TXT Record Checker
Look up the TXT records on a host name.
Enter a domain or host to look up its TXT records. We read the live records straight from DNS over an encrypted connection and label the common ones, such as SPF, DMARC and provider verification strings. Nothing is stored.
The TXT Record Checker retrieves the TXT records published on a host name and shows them exactly as a resolver returns them. TXT records hold free-form text, and email authentication leans on them heavily: SPF, DMARC, DKIM, MTA-STS and TLS-RPT are all stored as TXT records, alongside the verification strings that services like Google and Microsoft ask you to add. Listing them lets you confirm what is live, catch duplicates, and spot values that have been split or quoted incorrectly.
Where each authentication TXT record lives
The host name matters as much as the value. SPF sits as a v=spf1 TXT record at the domain apex. DMARC is a v=DMARC1 TXT record at _dmarc.yourdomain. DKIM is a v=DKIM1 TXT record at selector._domainkey.yourdomain. MTA-STS publishes a v=STSv1 TXT record at _mta-sts.yourdomain, and TLS-RPT a v=TLSRPTv1 record at _smtp._tls.yourdomain. Querying the wrong host is the usual reason a record looks absent.
Reading and fixing the result
Watch for these problems:
- Duplicate policy records: two
v=spf1records, or two DMARC records, is a permanent error; receivers may ignore the policy entirely. Keep exactly one of each. - String length: a single TXT string cannot exceed 255 characters, so long DKIM keys are split into multiple quoted chunks that resolvers join. Make sure none are dropped.
- Stray quoting or whitespace: extra quotes or line breaks pasted into the value can break parsing.
If a record is missing, confirm you saved it on the correct host and wait for the previous TTL to expire before re-testing. For email records specifically, our DMARC and SPF checkers validate the contents, and DMARC Engine can keep them correct for you. See the requirements for the full set.
Frequently asked questions
Why is a TXT record split into multiple quoted strings?
A single TXT string is limited to 255 characters, so long values such as a 2048-bit DKIM public key are published as several quoted chunks. Resolvers concatenate them back together, so this is normal as long as no chunk is missing.
Can I have more than one SPF or DMARC TXT record?
No. A domain must publish exactly one v=spf1 record and one v=DMARC1 record. Duplicates cause a permanent error, and receivers may disregard the policy entirely. Merge or remove the extra record.
My DMARC TXT record does not appear. Where should it be?
DMARC lives at _dmarc.yourdomain, not at the domain apex. If you query the apex you will see SPF and verification strings but no DMARC. Re-run the check against the _dmarc host name.
Why do I see Google or Microsoft verification strings in the TXT records?
Many services ask you to prove domain ownership by adding a TXT record they generate. These are harmless to leave in place once verified, though tidying up strings for services you no longer use keeps the record set clear.
I added a TXT record but it is not showing. Why?
Resolvers cache the previous answer for the length of its TTL, so a new record can take minutes to hours to appear everywhere. Confirm it was saved on the correct host at your DNS provider, then wait for the old TTL to lapse and check again.
What other authentication records use TXT?
MTA-STS publishes a v=STSv1 TXT record at _mta-sts.yourdomain (with the policy file served over HTTPS), and TLS-RPT a v=TLSRPTv1 record at _smtp._tls.yourdomain for TLS failure reporting. Both sit alongside your SPF, DKIM and DMARC TXT records.