TXT Record Lookup That Explains Every Record
Enter a domain or any host name. See every TXT record with its TTL and how it is split, what it is (SPF, DMARC, DKIM, BIMI or a verification token) and what to fix. Free, no sign-up, nothing stored.
Your Domain
Try it: salesforce.com, _dmarc.salesforce.com
Options: email records, DKIM selectors
In a sent email’s header: DKIM-Signature: … s=selector. Separate several with commas.
What Is a TXT Record?
A TXT record holds text a domain publishes in DNS. Mail servers read SPF, DKIM and DMARC from TXT records, and services such as Google or Microsoft 365 check a TXT token to confirm you own a domain.
DNS stores the text in strings of at most 255 octets. A longer record, such as a 2048-bit DKIM key, is split into several strings that SPF and DKIM join without spaces.
- Type
- TXT (16)
- String limit
- 255 octets each (RFC 1035)
- Several per name
- Yes; SPF and DMARC only once
- Changes show
- After the old TTL runs out
- Command line
dig TXT example.com
How to Read Your Result
Four parts, the most urgent first.
- 1
The Answer
How many records and of which kind, the resolver, DNSSEC and the time of the check.
- 2
What to Fix First
Two SPF records, DMARC or DKIM on the wrong name, quotes stored as text, an answer too large for one UDP packet.
- 3
Every Record Explained
Its kind, its parts in a table, the TTL, the size in octets and how it is split into strings.
- 4
Your Email Records
_dmarc, the common DKIM selectors, BIMI, MTA-STS and TLS reporting at once, each linked to its checker.
What Lives in TXT Records
The lookup recognises each of these by its start.
| Record | Starts with | Published at | Read by |
|---|---|---|---|
| SPF | v=spf1 | the domain (@) | receiving mail servers |
| DMARC | v=DMARC1 | _dmarc.example.com | receiving mail servers |
| DKIM | v=DKIM1; k=rsa; p=… | selector._domainkey.example.com | receiving mail servers |
| BIMI | v=BIMI1 | default._bimi.example.com | Gmail, Apple Mail, Yahoo |
| MTA-STS | v=STSv1; id=… | _mta-sts.example.com | sending mail servers |
| TLS reporting | v=TLSRPTv1 | _smtp._tls.example.com | sending mail servers |
| Verification token | google-site-verification=, MS=ms… | usually the domain (@) | the service that issued it |
Verification Tokens We Recognise
Each in the format the service documents. Other tokens show with the name they carry.
Tokens the lookup names
- Google.
google-site-verification=for Search Console and Google Workspace. - Microsoft 365.
MS=msfollowed by digits, from the Microsoft 365 admin center. - Apple.
apple-domain-verification=for Apple Business. - Stripe.
stripe-verification=. Keep it: Stripe checks it again later. - Zoho, Brevo.
zoho-verification=andbrevo-code:(with a colon). - GlobalSign, Docusign, Adobe.
globalsign-domain-verification=,docusign=,adobe-idp-site-verification=.
For Pardot and Marketing Cloud Next
Which DNS records Salesforce’s help pages ask for, checked 16 October 2026.
Account Engagement (Pardot)
Domain Management gives you two TXT records for a sending domain: a validation key and the DKIM key at
200608._domainkey. Look up both here to see if they are live. Account Engagement (Pardot) needs no SPF include.Marketing Cloud Next
An authenticated domain uses eight CNAME records; three carry the DKIM keys (
s1-e360-…). A TXT lookup at those names follows the CNAME and shows the key.
Common TXT Problems
What goes wrong most, and the fix.
- The Record Doesn’t Show Yet. Resolvers keep the old answer until its TTL runs out. Wait that long, then use Check Again. Also check the host: some panels add the domain, so _dmarc.example.com ends up as _dmarc.example.com.example.com.
- Two SPF Records. Only one record per name may start with v=spf1; with two, SPF fails for all mail. Merge them in the SPF generator.
- Quotes Stored as Text. Some DNS panels add quotes themselves. Paste the value without them, or the record starts with a quote mark.
- Record on the Wrong Name. DMARC belongs at _dmarc, DKIM at selector._domainkey. On the domain itself, receivers never find them.
- A Long Record in Several Strings. Normal above 255 octets. SPF and DKIM join the strings without spaces, so add no space at the split.
- Old Tokens Pile Up. Every token makes the answer larger. RFC 7208 recommends keeping a name’s TXT answer under 450 octets. Delete tokens of services you left.
TXT Record Lookup FAQ
Short answers to what people ask about TXT records.
How do I look up the TXT records of a domain?
Enter the domain above. On the command line: dig TXT example.com or nslookup -type=TXT example.com.
Why is my TXT record split into several quoted parts?
DNS stores text in strings of at most 255 octets, so longer records are split. SPF and DKIM join the parts without spaces; there is nothing to fix.
Why can’t I see the TXT record I just added?
Resolvers keep the previous answer until its TTL runs out. Also check the host name: some DNS panels add your domain to it, so enter only the part before the domain.
Can a domain have several TXT records?
Yes, as many as needed. Two exceptions: one SPF record per name, and one DMARC record at _dmarc.
Can I delete a verification record once the domain is verified?
It depends on the service. Some check again later (Stripe says so), so delete a token only when you no longer use the service.
Is TXT data case-sensitive?
Names are not; the text is stored as typed. Whether case matters depends on the reader: DKIM tags and values are case-sensitive, SPF mechanism names are not.
Is the name I look up stored?
No. Your browser sends the name to our server, which asks a public DNS resolver. Nothing is saved, no name is logged, and the resolver never sees your IP address.
More Free Tools
We Make Salesforce Marketing Work for You
Talk to a certified consultant, not a salesperson, and leave the first call knowing your next step.