Query and retrieve DNS TXT records for any domain name. Verify active SPF, DKIM, and site ownership records.
A TXT (Text) record is a type of Domain Name System (DNS) resource record that allows a domain administrator to associate arbitrary text with a domain. Unlike A or MX records, which point to specific IP addresses or mail servers, TXT records are designed to provide human-readable or machine-parsable information to external entities. These records are critical for domain verification, email security frameworks, and third-party service integration.
When a client initiates a TXT record lookup, the recursive resolver queries the authoritative name server for the specific domain. The server returns a series of character strings. Because the DNS protocol originally limited the size of a single string to 255 characters, longer records are split into multiple strings, which the client must concatenate to reconstruct the full payload. This mechanism ensures that complex security policies, such as SPF (Sender Policy Framework), can be transmitted reliably across the global DNS infrastructure.
Our TXT Record Lookup tool provides a comprehensive suite of analysis features designed for network engineers and security analysts:
v=spf1 format and lack redundant mechanisms.p=quarantine or p=reject directives to assess email security posture.While our web interface provides a visual representation, developers often need to perform these lookups programmatically. You can retrieve TXT records using standard system tools or high-level programming languages.
For instance, using the dig utility in a bash environment is the industry standard for manual verification:
dig TXT example.com +shortFor automated workflows, Python's dnspython library offers a robust way to fetch and process these records:
import dns.resolver
domain = 'google.com'
answers = dns.resolver.resolve(domain, 'TXT')
for rdata in answers:
print(f'Record: {rdata.to_text()}')TXT records are public by design; anyone who can query your DNS can read your TXT records. Therefore, never store sensitive secrets, private keys, or passwords within a TXT record. Instead, use them for public identifiers. To maintain a secure environment, follow these guidelines:
PermError results during mail delivery.A TXT record contains descriptive text used for configuration and verification, whereas a CNAME (Canonical Name) record acts as an alias that maps one domain name to another. While a CNAME redirects a request to another hostname, a TXT record provides specific data to the requester without changing the destination of the DNS query. Consequently, you cannot have a CNAME and a TXT record on the same exact hostname due to DNS protocol restrictions.
A PermError typically occurs when the SPF record is syntactically incorrect or violates the RFC standards. The most common cause is having multiple SPF records defined for a single domain; the DNS specification allows only one SPF record per domain. Other causes include exceeding the 10-lookup limit for the 'include' mechanism or having trailing spaces and invalid characters within the record string.
TXT records are used to implement SPF, DKIM, and DMARC. SPF (Sender Policy Framework) lists the IP addresses authorized to send mail on behalf of your domain. DKIM (DomainKeys Identified Mail) provides a public key in a TXT record to verify the digital signature of the email. DMARC (Domain-based Message Authentication, Reporting, and Conformance) uses a TXT record to tell receiving servers what to do if SPF or DKIM fails, effectively stopping spoofed emails from reaching the inbox.
A single string within a TXT record is limited to 255 characters. However, a single TXT resource record can contain multiple strings, allowing the total record length to reach approximately 65,535 bytes. Most modern DNS clients and resolvers automatically concatenate these strings, but developers must ensure their parsing logic accounts for this segmentation to avoid truncating critical security data.
No, you should never store private API keys, passwords, or sensitive credentials in TXT records. DNS records are public and can be queried by anyone globally using simple tools like 'dig' or 'nslookup'. Storing secrets in DNS exposes your infrastructure to reconnaissance and unauthorized access. Instead, use secure environment variables or dedicated secret management vaults like HashiCorp Vault or AWS Secrets Manager.
Propagation time depends on the Time-to-Live (TTL) value assigned to the record. The TTL tells recursive resolvers how long to cache the record before querying the authoritative server again. If your TTL is set to 3600 seconds, it can take up to one hour for changes to be reflected worldwide. In some cases, stale caches at the ISP level may extend this window, though typically changes are visible within a few hours.