Free tool
Read every TXT record on a domain, including SPF and verification strings.
Enter a domain to look up its TXT records.
A TXT record stores arbitrary text against a domain. In practice it powers email authentication (SPF), domain ownership verification for services like Google and Microsoft, and various security policies.
This tool lists every TXT record on a domain so you can confirm your SPF policy, verification tokens, and other entries are present and correct.
Several TXT records can share one name. A typical domain might have these three:
example.com. 3600 IN TXT "v=spf1 include:_spf.google.com ~all"
example.com. 3600 IN TXT "google-site-verification=EXAMPLE-TOKEN"
example.com. 3600 IN TXT "MS=ms00000000"
Each record holds one or more quoted strings of up to 255 characters. Services recognise their own record by its prefix: v=spf1 for SPF, google-site-verification= for Google, MS= for Microsoft 365, and so on.
Values longer than 255 characters, such as 2048-bit DKIM keys, are split into several strings inside one record. Whatever reads the record joins the strings back together with nothing between them, so where a long value is split does not matter.
Each TXT record gets its own row. Where a record is split into several quoted strings, the tool joins them into one, so you read the value the way receiving servers do. The bar shows how many TXT records the name has and the query time. Queries go live from the PulseStack™ server in the UK to Google Public DNS (8.8.8.8), with Cloudflare (1.1.1.1) as the fallback, and nothing is stored.
The tool reads the exact name you enter. DMARC lives at _dmarc.example.com and DKIM keys at selector._domainkey.example.com, so a lookup of the bare domain will not show them. Enter the full name to read the raw record, or use the DMARC checker and DKIM checker, which query those names for you and check what they find.
No TXT records found means the name publishes none. For a domain that sends email, that means it has no SPF record, which the SPF checker will confirm.
Two SPF records. Adding a new v=spf1 record for each email service, instead of merging them into one, makes SPF fail with a permanent error. Combine the includes into a single record.
Quotes added twice. Many DNS panels add the quote marks for you. Paste a value that already has quotes and they end up inside the record, which breaks SPF and verification checks. If a row here starts and ends with a quote mark, remove the extra quotes in your panel.
Verification tokens deleted too soon. Some services check that their token is still there long after setup; Google Search Console, for example, re-checks verification periodically. Removing the token can quietly cost you access.
Hidden characters. A value copied with a trailing space or a line break looks right in the panel but no longer matches what the service expects. Copy tokens straight from the provider.
Old clutter. Tokens for services you no longer use stay public and make every TXT response larger. Removing them is good housekeeping.
On macOS or Linux, run dig TXT example.com +short. On Windows, use nslookup -type=TXT example.com, or in PowerShell Resolve-DnsName -Name example.com -Type TXT. For DMARC, query the subdomain: dig TXT _dmarc.example.com +short.
dig prints each string in its own quotes, so a split DKIM key appears as several quoted chunks on one line. Join them without spaces to get the real value.
Because SPF and verification tokens live in TXT records, an accidental edit can break email or a connected service with no visible sign. A PulseStack™ DNS record monitor on a paid plan watches a TXT record as often as every five minutes and alerts you when no record contains the value you expect, such as your SPF include.
The most common uses are SPF (email sender policy), domain verification tokens for third-party services, DKIM keys, and site verification for search consoles. DMARC also lives in a TXT record at a specific subdomain.
A single TXT string is limited to 255 characters, but a record can contain several strings. Long values like DKIM keys are split across strings and joined back together by the software that reads them; this tool joins them for you.
Yes, significantly. SPF, and the DKIM keys often stored in TXT records, are checked by receiving mail servers. A wrong or missing SPF record can cause your mail to be marked as spam or rejected.
Because they are not on the bare domain. DMARC lives at _dmarc.example.com and DKIM at a selector name such as google._domainkey.example.com. Enter the full name here to read the raw record, or use the PulseStack™ DMARC checker and DKIM checker, which look up those names for you and check the values they find.
Every one runs a real check, live, with nothing to install.
PulseStack™ DNS record monitors check TXT, A, AAAA, MX, CNAME and NS records as often as every five minutes and alert you when the value you expect disappears. Included from the Starter plan at £9 a month, with a 14-day trial and no card.