Skip to content
LookupOwl

TXT record lookup

Read the TXT records published at a name, such as SPF, DMARC, DKIM and verification tokens, exactly as they are.

Any name works, like example.com, _dmarc.example.com or selector._domainkey.example.com.

More options

Which DNS server to ask. The default is Cloudflare; pick "the domain's own nameserver" to skip every cache and see exactly what the zone publishes.

Set the DNSSEC OK bit: include RRSIG records and report whether the resolver validated the answer (AD flag).

Try:

Results for google.com

Checked live lookup16 ms

JSONCheck again

NOERROR

17 records found

Everything came back normally. Open any type below to copy its values.

TXT · 17
Record mix
  • TXT17 of 17

17 records in 1 type.

Answered in
16ms

Cloudflare

Lowest TTL
247s

Changes reach caches within this time

DNSSEC
Not checked

Turn on DNSSEC in More options to check

TXT17
NameTTLValue
google.com4.1 min"google-site-verification=4ibFUgB-wXLQ_S7vsXVomSTVamuOXBiVAzpR5IZ87D0"
google.com4.1 min"globalsign-smime-dv=CDYX+XFHUw2wml6/Gb8+59BsH31KzUr6c1l2BPvqKX8="
google.com4.1 min"onetrust-domain-verification=6d685f1d41a94696ad7ef771f68993e0"
google.com4.1 min"facebook-domain-verification=22rm551cu4k0ab0bxsw536tlds4h95"
google.com4.1 min"docusign=1b0a6754-49b1-4db5-8540-d2c12664b289"
google.com4.1 min"apple-domain-verification=30afIBcvSuDV2PLX"
google.com4.1 min"google-site-verification=wD8N7i1JTNTkezJ49swvWW48f8_9xveREV4oB-0Hf5o"
google.com4.1 min"onetrust-domain-verification=0d477fe608074e6f9c12bca7826035cc"
google.com4.1 min"arcules-domain-verification=2R4t5G7nI6tRCo61lpxxbLksPYstxhGmtV75cpr8x9K"
google.com4.1 min"Z29vZ2xl"
google.com4.1 min"docusign=05958488-4752-4ef2-95eb-aa7ba8a3bd0e"
google.com4.1 min"v=spf1 include:_spf.google.com ~all"
google.com4.1 min"cisco-ci-domain-verification=47c38bc8c4b74b7233e9053220c1bbe76bcc1cd33c7acf7acd36cd6a5332004b"
google.com4.1 min"_r4rd1pvwyrpi7sw4a3hzmw8e51yh9td"
google.com4.1 min"google-site-verification=TV9-DBe4R80X4v0M4U_bd_J9cpOJM0nikft0jAgjmsQ"
google.com4.1 min"MS=E4A68B9AB2BB9670BCE15412F62916164C0B20BB"
google.com4.1 min"work-accounts-domain-verification=Tcj6JjIMZOw2KsSEw2Nt2rLae89tN6"
Structured result (JSON) · 5.0 KB
{
  "name": "google.com",
  "type": "TXT",
  "resolver": "cloudflare",
  "resolverName": "Cloudflare",
  "rcode": "NOERROR",
  "ad": false,
  "dnssec": false,
  "ms": 16,
  "records": [
    {
      "name": "google.com",
      "type": "TXT",
      "ttl": 247,
      "data": "\"google-site-verification=4ibFUgB-wXLQ_S7vsXVomSTVamuOXBiVAzpR5IZ87D0\"",
      "fields": {
        "text": "google-site-verification=4ibFUgB-wXLQ_S7vsXVomSTVamuOXBiVAzpR5IZ87D0",
        "chunks": 1
      }
    },
    {
      "name": "google.com",
      "type": "TXT",
      "ttl": 247,
      "data": "\"globalsign-smime-dv=CDYX+XFHUw2wml6/Gb8+59BsH31KzUr6c1l2BPvqKX8=\"",
      "fields": {
        "text": "globalsign-smime-dv=CDYX+XFHUw2wml6/Gb8+59BsH31KzUr6c1l2BPvqKX8=",
        "chunks": 1
      }
    },
    {
      "name": "google.com",
      "type": "TXT",
      "ttl": 247,
      "data": "\"onetrust-domain-verification=6d685f1d41a94696ad7ef771f68993e0\"",
      "fields": {
        "text": "onetrust-domain-verification=6d685f1d41a94696ad7ef771f68993e0",
        "chunks": 1
      }
    },
    {
      "name": "google.com",
      "type": "TXT",
      "ttl": 247,
      "data": "\"facebook-domain-verification=22rm551cu4k0ab0bxsw536tlds4h95\"",
      "fields": {
        "text": "facebook-domain-verification=22rm551cu4k0ab0bxsw536tlds4h95",
        "chunks": 1
      }
    },
    {
      "name": "google.com",
      "type": "TXT",
      "ttl": 247,
      "data": "\"docusign=1b0a6754-49b1-4db5-8540-d2c12664b289\"",
      "fields": {
        "text": "docusign=1b0a6754-49b1-4db5-8540-d2c12664b289",
        "chunks": 1
      }
    },
    {
      "name": "google.com",
      "type": "TXT",
      "ttl": 247,
      "data": "\"apple-domain-verification=30afIBcvSuDV2PLX\"",
      "fields": {
        "text": "apple-domain-verification=30afIBcvSuDV2PLX",
        "chunks": 1
      }
    },
    {
      "name": "google.com",
      "type": "TXT",
      "ttl": 247,
      "data": "\"google-site-verification=wD8N7i1JTNTkezJ49swvWW48f8_9xveREV4oB-0Hf5o\"",
      "fields": {
        "text": "google-site-verification=wD8N7i1JTNTkezJ49swvWW48f8_9xveREV4oB-0Hf5o",
        "chunks": 1
      }
    },
    {
      "name": "google.com",
      "type": "TXT",
      "ttl": 247,
      "data": "\"onetrust-domain-verification=0d477fe608074e6f9c12bca7826035cc\"",
      "fields": {
        "text": "onetrust-domain-verification=0d477fe608074e6f9c12bca7826035cc",
        "chunks": 1
      }
    },
    {
      "name": "google.com",
      "type": "TXT",
      "ttl": 247,
      "data": "\"arcules-domain-verification=2R4t5G7nI6tRCo61lpxxbLksPYstxhGmtV75cpr8x9K\"",
      "fields": {
        "text": "arcules-domain-verification=2R4t5G7nI6tRCo61lpxxbLksPYstxhGmtV75cpr8x9K",
        "chunks": 1
      }
    },
    {
      "name": "google.com",
      "type": "TXT",
      "ttl": 247,
      "data": "\"Z29vZ2xl\"",
      "fields": {
        "text": "Z29vZ2xl",
        "chunks": 1
      }
    },
    {
      "name": "google.com",
      "type": "TXT",
      "ttl": 247,
      "data": "\"docusign=05958488-4752-4ef2-95eb-aa7ba8a3bd0e\"",
      "fields": {
        "text": "docusign=05958488-4752-4ef2-95eb-aa7ba8a3bd0e",
        "chunks": 1
      }
    },
    {
      "name": "google.com",
      "type": "TXT",
      "ttl": 247,
      "data": "\"v=spf1 include:_spf.google.com ~all\"",
      "fields": {
        "text": "v=spf1 include:_spf.google.com ~all",
        "chunks": 1
      }
    },
    {
      "name": "google.com",
      "type": "TXT",
      "ttl": 247,
      "data": "\"cisco-ci-domain-verification=47c38bc8c4b74b7233e9053220c1bbe76bcc1cd33c7acf7acd36cd6a5332004b\"",
      "fields": {
        "text": "cisco-ci-domain-verification=47c38bc8c4b74b7233e9053220c1bbe76bcc1cd33c7acf7acd36cd6a5332004b",
        "chunks": 1
      }
    },
    {
      "name": "google.com",
      "type": "TXT",
      "ttl": 247,
      "data": "\"_r4rd1pvwyrpi7sw4a3hzmw8e51yh9td\"",
      "fields": {
        "text": "_r4rd1pvwyrpi7sw4a3hzmw8e51yh9td",
        "chunks": 1
      }
    },
    {
      "name": "google.com",
      "type": "TXT",
      "ttl": 247,
      "data": "\"google-site-verification=TV9-DBe4R80X4v0M4U_bd_J9cpOJM0nikft0jAgjmsQ\"",
      "fields": {
        "text": "google-site-verification=TV9-DBe4R80X4v0M4U_bd_J9cpOJM0nikft0jAgjmsQ",
        "chunks": 1
      }
    },
    {
      "name": "google.com",
      "type": "TXT",
      "ttl": 247,
      "data": "\"MS=E4A68B9AB2BB9670BCE15412F62916164C0B20BB\"",
      "fields": {
        "text": "MS=E4A68B9AB2BB9670BCE15412F62916164C0B20BB",
        "chunks": 1
      }
    },
    {
      "name": "google.com",
      "type": "TXT",
      "ttl": 247,
      "data": "\"work-accounts-domain-verification=Tcj6JjIMZOw2KsSEw2Nt2rLae89tN6\"",
      "fields": {
        "text": "work-accounts-domain-verification=Tcj6JjIMZOw2KsSEw2Nt2rLae89tN6",
        "chunks": 1
      }
    }
  ],
  "authority": [],
  "queries": [
    {
      "type": "TXT",
      "rcode": "NOERROR",
      "records": 17,
      "ms": 16,
      "ad": false
    }
  ],
  "ede": [],
  "notes": [],
  "truncated": false,
  "server": "1.1.1.1",
  "minTtl": 247
}

What TXT records are used for

A TXT record holds text. It was designed for notes, and today it carries mostly machine-readable policies and proofs. Email authentication depends on it, and so does proving to Google, Microsoft or a certificate authority that you control a domain. This lookup shows every TXT record at a name exactly as it is published.

Looks likeWherePurpose
v=spf1 include:_spf.google.com ~allDomain rootSPF: which servers may send email as the domain. Check it with the SPF checker.
v=DMARC1; p=quarantine; rua=mailto:..._dmarc. + domainDMARC policy. Use the DMARC checker.
v=DKIM1; k=rsa; p=MIGf...selector._domainkey. + domainDKIM public key, used to verify signatures.
google-site-verification=...Domain rootProves ownership to Google services.
MS=ms12345678Domain rootProves ownership to Microsoft 365.
_acme-challenge values_acme-challenge. + domainA temporary token for a certificate authority's DNS validation.
v=BIMI1; l=https://...default._bimi. + domainBrand logo for email clients.
v=STSv1; id=..._mta-sts. + domainAnnounces an MTA-STS mail transport policy.

How to read the right record

  1. Choose the exact nameFor SPF, use the plain domain. For DMARC, use _dmarc.example.com. For DKIM, use selector._domainkey.example.com, where the selector is the name your sending service gave you.
  2. Read each record in fullA name can have several TXT records. Each one is shown separately, with its TTL.
  3. Match it to what the service expectsCopy the value your provider gave you and compare it character by character, including quotes, semicolons and spaces.

How TXT values are stored

  • 255-byte strings. One character-string in DNS holds at most 255 bytes. Longer values, such as DKIM keys, are stored as several strings that receivers join with no space between them.
  • Quotes are display only. Zone files and some DNS panels show quotes around each string. They are not part of the data.
  • Several TXT records at one name are allowed and common, for verification tokens. A domain must publish only one SPF record, though. Two v=spf1 records cause an error at receivers (RFC 7208).
  • Size. A big set of TXT records makes DNS responses large. Over UDP they may need to switch to TCP, which some firewalls block.
  • Case. Tags like v=spf1 are case-insensitive, but DKIM keys and verification codes must be copied exactly.

Common problems

  • Verification fails but the record looks right. Check that it sits at the right name (the root, not www), that your DNS host did not add the domain a second time, and that caches have expired.
  • A DKIM key is rejected as invalid. The public key was probably cut short, wrapped with line breaks or given extra spaces when pasted. Copy it again as one continuous value.
  • Two SPF records. Merge them into one that combines all the include: mechanisms.
  • Extra quotes in the value. Some DNS panels add quotes for you. If the lookup shows literal quote characters inside the text, remove the ones you typed.
  • A TXT record at a CNAME name. A name with a CNAME cannot hold a TXT record. Move the TXT or the CNAME.
  • Secrets in TXT. DNS is public. Never publish API keys or passwords there.

How the lookup works and the standards

LookupOwl asks for type TXT (code 16) and shows each record as one text value, with its character-strings joined the way SPF and DKIM receivers read them. If a name carries more than one v=spf1 record, the lookup flags it. The record type is defined in RFC 1035. The common uses are specified in RFC 7208 (SPF), RFC 6376 (DKIM), RFC 7489 and its successor RFC 9989 (DMARC), and RFC 8461 (MTA-STS).

Shell
dig +short TXT example.com
dig +short TXT _dmarc.example.com
dig +short TXT selector1._domainkey.example.com

Questions people ask

What is a TXT record?

A TXT record is a DNS record that stores text. Today it mostly holds email policies such as SPF and DMARC, DKIM public keys, and tokens that prove you own a domain. Anyone can read it, because DNS is public. A name can have many TXT records at the same time.

How do I check a domain's SPF record?

Look up the TXT records of the domain and find the one that starts with v=spf1. That is the SPF record. It lists the servers allowed to send email for the domain. For a full check, including the limit of ten DNS lookups, use the SPF record checker.

Why is a TXT value split into pieces?

DNS limits each string to 255 bytes, so a long value is stored as several strings inside one record. Software joins them back together, with nothing added between the pieces. In this lookup you should see one continuous value. Long DKIM keys are the usual reason.

How many TXT records can a domain have?

As many as you need, as long as the total DNS response stays reasonably small. Some domains publish dozens of verification tokens at the root. SPF is the one exception, because only one v=spf1 record is allowed per name. Very large sets can push responses over the UDP size limit and slow lookups down.

Can I delete old verification TXT records?

Usually yes, once the service has verified you, but not always. Some services re-check from time to time and may lock you out if the token is gone. Check the provider's documentation before you remove one, and note which service each token belongs to so that cleanup is safe next time.

How do I find a DKIM selector?

Open a message you received from the domain and look at its DKIM-Signature header. The s= value is the selector, and the d= value is the domain. The public key then lives in a TXT record at s._domainkey. followed by the d= domain, which you can look up here.

Use it from AI, the API or the command line

Every LookupOwl tool is also a free API and an MCP tool, with no key and no account. This one is dns_lookup. Please be kind to the rate limits.

curl
curl "https://lookupowl.com/api/v1/tools/dns-lookup?q=google.com"
MCP
claude mcp add --transport http lookupowl https://lookupowl.com/mcp

Description for AI agents · OpenAPI · llms.txt