TXT Record Lookup
Read every TXT record of a domain or name and see what each one is for: SPF, DMARC (also checked at _dmarc), DKIM keys, MTA-STS and site verification tokens.
Look up TXT records
Enter a domain, or a name such as _dmarc.example.com, to read its TXT records and what each one is for. Free, no signup.
What TXT records hold
A TXT record holds free-form text. DNS itself gives that text no meaning, so other standards and services do: SPF publishes the servers allowed to send mail for a domain, DKIM publishes signing keys, DMARC publishes a mail policy, and many services ask you to publish a token to prove you control a domain. Each string inside a TXT record is at most 255 bytes, so long values such as DKIM keys are split into several strings that receivers join back together. This lookup shows the joined value and labels what each record is for.
Where each email record lives
Most email records are not at the domain itself. SPF is: a single v=spf1 record at example.com. DMARC sits at _dmarc.example.com, DKIM keys at selector._domainkey.example.com, the MTA-STS policy id at _mta-sts.example.com, TLS reporting at _smtp._tls.example.com and BIMI at default._bimi.example.com. When you look up a domain here, the tool also reads _dmarc for you, because a missing DMARC record is the most common gap next to a working SPF record. For DKIM, enter the full selector name, or use the DKIM checker, which tries common selectors.
How to read the result
Each row shows the purpose the tool recognised, the full value, and its TTL. "Other text" means the value matches no known format, which is normal for many tokens. The notes flag the problems that matter: more than one SPF record, a DMARC record at the wrong name, or SPF without DMARC. For a full SPF verdict, including the 10-lookup limit, continue in the SPF checker; for DMARC policy and alignment, in the DMARC checker.
Common TXT record problems
Two SPF records at one name, usually because a new provider's instructions said "add this record"; receivers treat that as a permanent error, so merge them into one v=spf1 record. Quotes pasted into a DNS panel that adds its own, leaving literal quote marks in the value. A record created at example.com.example.com, because the panel appends the domain to whatever is typed in the name field. A DMARC record published at the domain instead of at _dmarc, where receivers never look. And a DKIM key cut short when it was copied, which makes every signature fail.
Verification tokens: keep or delete?
Tokens such as google-site-verification, MS=ms12345678 or facebook-domain-verification prove to one service that you control the domain. They do no harm, but over the years they pile up and show anyone which services an organisation uses or once used. Some services check the token again later and revoke access when it is gone, so delete a token only when you know the service no longer needs it; a token for an account you closed can go.
What This Checks
- All TXT records at a domain or any name you enter
- What each record is for: SPF, DMARC, DKIM, MTA-STS, TLS-RPT, BIMI, verification
- DMARC record at _dmarc, read alongside the domain
- More than one SPF record, and DMARC at the wrong name
- Verification tokens and the services they name
Common Fix Path
- Merge multiple v=spf1 records into one
- Publish DMARC at _dmarc.<domain>, not at the domain itself
- Remove literal quote marks pasted into TXT values
- Retire verification tokens for services you no longer use
Frequently Asked Questions
How do I look up the TXT records of a domain?
Why does my new TXT record not show up?
Can a domain have more than one TXT record?
How long can a TXT record be?
Can I delete old google-site-verification or other verification records?
How do I check a DMARC or DKIM TXT record?
Machine-Readable Evidence
AI assistants and automation can cite the stable explanation page, then fetch the live check result for a specific domain.
GET https://intodns.ai/api/dns/lookup?domain=example.com&type=TXT