DNS lookup

Check the TXT records of a domain, including SPF and DMARC

TXT records hold text that other services read: mail policies, ownership proofs for search engines and keys. The tool shows the domain's records and the DMARC record at _dmarc.

What the TXT record shows

SPF lists the servers allowed to send mail for the domain and starts with v=spf1. A domain must have one SPF record: two records starting with v=spf1 break the check.

DMARC lives at _dmarc.domain and tells receivers what to do with mail that fails SPF and DKIM. DKIM keys sit at selector._domainkey.domain, and your mail provider gives you the selector.

When you need it

Check SPF and DMARC of a sender domain before a campaign
Confirm that a verification record for Google Search Console or Yandex Webmaster is live
Find which mail services a domain has authorised to send on its behalf

Questions about DNS records

01How do I check DKIM?

Enter selector._domainkey.yourdomain in the field, with the selector from your mail provider, for example google._domainkey.example.com.

02What do ~all and -all mean in SPF?

-all tells receivers to reject mail from servers not in the list, ~all asks them to accept it but mark it as suspicious.

03Why is my DMARC record not found?

It must be a TXT record on the _dmarc subdomain and start with v=DMARC1. A record on the root domain does not count.

04What are TXT records like google-site-verification for?

Services use them to confirm you own the domain: Google Search Console, Bing Webmaster Tools, Microsoft 365. Keep them after verification: some services re-check ownership and drop access when the record is gone.

05Is there a length limit for a TXT record?

One string inside a TXT record holds up to 255 characters. Long values, such as a 2048-bit DKIM key, are split into several quoted strings that the receiver joins.