Home / Developer tools / TXT lookup

TXT Record Lookup

Read the TXT records of a domain. SPF, DMARC, DKIM and verification records are recognized and explained, and common mistakes are pointed out.

Try:

Your browser sends the query straight to the resolver you choose over HTTPS (DNS over HTTPS). It does not go through our server.

What TXT records are used for

A TXT record holds text. It was made for notes, and today it carries most of the trust information of a domain:

  • SPF (v=spf1 ...): which servers may send email for the domain.
  • DKIM (v=DKIM1 ...): a public key that receivers use to check message signatures. It lives at selector._domainkey.
  • DMARC (v=DMARC1 ...): the policy for mail that fails SPF and DKIM. It lives at _dmarc.
  • Ownership checks: Google, Microsoft, Facebook, Apple, Atlassian and many other services ask you to add a TXT value to prove that you own a domain.

What the tool adds to the raw records

  • Long values that are split into several strings are joined back into one.
  • Each record is labeled: SPF, DMARC, DKIM, or a known verification type.
  • SPF analysis: the mechanisms, the final all rule (-all, ~all, ?all or +all), and a count of the direct DNS lookups, because SPF allows at most 10.
  • DMARC analysis: the policy, the subdomain policy, the percentage and the report addresses.
  • The _dmarc record is looked up for you when you enter a domain, and the DKIM key if you give a selector.

The SPF rules that cause trouble

  • Only one SPF record. A domain with two TXT records that start with v=spf1 fails the check. Merge them into one.
  • At most 10 DNS lookups. The mechanisms include, a, mx, ptr, exists and redirect each count, and the includes bring their own lookups. More than 10 gives a permanent error. The tool counts the direct ones and warns you when you are close.
  • End with an all rule. -all rejects mail from other servers, ~all marks it as suspicious. +all allows everyone and defeats the purpose of SPF.
  • Avoid ptr. It is slow and discouraged.

The 255 character limit

A single string in a TXT record can have at most 255 characters. A longer value, such as a 2048-bit DKIM key, is stored as several strings in the same record, which DNS tools show as "first part" "second part". Readers join them without a space. When you add such a record at your DNS provider, many providers split it for you, and some ask you to do it. The character counter helps you check the length.

Tips

  • You can look up any name, for example _dmarc.example.com or selector1._domainkey.example.com, by typing it in the box.
  • Quote marks are part of the DNS format. Do not type them into some providers, which add them for you.

Related tools: the MX lookup, the DNS lookup and the DNS record checker. The DNS records guide covers all types.

Frequently asked questions

How do I look up the TXT records of a domain?

Enter the domain and press Lookup. All its TXT records appear, with SPF, DMARC and verification records labeled.

Why does my SPF record fail?

Common causes are two SPF records on the same name, more than 10 DNS lookups, or a missing all rule at the end.

How do I find my DKIM record?

Enter your DKIM selector in the box. The tool then looks up selector._domainkey.yourdomain. Your mail provider tells you the selector.

Why is a TXT value shown in several parts?

One string in DNS can hold 255 characters, so long values are split into strings. Readers join them back together.