Network & DevOps ToolkitTXT Record Lookup
SPF, DMARC, DKIM and verification strings — everything a domain publishes as text.
Enter a domain — the TXT record type is pre-selected. For DMARC query _dmarc.yourdomain.com; for DKIM, selector._domainkey.yourdomain.com.
Loading…
Decoding what you'll find
- SPF —
v=spf1 include:_spf.google.com ~all: which servers may send mail as this domain. One SPF record only — publishing two breaks validation.~all= softfail suspicious senders,-all= reject outright. - DMARC — at
_dmarc.<domain>:v=DMARC1; p=quarantine; rua=mailto:…tells receivers what to do when SPF/DKIM fail, and where to send reports.p=nonemeans monitor-only. - DKIM — at
<selector>._domainkey.<domain>: the public key receivers use to verify message signatures. Selectors likegoogleors1come from your mail provider. - Verification strings —
google-site-verification=…,MS=…,stripe-verification=…: harmless ownership proofs; stale ones can be deleted. - The 10-lookup limit: SPF stops evaluating after 10 DNS lookups — too many
include:chains and your SPF silently fails. Flatten rarely-used includes.
Why don't I see my DKIM record when I query the bare domain?
DKIM lives at selector._domainkey.yourdomain.com, not at the root. Find the selector in a received message's DKIM-Signature header (s= tag) and query that exact name here.
Is it bad to have two SPF records?
Yes — RFC 7208 requires receivers to treat multiple v=spf1 records as a permanent error, so your mail can fail authentication entirely. Merge them into one record.
Do TXT records affect website traffic?
No — they're metadata read by mail systems and verification bots. You can add or remove verification strings without any risk to the site itself.
Related tools
- MX Record Lookup — where the mail actually goes.
- HMAC Generator — the signing primitive behind DKIM.
- DNS Lookup — all record types for any domain.
🔐 DNS queries are answered server-side by this site's own resolver API and are not logged. Every other tool on this site runs entirely in your browser.