TXT Record Lookup

TXT records store free-form text in DNS. They are how domain owners publish SPF policies, DKIM public keys, DMARC reports policy, and proof-of-ownership tokens for SaaS providers. This lookup runs a live TXT-type DNS query through a public resolver and returns every TXT record on the queried name, preserving the raw text exactly as the resolver delivered it (including the multi-string format DNS uses for long values).

Run a TXT lookup when a SaaS provider cannot verify your domain, when SPF / DKIM / DMARC checks fail at the receiver, when you need to confirm a recently-changed authentication record has actually propagated, or when you want to inspect what third-party security vendors have published on your zone. For DKIM and DMARC, remember the hostname is a subdomain (selector._domainkey.example.comfor DKIM, _dmarc.example.com for DMARC) — not the bare apex.

SPF records start with v=spf1. DMARC records start with v=DMARC1. DKIM records typically include v=DKIM1 and a p= public key. Verification records from Google, Microsoft, and others usually look like a vendor prefix plus a token (for example google-site-verification=...). If a TXT value is returned as several consecutive quoted strings, that is the normal way DNS represents a value longer than 255 characters — the receiving service joins them in order.

Record exists in your provider panel but lookup returns nothing. Almost always a hostname mismatch — DKIM and DMARC need to be published under their specific subdomain, not at the root. Multiple SPF records on the same name will fail SPF evaluation (per RFC 7208 section 4.5); merge them into one record with combined includes. SERVFAIL means the authoritative servers are unreachable or DNSSEC is failing. NXDOMAIN on a DKIM selector means the selector hostname itself does not exist — typo in the selector, or the record was never created.

An average production domain publishes several TXT records: an SPF policy at the apex, a DMARC policy at _dmarc, one or more DKIM selectors under _domainkey, plus vendor verification tokens for Google Workspace, Microsoft 365, security tools, and analytics. Reviewing all of them at once is the fastest way to spot stale or duplicate records left behind by old providers. For what each one does and how to roll them out safely, read SPF, DKIM, and DMARC explained.