--- title: "TXT Record Lookup" date: 2026-10-01 author: "Robert A. Lee" featured_image: "https://sqmagazine.co.uk/wp-content/uploads/2026/10/txt-record-lookup.jpg" --- # TXT Record Lookup The TXT record lookup lists every TXT record, DNS entries that hold descriptive text, at a domain and its \_dmarc subdomain. It reads the SPF (Sender Policy Framework) record and DMARC (Domain-based Message Authentication, Reporting, and Conformance) policy. Example.com returns **3** records, including v=spf1 -all and p=reject, the setup UK government IT guidance prescribes for domains which never send email. TXT Record Lookup Examples Reset example.com google.com github.com Domain or name A domain such as example.com, or an exact name such as \_dmarc.example.com or selector.\_domainkey.example.com. Runs when you press Enter or Check, so a half-typed address is never looked up. Check DKIM selector (optional) The part before .\_domainkey in your email service's DKIM setup. Google Workspace uses google, Microsoft 365 selector1 and selector2. Also check MTA-STS, TLS-RPT and BIMI TXT records found 3 Copy SPF for example.com: v=spf1 -all. DMARC: p=reject. TXT records found3 SPF recordv=spf1 -all DMARC policyp=reject DKIM recordNot checked: enter a selector, the part before .\_domainkey MTA-STS, TLS-RPT and BIMIMTA-STS: none. TLS-RPT: none. BIMI: none. Domain checkedexample.com Copy all details Share result Download CSV Records | Name | Type | TTL | Value | |---|---|---|---| How this works How it worksQueries go from your browser to Cloudflare's 1.1.1.1 resolver over DNS-over-HTTPS. TXT records and their TTL are defined in [IETF RFC 1035 (opens in new window)](https://www.rfc-editor.org/rfc/rfc1035.html); the TTL shown is the resolver's remaining cache time in seconds, so it changes between lookups. An exact name (\_dmarc.example.com, selector.\_domainkey.example.com) is looked up beside its domain and listed first. DKIM keys live at selector.\_domainkey (RFC 6376), MTA-STS at \_mta-sts (RFC 8461), TLS reporting at \_smtp.\_tls (RFC 8460) and BIMI at default.\_bimi. Not coveredOne public resolver's view; propagation delays apply; DKIM needs the selector, which the sending service's setup page names. Privacy**Your lookup never passes through our server.** Your browser asks a public DNS resolver directly over HTTPS. CorrectionsReport a wrong result to [media@sqmagazine.co.uk](mailto:media@sqmagazine.co.uk?subject=Correction%3A%20TXT%20Record%20Lookup); every report is reviewed and confirmed errors are corrected. Include the inputs and the answer you expected. With your permission, we thank you by name on this page. FeedbackHow useful was this tool? The figures shown are the worked example. Enable JavaScript to calculate with your own numbers. ## How to Use the TXT Record Lookup The lookup runs from your browser to Cloudflare’s public DNS resolver over HTTPS. Nothing passes through SQ Magazine’s server. Give it one domain, and it returns the records plus a summary: 1. Type a domain into “Domain”, such as example.com. A pasted URL works too; the tool strips the https:// prefix and any path. 2. Or pick a preset from the “Examples” row: example.com, google.com or github.com. 3. Read the summary. “TXT records found” leads, then “SPF record”, “DMARC policy” and “Domain checked”. 4. Scan the “Records” table. Each row gives the Name, Type, TTL (time to live, the seconds a resolver may cache the answer) and Value. 5. Use “Share result” to send a URL that reopens the lookup, or “Download CSV” to keep the table. The \_dmarc rows follow [RFC 9989](https://www.rfc-editor.org/rfc/rfc9989.html), the DMARC specification that obsoletes RFCs 7489 and 9091. It says “DMARC Policy Records are stored as DNS TXT records” at names that start with \_dmarc. The lookup makes **2** DNS queries. SPF comes from the domain query, and DMARC from the \_dmarc query. ## How the TXT Record Lookup Works [Cloudflare’s JSON API documentation](https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/make-api-requests/dns-json/) says “JSON formatted queries are sent using a GET request.” Clients should include “an HTTP Accept request header with a MIME type of application/dns-json,” and the tool does. Three email authentication methods use these records, as Google’s sender guidelines put it: - SPF: “The SPF record for your domain should include all email senders for your domain.” - DKIM, short for DomainKeys Identified Mail: “Receiving servers use DKIM to verify that the domain owner actually sent the message.” - DMARC: “DMARC tells receiving servers what to do with your messages that don’t pass SPF or DKIM.” | Output | What the tool reads | Where the rule comes from | |---|---|---| | TXT records found | Every answer of type **16** at the domain and at \_dmarc | DNS core specification | | SPF record | The record whose value starts with v=spf1 | SPF specification | | DMARC policy | The p= tag of the v=DMARC1 record at \_dmarc | DMARC specification | | TTL column | Seconds the resolver may keep the answer cached | Cloudflare JSON API | *Sources: [RFC 1035](https://www.rfc-editor.org/rfc/rfc1035.html), RFC 7208, RFC 9989, Cloudflare* Long values arrive split into several quoted strings, and the tool joins them. For SPF records, [RFC 7208](https://www.rfc-editor.org/rfc/rfc7208.html) requires it: “the record MUST be treated as if those strings are concatenated together without adding spaces.” The split exists because of “the **255-octet** maximum length of a character-string within a single TXT record,” roughly 255 plain-text characters per string. Each row then gets a Type label: SPF, DMARC, DKIM, Verification or Other. The version tag decides SPF, DMARC and DKIM, while keywords in the value decide Verification. The TTL counts down. Cloudflare defines it as “the number of seconds the answer can be stored in cache before it is considered stale.” The “SPF record” line shows the record when a domain publishes exactly one. With more than one, it reads “Invalid” and gives the count, since RFC 7208 says “A domain name MUST NOT have multiple records that would cause an authorization check to select more than one record.” DKIM keys normally stay out of the table. [RFC 6376](https://www.rfc-editor.org/rfc/rfc6376.html) says “All DKIM keys are stored in a subdomain” named \_domainkey, behind a selector name the lookup can’t guess. ### What Does a TXT Record Look Like? A TXT record is a name, a type, a TTL and a quoted text value. [UK government guidance for domains that send no email](https://www.gov.uk/guidance/protect-domains-that-dont-send-email) shows how nslookup or dig prints one: yourdomain.gov.uk. TXT “v=spf1 -all”. RFC 1035 keeps the meaning open: “The semantics of the text depends on the domain where it is found.” The Records table swaps the type for its own label. ## TXT Record Lookup Example: example.com On example.com, the lookup takes five steps: 1. A query for example.com returns two TXT records: v=spf1 -all, typed SPF, and the token \_k2n1y4vw3qtb4skdx9e7dxt97qrmmq9, typed Other. 2. “SPF record” shows v=spf1 -all, the only row starting with v=spf1. 3. The \_dmarc query returns one record, v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s, so “DMARC policy” reads p=reject. 4. “TXT records found” reads **3**: two rows for the domain and one for \_dmarc. 5. Both answers carried a TTL of **300** seconds when we captured them through Google Public DNS on September 27, 2026. A cached answer shows a lower number. [IANA](https://www.iana.org/help/example-domains) lists example.com among the domains “maintained for documentation purposes” that are “not available for registration or transfer.” The DMARC record’s sp=reject tag sets the same reject policy for subdomains. CISA explains that DMARC alignment ties the visible From address to the domains SPF and DKIM authenticate. Alignment “can be “strict” (an exact match) or “relaxed” (must be a subdomain of the parent domain).” The record’s adkim=s and aspf=s tags require the strict kind, since RFC 9989 lists s: strict mode for both. GOV.UK’s guidance, written for UK government IT teams, covers domains which do not send email. It tells them to publish v=spf1 -all and a DMARC value that begins v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s. Example.com’s record stops at exactly that string. GOV.UK’s version adds reporting tags, including rua, which names “the email address that you want reports to be sent to.” Its list also calls for “an empty DKIM key record” and “a null MX record.” GOV.UK builds it as an MX record whose value is a single dot. A TXT lookup of the domain checks neither. On the two records the lookup can see, example.com follows the template. ## What Your TXT Record Lookup Result Means A TXT lookup shows what a domain asks for, and receiving mail servers decide what to do with it. RFC 9989 says “The final handling of any message is always a matter of local policy and is left to the discretion of the Mail Receiver.” The DMARC p= tag gives the “message handling preference of the Domain Owner” for mail from its domain that fails DMARC. Read each field against its specification: - An SPF record ending in -all gives a fail result for mail from any server it doesn’t list. RFC 7208 maps the qualifiers as “+” pass “-” fail “~” softfail “?” neutral. The “all” mechanism is used “as the rightmost mechanism in a record to provide an explicit default.” - RFC 9989 defines p=none this way: “The Domain Owner offers no expression of preference.” - For p=quarantine, it says: “The Domain Owner considers such mail to be suspicious.” - For p=reject: “The Domain Owner considers all such failures to be a clear indication that the use of the domain name is not valid.” - A “None found” result means no record at that name starts with the SPF or DMARC version tag. - Extra TXT rows are normal: RFC 7208 tells SPF checkers to “discard records that do not begin with a version section” of exactly v=spf1. The policy also covers subdomains. It “applies to the domain queried and to subdomains, unless the subdomain policy is explicitly described” in a tag such as sp. A subdomain can show “None found” here while its parent’s policy still covers it. RFC 9989 says “If no valid DMARC Policy Record is found by the first query, then perform a DNS Tree Walk”. Each query in that walk drops the leftmost label, so mail.example.com falls back to example.com. A reject policy helps reduce the risk that forged mail carrying the exact domain reaches inboxes; a lookalike domain sits outside it. Email authentication is one layer, and the [small-business cybersecurity plan](/how-to-secure-your-business-from-cyber-attacks/) covers the others, from MFA to backups. CISA says p=none “should be viewed as a temporary policy setting before getting to p=quarantine and p=reject.” That setting “is only meaningful when coupled with reporting.” The [phishing email statistics](/phishing-email-statistics/) show how often spoofed senders and brand impersonation turn up in phishing campaigns. ### Why a New TXT Record Does Not Show Up Yet A resolver can serve a cached answer until its TTL runs out. Until then, a fresh edit won’t appear here. A record added at the wrong DNS host won’t appear in the lookup. A DMARC record added at the domain instead of \_dmarc shows up as a DMARC row there, but “DMARC policy” reads None found. ### Common Mistakes in SPF and DMARC Records - Two SPF records break evaluation. RFC 7208 says that “if the resultant record set includes more than one record,” check\_host(), the SPF check, “produces the ‘permerror’ result.” A permerror “means the domain’s published records could not be correctly interpreted.” - Too many lookups hit a hard cap. Under RFC 7208, “SPF implementations MUST limit the total number of those terms to **10**,” counting include, a, mx, ptr, exists and redirect. Going over also ends in a permerror. - Two DMARC records at \_dmarc cancel each other out. RFC 9989 says “If multiple DMARC Policy Records are returned for a single target, they are all discarded.” If no parent name holds a record either, receivers “MUST NOT apply the DMARC mechanism to the message.” The “DMARC policy” line shows only one record, so count the DMARC rows too. - A clean-looking result isn’t a pass. The tool shows the SPF record as published, without counting its lookups or checking its syntax. ## SPF, DKIM and DMARC Records Compared SPF, DKIM and DMARC use TXT records at **3** different names. A lookup of the domain and \_dmarc sees two of them. DKIM’s name depends on a selector named in each signed message’s DKIM-Signature header. | Record | Where it lives | Value starts with | Shown by this lookup | |---|---|---|---| | SPF | example.com | v=spf1 | Yes, as “SPF record” | | DMARC | \_dmarc.example.com | v=DMARC1 | Yes, as “DMARC policy” | | DKIM | selector.\_domainkey.example.com | v=DKIM1 when the tag is present (RECOMMENDED) | No, the selector is unknown | *Sources: RFC 7208, RFC 9989, RFC 6376* ### Is DKIM a TXT or CNAME Record? DKIM keys are TXT records: RFC 6376 names “txt” as “the only option defined in this base specification.” Microsoft 365 publishes them through CNAMEs instead, asking for “two CNAME records in DNS in each custom domain” that point to key records Microsoft hosts. RFC 6376 marks the key record’s v= tag RECOMMENDED, and if specified it MUST be set to “DKIM1”. ## Who Requires SPF and DMARC Records? Google says “Starting in 2024, email senders must meet the requirements described here to send email to Gmail personal accounts.” The baseline is “All senders: SPF or DKIM” and “Bulk senders: SPF, DKIM, and DMARC.” Google’s [email sender guidelines](https://support.google.com/a/answer/81126) warn that unauthenticated mail “might be marked as spam or rejected.” For personal accounts, Gmail requires “a DKIM key of **1024 bits** or longer.” Google recommends “using a **2048-bit** key if your domain provider supports this.” CISA’s [Binding Operational Directive 18-01](https://www.cisa.gov/news-events/directives/bod-18-01-enhance-email-and-web-security) gave US federal executive-branch agencies a deadline: “within one year after issuance of this directive.” By then, each agency had to finish “setting a DMARC policy of “reject” for all second-level domains and mail-sending hosts.” Here, a second-level domain is a name registered directly under a top-level domain, such as dhs.gov or irs.gov. For bulk senders, a missing DMARC record now affects whether mail reaches personal Gmail inboxes at all. The [step-by-step guide to how phishing works](/what-is-phishing/) shows where a forged sender fits into an attack. ## How to Check TXT Records With dig or nslookup In a terminal, dig example.com TXT prints the domain’s own records, and dig \_dmarc.example.com TXT prints the DMARC record. The nslookup -type=TXT command does the same for each name. The BIND 9 manual, from dig’s own maintainers, calls dig “a flexible tool for interrogating DNS name servers.” It “performs DNS lookups and displays the answers.” A typical invocation is “dig @server name type”. Microsoft’s [nslookup documentation](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/nslookup) says the -type= option returns “certain types of records or information.” ## Can I Remove a Google Site Verification TXT Record? You can, but Search Console will notice the missing token and notify you. If the issue isn’t fixed, access through that record lapses after a grace period. Keep the record while any access depends on it. [Search Console Help](https://support.google.com/webmasters/answer/9008080) says “Search Console periodically checks if your verification token is still present and valid.” When verification fails and nothing changes, “your permissions on that property will expire after a certain grace period.” Google’s tokens appear in rows labeled Verification. Check which service owns a token before deleting it. ## Is there anything else my agent or I should know about this page? Yes. The lookup sends two DNS-over-HTTPS queries from your browser to Cloudflare’s 1.1.1.1 resolver, one for the domain and one for the \_dmarc name. Nothing you type reaches our server. The result is one public resolver’s view at that moment, not a check of every name server. A record changed recently can still show its old value until the TTL runs out, and a record that exists only on a private resolver does not appear. DKIM keys sit under selector names the lookup cannot guess, so a missing DKIM row says nothing about whether the domain signs its mail. The example on this page uses example.com, a domain reserved for documentation, so its records are stable. Your own domain’s results change whenever its DNS does. SQ Magazine publishes the page for information. Reading a record helps you check a setup and promises no delivery or security outcome. ## Conclusion For example.com, the TXT record lookup returns **3** records: v=spf1 -all at the domain and a DMARC policy of p=reject. Re-run the lookup when a new service starts sending for the domain. Google says the SPF record should include every sender. Run your own domain next and look for one SPF row, one DMARC row and a DMARC policy past p=none. If mail still lands in spam, the [email deliverability benchmarks](/email-statistics/) show how inbox placement varies across senders. ## More Network Tools [All network tools (3) →](https://sqmagazine.co.uk/network-tools/) - [ Your IP Edge lookup Live Detected the moment you open it Network At the network edge What Is My IP Address Your public IP, provider and location, read at the edge. IPv4 and IPv6Provider, ASN and time zone → ](https://sqmagazine.co.uk/what-is-my-ip/) - [ Network 192.168.1.10/24 192.168.1.0/24 Network In your browser IP Subnet Calculator Network, broadcast, host range and mask for any IPv4 block. 254Usable hosts → ](https://sqmagazine.co.uk/subnet-calculator/)