why do I see only some of the records I expect?
TXT records live at specific names, and this tool reads only the one you type. SPF and most verification tokens sit on the bare domain (example.com). DMARC sits at _dmarc.example.com, and DKIM keys at selector._domainkey.example.com, where selector is chosen by your mail provider. Enter those full names to see them. The tool cannot discover DKIM selectors for you.
How do I recognise an SPF record in the list?
It is the value beginning v=spf1. A domain should publish only one; two separate v=spf1 records cause SPF to fail with a permanent error (RFC 7208). The same standard caps the number of DNS-querying terms (include, a, mx and similar) at 10 per check. This lookup shows the raw text and does not count lookups or validate it; use the SPF Record Checker for that.
What are DKIM and DMARC records in this output?
A DKIM record at selector._domainkey.<domain> is a value starting v=DKIM1 that holds a public key used to verify message signatures (RFC 6376). A DMARC record at _dmarc.<domain> starts with v=DMARC1 and states a policy for mail that fails authentication (RFC 7489). The DKIM Record Checker and DMARC Record Checker go further than a raw lookup.
What are the strange strings starting with google-site-verification= and similar?
They are ownership tokens. Services such as Google Search Console and other platforms ask you to publish a specific TXT value to prove control of the domain, then read it from DNS. Each service has its own prefix. Removing one after verification can make the service lose access, so check before cleaning up old records.
Can a TXT value be longer than 255 characters?
A single character-string inside a TXT record is limited to 255 bytes, but a record can hold several strings, which is how 2048-bit DKIM keys fit. DNS hosts show or accept these differently: some split automatically, some need you to enter the pieces. This tool shows them joined as one value.
Does the order of the rows mean anything?
No. DNS does not guarantee the order of records within a set, and resolvers may rotate them, so the same domain can list its rows in a different order between lookups.
What if the result says no TXT records were found?
Either the name has none or the name does not exist; this tool does not separate the two. To tell them apart, run the same name through the DNS Lookup, which shows a Status line with NXDOMAIN for a missing name.
Reading the TXT records published for a domain
Where TXT records are published
A TXT record attaches free text to a DNS name, and email authentication and domain verification both depend on it. What matters is which name holds the record. This tool queries one name per lookup through Cloudflare’s public resolver and lists every TXT value it returns, which is why the names below must be typed in full to see the record you want.
| Record | Name to enter | Value begins |
|---|---|---|
| SPF | example.com | v=spf1 |
| DMARC | _dmarc.example.com | v=DMARC1 |
| DKIM | selector._domainkey.example.com | v=DKIM1 |
| Site verification | example.com | service-specific prefix, e.g. google-site-verification= |
Example inputs and what to look for
Looking up example.com typically returns a handful of rows: the SPF policy, one or more verification tokens, and perhaps vendor-specific entries. Check that there is exactly one v=spf1 row, that its include: entries match the services you actually send mail from, and that old tokens for decommissioned services can be identified. Looking up _dmarc.example.com should return one row starting v=DMARC1, whose p= tag gives the policy. The values depend on live DNS, so these are descriptions of what to check rather than stored output.
Quotes, splits and long values
DNS stores a TXT value as one or more strings of up to 255 bytes each. DNS hosts display them differently, sometimes as separate quoted chunks. This tool removes the quotation marks and joins the chunks with no separator, so a long DKIM public key appears as a single continuous value, which is what receiving servers do. If a value looks cut off or has stray spaces, the problem is in how it was entered at the DNS host.
Typical problems
Duplicate SPF records are the most common: two v=spf1 rows must be merged into one. Next is a missing or misplaced name, such as a DMARC record created at the root instead of _dmarc. Long records truncated by a control panel and tokens pasted with extra quotes also show up here. After any change, compare the TTL column with the time elapsed, because the resolver may still hold the earlier set, and the web service adds a 60-second cache of its own.
What this tool does not do
It displays records but does not validate them. It does not count SPF lookups, check DKIM key strength, evaluate DMARC alignment or test actual mail delivery. It queries one resolver, does not discover DKIM selectors and does not show records on other names unless you type them. For analysis, the SPF, DKIM and DMARC checkers go further, and for other record types the DNS Lookup covers them.
Learn more from an authoritative source:
MDN Web DocsSPF Record Checker
Validate the SPF (Sender Policy Framework) record for any domain and understand its email authentication policy.
DKIM Record Checker
Look up and validate the DKIM (DomainKeys Identified Mail) public key record for a domain and selector.
DMARC Record Checker
Check and analyse the DMARC policy for any domain to understand how email authentication failures are handled.
DNS Propagation Checker
Check whether your DNS changes have propagated across Cloudflare, Google, and Quad9 resolvers worldwide.
SSL Certificate Checker
Inspect the SSL/TLS certificate for any domain — view issuer, expiry date, SANs, and days remaining.
Domain Age Checker
Find out how old any domain is — see its registration date, age in years, and expiry date via RDAP.
Results are estimates for informational purposes only and do not constitute professional financial, medical, legal, or technical advice. Read full disclaimer →