DNS TXT Record Lookup

View all TXT records for any domain — SPF, DKIM, DMARC, and domain verification tokens — from 5 resolvers or authoritative DNS.

More Tools

What Is a DNS TXT Record?

DNS TXT record lookup queries the Domain Name System for all TXT-type resource records published under a domain name, as defined in RFC 1035 §3.3.14. TXT records store arbitrary text data — originally designed for human-readable notes (RFC 1464), now used primarily for email authentication and domain ownership verification. Results include SPF records (RFC 7208), DKIM public keys (RFC 6376), DMARC policies (RFC 7489), and third-party verification tokens from services such as Google Search Console and Microsoft 365.

Property	Detail
DNS Type Code	16 (TXT), defined in RFC 1035 §3.3.14
Extended by	RFC 1464 — arbitrary attribute storage for domain names
Max string length	255 bytes per character string; multiple strings per record are allowed
Common uses	SPF (RFC 7208), DKIM (RFC 6376), DMARC (RFC 7489), domain ownership tokens
Query protocol	UDP, no caching, 3-second timeout per resolver
Available resolvers	Google 8.8.8.8, Cloudflare 1.1.1.1, OpenDNS 208.67.222.222, Quad9 9.9.9.9, Yandex 77.88.8.8, Authoritative DNS

How to Look Up DNS TXT Records

Find all TXT records — SPF, DKIM, DMARC, and verification tokens — for any domain in seconds.

Enter the Domain Name

Type the domain name (e.g. google.com) into the input field. Do not include https:// or trailing paths — the bare domain only.

Select a DNS Resolver

Choose Google, Cloudflare, Quad9, OpenDNS, or Yandex for a recursive lookup, or select Authoritative DNS to query the domain's own name servers directly.

Click Lookup TXT Records

Submit the query. A live TXT record request is sent without caching — results reflect the current state of DNS at the selected resolver.

Read the Results

Each row shows one TXT record value and its TTL in seconds. Identify record types by prefix: v=spf1 (SPF), v=DMARC1 (DMARC), v=DKIM1 or k=rsa (DKIM).

What Do TXT Record Results Mean?

TXT records do not have a fixed format — their meaning is determined by the value prefix. The table below covers the most common patterns returned by a TXT lookup.

Diagram of common TXT records: v=spf1 for SPF, v=DMARC1 on _dmarc, v=DKIM1 on a selector domain key, and site verification tokens — The first characters of a TXT record tell you what it is for.

Value Starts With	Record Type	Purpose
`v=spf1`	SPF (RFC 7208)	Lists mail servers authorized to send email on behalf of this domain. Only one SPF record is permitted per domain — a second record causes SPF to fail.
`v=DMARC1`	DMARC (RFC 7489)	Defines the policy for handling email that fails SPF or DKIM checks — none, quarantine, or reject. Published on the `_dmarc` subdomain.
`v=DKIM1; k=rsa; p=`	DKIM (RFC 6376)	Public key used by receiving mail servers to verify the DKIM signature in email headers. Published on a selector subdomain (e.g. `default._domainkey`).
`google-site-verification=`	Google Ownership Token	Domain ownership proof required by Google Search Console, Google Workspace, or other Google services.
`MS=ms`	Microsoft Ownership Token	Domain ownership verification string added during Microsoft 365 or Azure setup.
(any other text)	Custom / Service TXT	Arbitrary text per RFC 1464 — used by SaaS tools, CI/CD platforms, and other services for domain verification or configuration signalling.

How DNS TXT Record Lookup Works

TXT record queries are sent as UDP datagrams to the selected resolver using dnsjava (org.xbill.DNS). The Lookup class is configured with setCache(null) and setTCP(false), ensuring each request is a fresh UDP query — no cached data is ever returned.

When Authoritative DNS mode is selected, the tool first queries Google (8.8.8.8) for the domain's NS records, resolves each name server hostname to its A record IP, and sends the TXT query directly to those authoritative resolvers. This bypasses the recursive resolution layer entirely and returns data as it exists at the domain's own name servers — propagation delays from recursive resolver caches do not apply.

Per RFC 1035 §3.3.14, a single TXT record may contain multiple character strings, each limited to 255 bytes. When a TXT value exceeds 255 bytes — common with long DKIM public keys — the DNS zone stores it as multiple strings inside one record. The tool joins these strings with a space separator when displaying results, matching standard client behavior.

Do it yourself

How to Look Up TXT Records Without an Online Tool

All major operating systems include command-line DNS tools that support TXT record queries. The online tool queries from a neutral external resolver — results may differ from your local resolver due to caching. Use Authoritative DNS mode or specify a resolver IP in the command to control which source is queried.

Windows Command Prompt

nslookup -q=TXT google.com
nslookup -q=TXT google.com 8.8.8.8
nslookup -q=TXT google.com 1.1.1.1

Use -q=TXT to request TXT records specifically. Append a resolver IP after the domain to override the system default — useful for verifying how a record appears from a specific resolver before email authentication changes go live.

Windows PowerShell

Resolve-DnsName google.com -Type TXT
Resolve-DnsName google.com -Type TXT -Server 8.8.8.8
Resolve-DnsName google.com -Type TXT -Server 1.1.1.1

Mac / Linux dig

dig google.com TXT
dig google.com TXT @8.8.8.8
dig google.com TXT @1.1.1.1

dig is the preferred tool for sysadmins and developers — it exposes the full DNS response including TTL, response flags, and the authority section. On macOS, dig is pre-installed. On Ubuntu/Debian, install it with apt install dnsutils.

Common Uses for DNS TXT Record Lookup

Verifying email authentication records before a migration. A DevOps engineer preparing to migrate a client domain to Google Workspace adds the required SPF, DKIM, and DMARC TXT records in the DNS control panel. Before cutting over mail routing, they run a TXT lookup in Authoritative DNS mode to confirm all three records are live at the domain's own name servers — not waiting on recursive resolver propagation.

Diagnosing email deliverability failures. An email deliverability engineer investigating mail landing in spam runs a TXT lookup on the sending domain. The results show two records beginning with v=spf1 — a duplicate SPF record that RFC 7208 §3.4 explicitly prohibits. The duplicate causes SPF to return a PermError at receiving mail servers, which DMARC treats as a failure. Removing the duplicate resolves the deliverability issue.

Auditing domains for missing security records. A security analyst conducting an infrastructure audit runs TXT lookups across all company-owned domains. Several domains have no v=DMARC1 record, confirming no policy is in place to handle spoofed email sent from those domains. Each unprotected domain is flagged as a phishing risk — DMARC with a p=reject policy is added to each.

Frequently Asked Questions

What is a DNS TXT record?

A DNS TXT (text) record, defined in RFC 1035 §3.3.14 and RFC 1464, is a resource record that stores arbitrary text associated with a domain name. Originally designed for human-readable notes, TXT records now serve machine-readable purposes — most importantly email authentication (SPF, DKIM, DMARC) and domain ownership verification for services such as Google Search Console, Google Workspace, and Microsoft 365.

How accurate are the TXT record results?

Results reflect the current DNS state at the selected resolver at the time of the query. The tool queries without caching, so data is as current as the resolver's own cache. Selecting Authoritative DNS mode bypasses recursive resolvers entirely and queries the domain's name servers directly — this returns the most current data available. After making a DNS change, propagation to recursive resolvers may take up to the record's TTL duration.

Why does my domain have multiple TXT records?

Each service that requires TXT-based verification adds its own record independently. A typical domain may have one SPF record, one DMARC record, one or more DKIM records (one per sending service or DKIM selector), and one or more ownership verification tokens from Google, Microsoft, and other platforms. Only SPF is strictly limited to exactly one record per domain — multiple SPF records cause SPF authentication to fail, per RFC 7208 §3.4.

Why is my TXT record not showing up in the results?

The most common causes are: the record was added to the wrong subdomain (SPF must be on the root domain, not www); DNS changes have not yet propagated — wait until the record's TTL expires; or the selected resolver holds a cached copy of the previous value. Switch to Authoritative DNS mode to query the domain's own name servers directly, which will reflect changes immediately after they are saved.

What is the difference between a TXT record and an SPF record?

An SPF record is not a separate DNS record type — it is a TXT record whose value follows the SPF syntax defined in RFC 7208, beginning with v=spf1. All SPF records are TXT records, but not all TXT records are SPF records. DKIM public keys and DMARC policies are also stored as TXT records. Running a TXT lookup retrieves all of them in a single query.

Do you store or log the domains I look up?

No. Each query is processed in real time and the domain name is not stored, logged, or retained after the request completes. TXT record values are displayed in your browser and discarded server-side immediately after the response is sent.

understand the addressing layer that DNS resolves domain names into.

Guide What Is IPv4 — The Protocol Behind Most DNS Records

covers the IPv4 address structure that A records, MX records, and SPF IP mechanisms reference.