TXT Record Lookup
Enter a domain to see all of its DNS TXT records, queried live over DNS-over-HTTPS. Each record is labeled, so you can spot SPF, DMARC, DKIM, MTA-STS and BIMI policies and the verification tokens left by Google, Microsoft, Apple and other services at a glance.
Last updated:
Enter a domain and click Look up TXT to list its TXT records.
How to use the TXT Record Lookup
- Type a domain, URL or email address, for example example.com.
- Choose extra checks: email policy names like _dmarc, and a DKIM selector if you know it.
- Click Look up TXT to query the records live.
- Read the labels to see what each record does and any warnings.
- Copy a record or the full list to compare with what your provider asked you to add.
Common TXT records and what they mean
| Record starts with | Name it lives at | Purpose |
|---|---|---|
v=spf1 | example.com | SPF: servers allowed to send email for the domain. Only one per name. |
v=DMARC1 | _dmarc.example.com | DMARC: what receivers do with mail that fails SPF/DKIM alignment, and where to send reports. |
v=DKIM1; k=rsa; p=… | selector._domainkey.example.com | DKIM: public key used to verify signed email. |
v=STSv1; id=… | _mta-sts.example.com | MTA-STS: tells senders a TLS policy for your mail servers exists. |
v=TLSRPTv1; rua=… | _smtp._tls.example.com | TLS-RPT: where to send reports about failed TLS connections. |
v=BIMI1; l=… | default._bimi.example.com | BIMI: brand logo shown by supporting inboxes when DMARC is enforced. |
google-site-verification= | example.com | Proves ownership to Google Search Console or Google Workspace. |
MS=ms12345678 | example.com | Proves ownership to Microsoft 365. |
apple-domain-verification=, facebook-domain-verification= | example.com | Ownership proofs for Apple and Meta services. |
How TXT lookups work here
The tool sends a standard DNS query for type TXT (record type 16) over DNS-over-HTTPS to Cloudflare’s 1.1.1.1 resolver, falling back to Google Public DNS if Cloudflare cannot be reached. With the email option on, it also queries the fixed names used by DMARC, MTA-STS, TLS-RPT and BIMI. DKIM keys can only be found when you know the selector, because there is no way to list all names under _domainkey.
Each TXT value can be made of several strings of up to 255 characters. The tool joins them into one value, the way mail servers and verification services read them, and shows how many strings there were.
Troubleshooting tips
- Record not showing yet? Check the TTL. A resolver that cached the old answer keeps it until the TTL runs out; try the other resolver.
- Added the record at the wrong name? Many DNS panels add the domain automatically, so entering
_dmarc.example.comas the host creates_dmarc.example.com.example.com. Enter just_dmarc. - Two SPF records? Merge them into one
v=spf1record with all the include terms, ending in a single~allor-all. Use the SPF Record Checker to count nested lookups. - Quotes in the value? Most DNS panels add the surrounding quotes for you. Do not paste extra quotes inside the value.
- Clean up old tokens for services you no longer use to keep the zone tidy.
Frequently asked questions
What is a TXT record?
A TXT record is a DNS record that stores text for a domain name. It was designed for free-form notes, but today it mostly holds machine-readable policies and proofs: SPF and DMARC email policies, DKIM public keys, and verification tokens that prove to a service that you control the domain.
Why do I not see my DMARC or DKIM record in the main list?
DMARC lives at the _dmarc subdomain (for example _dmarc.example.com) and DKIM keys live at selector._domainkey.example.com. They are not TXT records of the domain itself. Keep "Also check email policy names" on for DMARC, and enter your DKIM selector (such as google, selector1 or s1) to look it up.
Can a domain have more than one TXT record?
Yes. A domain can have many TXT records, for example several verification tokens and an SPF record. But it must have only one SPF record (starting with v=spf1) and only one DMARC record; two of either make the policy invalid.
What are the quoted chunks in a long TXT record?
A single TXT string can be at most 255 characters, so longer values such as 2048-bit DKIM keys are split into several quoted strings. Receivers join them without spaces. The tool shows the joined value and how many strings it was split into.
How long does a new TXT record take to show up?
Usually minutes, but it depends on the TTL (time to live) of any cached answer and on your DNS provider. If an old value was cached, resolvers can keep returning it until the TTL expires. The tool shows the TTL of each answer.
Is it safe to leave old verification tokens in DNS?
Tokens are public and generally harmless, but old ones add clutter and reveal which services you use or used. Remove tokens for services you no longer use, unless the service needs them to stay verified.
Is my lookup private?
The tool runs in your browser and sends only the domain name as a DNS query to the public DNS-over-HTTPS resolver you choose (Cloudflare or Google). Nothing else is sent or stored.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.