TXT Lookup Text records
A TXT lookup returns the text records published at a DNS name. Enter a domain to see all of its TXT records sorted into email authentication (SPF, DMARC, DKIM), domain verification tokens, and anything else, with the DMARC policy fetched for you from _dmarc.
How to read TXT lookup results
The tool queries the exact name you enter and lists every TXT record there. Records longer than 255 characters are stored in DNS as several quoted strings; they are joined here into the single value that mail servers and verifiers actually see. The length column is the size of that joined value, and the TTL is how long resolvers may cache it.
Results are grouped by what the record is for:
- Email authentication. The SPF policy (
v=spf1) at the domain itself, plus any DKIM, BIMI, MTA-STS or TLS-RPT record if you looked up one of their names. - Domain verification tokens. Values such as
google-site-verification=…orMS=…that a service asked the owner to publish. They show which services the organization has connected to its domain. - Other. Anything that does not match a known format, including legacy notes and tokens from services the tool does not recognize.
The DMARC policy is not stored at the domain name. It lives at _dmarc.example.com, so the tool looks that name up as well and shows the result in its own block.
Where the common TXT records live
| Record | Name to look up | Starts with |
|---|---|---|
| SPF | example.com | v=spf1 |
| DMARC | _dmarc.example.com | v=DMARC1 |
| DKIM | selector._domainkey.example.com | v=DKIM1 |
| BIMI | default._bimi.example.com | v=BIMI1 |
| MTA-STS | _mta-sts.example.com | v=STSv1 |
| TLS reporting | _smtp._tls.example.com | v=TLSRPTv1 |
DKIM needs the selector name, which is not discoverable from the domain alone. The DKIM lookup tries the selectors that mail providers commonly use.
Common TXT record problems
- Two SPF records. Adding a second
v=spf1record instead of merging the new sender into the existing one makes SPF fail for every message. The tool flags this. - Record placed at the wrong name. A DMARC record published at the domain apex, or an SPF record published at
_spfwithout an include pointing to it, is never read. - Smart quotes or stray characters. Values pasted from a document can carry curly quotes or line breaks that break parsing.
- Stale verification tokens. Tokens for services the organization no longer uses are harmless to mail flow but tell anyone who looks which vendors were once in use.
- Oversized responses. Dozens of long TXT records push the answer past what fits in a UDP packet, which forces a slower retry over TCP and can fail on restrictive networks.
To check what the SPF record actually authorizes, including nested includes and the 10-lookup limit, run it through the SPF Analyzer. The TXT record guide covers the record format in detail.
Frequently asked questions
What is a TXT record used for?
A TXT record stores text at a DNS name for other systems to read. Today it is mainly used for email authentication (SPF, DKIM, DMARC) and for proving domain ownership to cloud services through verification tokens.
How many TXT records can a domain have?
There is no fixed limit, and large organizations often publish dozens. The practical limits are that only one record may begin with v=spf1, and that a very large set of records makes the DNS response too big for a single UDP packet.
Why does a TXT record show up split into several quoted strings?
A single string inside a TXT record can hold at most 255 characters, so longer values such as 2048-bit DKIM keys are stored as several strings. Software that reads the record joins them with nothing in between, and this tool shows the joined value.
Why is the DMARC record not in the TXT results for my domain?
DMARC is published at the _dmarc subdomain rather than at the domain itself. This tool fetches _dmarc.yourdomain separately and shows it below the main results when one exists.
What do the verification tokens in a TXT lookup reveal?
Each token was added to prove ownership of the domain to a specific service, so the set of tokens is a public list of services the organization has connected, such as Google Workspace, Microsoft 365, Atlassian or DocuSign. Tokens are not secrets, but removing ones that are no longer needed keeps that list accurate.
Last updated: