DNS TXT Record Lookup: SPF, DKIM & DMARC Records

DNS TXT records store arbitrary text data associated with a domain. Originally designed for human-readable information, they are now used for machine-readable configurations including domain ownership verification, email authentication (SPF, DKIM, DMARC), and security policies. If you are setting up email or verifying a domain with Google, Cloudflare, or any other service, you will need to work with TXT records.

How to Look Up TXT Records

1. Enter the domain name — Use the root domain (e.g., example.com) for SPF and DMARC, or a specific selector subdomain (e.g., google._domainkey.example.com) for DKIM.
2. Select TXT from the record type dropdown — This returns all text records for that hostname.
3. Run the lookup — Results show each TXT record value, which may be long strings for DKIM keys.
4. Identify the record type by content — SPF records start with v=spf1; DMARC starts with v=DMARC1; DKIM includes p= for the public key.

Example: SPF and DMARC TXT Records

# Query SPF record
dig example.com TXT | grep spf

# Query DMARC record (always at _dmarc subdomain)
dig _dmarc.example.com TXT

# Query DKIM record (replace 'google' with your selector)
dig google._domainkey.example.com TXT

# SPF example output:
# example.com.  3600  IN  TXT  \"v=spf1 include:_spf.google.com ~all\"

# DMARC example output:
# _dmarc.example.com.  3600  IN  TXT  \"v=DMARC1; p=reject; rua=mailto:[email protected]\"

Why Check TXT Records?

• Verify SPF setup — SPF tells recipient mail servers which IP addresses are authorized to send email for your domain. A missing or wrong SPF record causes email to land in spam.
• Confirm DKIM keys are published — DKIM signs outgoing email with a private key; the public key lives in a TXT record. Checking it confirms your email signing chain is intact.
• Check DMARC policy — DMARC tells receiving servers what to do with email that fails SPF/DKIM checks (none, quarantine, or reject).
• Domain ownership verification — Google Search Console, Cloudflare, and most SaaS tools verify domain ownership by asking you to add a specific TXT record.

Common TXT Record Mistakes

Having multiple SPF records is invalid — you must have exactly one SPF TXT record per domain, combining all authorized senders into one string. Another common mistake is adding DMARC before configuring SPF and DKIM — DMARC requires both to be in place to be effective. Use the TXT record lookup to confirm all three are present and correctly formatted.

TXT Records and Google Workspace Setup

When setting up Google Workspace, Google provides a unique TXT verification string to add to your domain. This proves you control the domain before they activate your account. The string looks like google-site-verification=abc123... and must be added as a TXT record at the root domain level.

Check SPF, DKIM, DMARC, and any other TXT records instantly with the DNS Lookup tool.