TinyPingTinyPing

TXT Record Lookup

See every TXT record on a domain or hostname with its TTL, and which ones are SPF, DMARC, DKIM or verification tokens for Google, Microsoft, Facebook and others. Enter a name such as example.com or _dmarc.example.com.

Common TXT record problems

Domain verification keeps failing

The token was added to the wrong name (for example a host field of "example.com" that the DNS panel turned into example.com.example.com), copied with extra quotes or spaces, or is not yet visible because of caching. Compare the value shown here with the one Google, Microsoft or your SaaS tool asks for.

More than one SPF record

A domain must have exactly one TXT record starting with v=spf1. Two of them make SPF fail with a permanent error, so receivers treat your mail as unauthenticated. Merge them into one record with all the include: mechanisms.

DMARC or DKIM record not found

These do not live on the domain itself. DMARC is at _dmarc.example.com and DKIM is at <selector>._domainkey.example.com. Look up those exact names here, not example.com.

Long record cut off or split wrongly

A single TXT string is limited to 255 characters, so long values such as DKIM keys are stored as several strings that are joined together. Some DNS panels split them for you, others need you to paste them in quoted chunks. A missing piece breaks the key.

Old verification tokens piling up

Tokens from tools you no longer use are harmless for email but make the zone hard to read and can let a former vendor re-verify your domain. Remove the ones you cannot account for.

How to look up TXT records

  1. Enter the name to check: example.com for SPF and verification tokens, _dmarc.example.com for DMARC, or selector._domainkey.example.com for DKIM.
  2. Click Look up TXT.
  3. Find the record you expect among the labelled results and compare its value character by character.
  4. If you just added it, wait for the TTL to pass and check again before retrying verification.

What is a TXT record?

A TXT record stores free text on a DNS name. It was meant for human-readable notes, but today it is mostly machine-readable: services use it to prove you control a domain and mail servers use it to decide whether to trust your email.

SPF lists the servers allowed to send mail for your domain and starts with v=spf1. DMARC tells receivers what to do with mail that fails SPF and DKIM, and lives at _dmarc. DKIM publishes a public key at a selector under _domainkey, so receivers can check the signature on your messages.

Verification tokens such as google-site-verification=, MS=, facebook-domain-verification= and apple-domain-verification= prove to those services that you own the domain. You can keep several of them on the same name.

One TXT record can hold several strings of up to 255 characters each, which are joined when read. A name can also have many TXT records, but only one of them may be SPF.

example.com.         3600  IN  TXT  "v=spf1 include:_spf.google.com ~all"
example.com.         3600  IN  TXT  "google-site-verification=abc123..."
_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:[email protected]"

When to use a TXT record lookup

Verifying a domain in Google Search Console or Workspace

Confirm the google-site-verification token is public and exact before you click Verify.

Adding a new email sender

When you add Mailchimp, SendGrid or HubSpot, check the SPF record still exists only once and includes every service that sends for you.

Setting up Microsoft 365

Check the MS= verification token and the SPF include for spf.protection.outlook.com are in place.

Auditing an inherited domain

List every TXT record to see which services were connected to the domain and which tokens can be removed.

Check something else

Frequently asked questions

Can a domain have more than one TXT record?

Yes. A name can have as many TXT records as you need, for example several verification tokens. The exception is SPF: only one record starting with v=spf1 is allowed.

Where do I find my DMARC and DKIM records?

DMARC is a TXT record on _dmarc.yourdomain.com. DKIM is on selector._domainkey.yourdomain.com, where the selector comes from your email provider (for example google for Google Workspace, or selector1 and selector2 for Microsoft 365).

Should TXT values include quotes?

The quotes are part of how DNS displays TXT strings. Most DNS panels add them for you, so paste the value without quotes unless your provider's help says otherwise.

Why does my TXT record not show up yet?

If the name had no TXT record before, resolvers may have cached that negative answer for the time set in the SOA record. Wait a little and check again. Also confirm the record was saved on the exact name you are looking up.

Can I delete old verification records?

Usually yes, once the service no longer needs them. Some, like Google's, are checked again later, and removing them can unverify the domain. Keep tokens for services you still use.

Stop checking manually

DNS changes made for one service can break another. TinyPing checks your site every 5 minutes and alerts you when:

  • the domain stops resolving
  • the site returns an error or times out
  • an expired certificate breaks HTTPS
Start monitoring free for 7 days

US$6.99 a month or US$47 a year per 50 monitors, team members free. 7-day free trial, no card needed.

Want alerts in team chat? Follow the guide for Slack or Google Chat.