TXT Record Lookup

See all TXT records — SPF, DKIM, DMARC, domain verification, and more.

Perform TXT Lookup

What is a TXT record?

A TXT record holds arbitrary text at a DNS hostname. Originally designed for human-readable notes, TXT records have become the Swiss Army knife of modern DNS: SPF, DKIM, DMARC, MTA-STS, domain-ownership verification for every major SaaS platform, and dozens of other protocols all encode their data as TXT records.

A single hostname can have multiple TXT records, and resolvers return all of them. This is why you'll see a single hostname publishing an SPF record (v=spf1 ...), several domain-verification records for different SaaS providers, and potentially a DMARC or MTA-STS record, all coexisting.

TXT record content is stored as one or more character strings, each up to 255 characters. If the published value exceeds 255 characters (common for DKIM public keys), the zone file splits the value into multiple quoted strings concatenated by the resolver — "part1" "part2". This split is invisible to the end user but critical for DKIM: if the split happens at the wrong boundary or a quote is missing, the signature silently fails to verify.

The query hostname depends on what you're looking for. An SPF record lives at the domain itself (example.com). A DMARC record lives at _dmarc.example.com. DKIM keys live at <selector>._domainkey.example.com where <selector> is an ESP-specific value like s1, google, or mailjet. MTA-STS records live at _mta-sts.example.com. The Quick Lookup buttons on the main DNS lookup page handle the common prefixes for you.

How to read the results

Each entry is the exact text published at the queried hostname, with any multi-string concatenation already flattened. The first few characters — the "tag" — tell you what the record is:

— v=spf1 ... — SPF record (should only be one per domain)
— v=DMARC1; ... — DMARC record (queried at _dmarc.<domain>)
— v=DKIM1; k=rsa; p=<public key> — DKIM public key (queried at <selector>._domainkey.<domain>)
— v=STSv1; ... — MTA-STS policy
— <provider>-site-verification=... — domain ownership proof for SaaS (Google, Facebook, Microsoft, etc.)

If you see a TXT record that doesn't start with any of these tags, it's either custom application data or a legacy note left by a previous admin. Short strings with random hex or base64 content are usually verification tokens — safe to leave in place, unless you've confirmed the verification is no longer needed and you're cleaning up.

Common issues

Multiple SPF records. RFC 7208 explicitly forbids publishing more than one SPF record per domain. If a receiver sees two v=spf1 records at the same hostname, it must treat the result as PermError — SPF fails entirely. Merge the multiple records into a single v=spf1 ... record.
DKIM public key split incorrectly. TXT strings longer than 255 characters are split across multiple quoted strings. If the zone file splits mid-base64-character or introduces an unexpected character at a boundary, the resolver concatenation fails silently and DKIM verification breaks. Use our DKIM Checker to validate.
DMARC record queried at the wrong hostname. DMARC lives at _dmarc.example.com, not example.com. A common beginner mistake is publishing v=DMARC1; ... at the apex — mail receivers will never find it.
Missing or stale SaaS verification records. Old verification records from cancelled services accumulate over time. They're usually harmless but bloat the response and can push the domain's SPF DNS-lookup count toward the 10-lookup limit if they're referenced by other records.
Quoting confusion when publishing. Some DNS providers want the value including quotes, some want it without. Publishing "v=spf1 ..." (quotes included) at a provider that strips quotes leads to a record that actually contains the quote characters, which invalidates the SPF syntax.
Malformed DMARC record silently ignored. Receivers reject malformed DMARC records silently and treat the domain as if no policy were published — so the "permissive fallback" masks the misconfiguration. Always validate new DMARC records with a parser before relying on them for enforcement.

Other DNS Lookups

A Find the IPv4 address associated with any domain. AAAA Find the IPv6 address associated with any domain. CNAME Find the canonical name (alias target) for any hostname. MX See which mail servers accept email for a domain. NS See which nameservers are authoritative for a domain. SOA Check the Start of Authority record — serial, refresh, retry, expiry. All DNS record types

Automate your DNS

DMARC Busta manages SPF, DKIM, and DMARC records across 10,000+ domains — no manual lookups needed.

Start free trial