How to Look Up a Domain's TXT Records (and Tell What Each One Is)
A TXT record lookup returns the text records a domain publishes in DNS: its email authentication and the tokens that prove ownership to other services. Enter the domain in the TXT record lookup: it checks the domain and the underscore names email records live at, labels each record (SPF, DMARC, DKIM, BIMI, verification tokens) and flags a duplicate SPF or DMARC record.
Look up a domain's TXT records →
Look them up with the tool
- Open the TXT record lookup.
- Enter a domain, or a specific name such as
_dmarc.example.com. A URL or email address is trimmed to the host. - Optionally add a DKIM selector, such as
googleors1, to fetch that key too. - Press Look up TXT records and read the labels and any problems flagged at the top.
Look them up by hand
dig +short txt github.com | head -3
# "google-site-verification=UTM-3akMgubp6tQtgEuAkYNYLyYAvpTnnSrDMWoDR3o"
# "jamf-site-verification=XtaPNIYghF_e_xRDI8CjgQ"
# "krisp-domain-verification=ZlyiK7XLhnaoUQb2hpak1PLY7dFkl1WE"
dig +short txt github.com | grep spf1 # output shortened
# "v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com ... ip4:62.253.2" "27.114 ip4:166.78.69.169 ... ~all"
dig +short txt _dmarc.github.com
nslookup -type=txt github.com
When we ran these on 8 November 2026, github.com published 24 TXT records, most of them verification tokens for services such as Google, Stripe, Atlassian and Apple. Its SPF record is long enough to be split into two strings, mid-IP address. That's fine: RFC 7208, section 3.3 says the strings are joined with no space added.
What to look for
- One SPF record. RFC 7208, section 4.5 says more than one
v=spf1record produces a permerror, so SPF fails for every message. Merge them. See SPF record mistakes. - DMARC at
_dmarc. Av=DMARC1record on the bare domain does nothing. See how to check a domain's DMARC record. - DKIM at
selector._domainkey. Selectors can't be listed from DNS, so you need the one your provider uses. - Old verification tokens are harmless, but they show which services the domain has been connected to.
Next step: check the mailboxes behind the domain
TXT records tell you how a domain sends, not whether a given address on it exists. Upload a list at /verify to check every mailbox without sending. The first 100 checks are free with a Google sign-in, no card.
Pro, $39 a month: Unlimited email verification.* Never metered, never cut off. See pricing.
*Fair use: the first 100,000 checks a month at full speed, then slower, never cut off.
More: SPF, DKIM and DMARC explained, bulk DNS lookup for a list of domains.
Common questions
How do I check TXT records for a domain?
Enter the domain in the TXT record lookup, or run dig +short txt example.com (Mac, Linux) or nslookup -type=txt example.com (Windows).
Why don't I see my DMARC record in a TXT lookup?
DMARC lives at _dmarc.example.com, not on the domain itself. Look up that name, or use a tool that checks it for you.
Why is my SPF record split into two quoted strings?
One TXT string holds at most 255 characters, so long records are published as several strings. RFC 7208 says receivers join them with no space.
Can I have more than one TXT record?
Yes, as many as you need for verification tokens. But only one may start with v=spf1, and only one DMARC record at _dmarc.
Check your list before you send
Real mailbox checks over SMTP, and nothing is sent to the address. Sign in with Google and your first 100 email checks are free, no card. Plans for bigger lists are on the pricing page.