DNS TXT Record Lookup: dig, nslookup & Online Tools
ChatGPT
Claude
Gemini
Perplexity
GrokIn brief
Look up DNS TXT records with dig, nslookup, PowerShell, or our free online checker. Find and interpret SPF, DKIM, DMARC, BIMI, and verification records.
A DNS TXT record lookup returns the text records published at one exact DNS name. The fastest options are:
- Browser: enter the hostname in the free DNS lookup tool and select TXT.
- macOS or Linux: run
dig TXT example.com. - Windows: run
nslookup -type=TXT example.comorResolve-DnsName -Name example.com -Type TXTin PowerShell.
_dmarc.example.com, DKIM at ._domainkey.example.com default._bimi.example.com.
Run a DNS TXT lookup online
Use the Palisade DNS lookup tool when you want the public answer without opening a terminal:
- Enter the full hostname you need to inspect, such as
_dmarc.example.com. - Select TXT as the record type.
- Run the lookup and read each returned string.
- Repeat with the exact hostname used by the service or protocol you are troubleshooting.
DNS TXT lookup commands you can copy
macOS and Linux with dig
Query TXT records at the root domain:
dig TXT example.comReturn a shorter answer without the surrounding DNS response:
dig +short TXT example.comQuery the most common email-security TXT records:
dig +short TXT _dmarc.example.com
dig +short TXT selector1._domainkey.example.com
dig +short TXT default._bimi.example.com
dig +short TXT _smtp._tls.example.comReplace selector1 with the DKIM selector used by the sending service. A generic DKIM lookup cannot discover every selector; the selector normally comes from the provider's setup instructions or a real message header.
To compare a specific resolver with your default resolver, add its IP address:
dig +short TXT _dmarc.example.com @1.1.1.1
dig +short TXT _dmarc.example.com @8.8.8.8Windows with nslookup
Run a one-line TXT query in Command Prompt or PowerShell:
nslookup -type=TXT example.comQuery a DMARC hostname through Cloudflare's public resolver:
nslookup -type=TXT _dmarc.example.com 1.1.1.1You can also open the interactive nslookup prompt:
nslookup
set type=TXT
_dmarc.example.comType exit when you are finished.
Windows with PowerShell
PowerShell returns structured DNS output that is easier to filter or reuse in a script:
Resolve-DnsName -Name example.com -Type TXTFor DMARC:
Resolve-DnsName -Name _dmarc.example.com -Type TXTIf your system resolver appears stale, specify another DNS server:
Resolve-DnsName -Name _dmarc.example.com -Type TXT -Server 1.1.1.1Which hostname should you query?
| Record | Typical hostname | Value usually starts with |
|---|---|---|
| SPF | example.com | v=spf1 |
| DKIM | | v=DKIM1 or a public key |
| DMARC | _dmarc.example.com | v=DMARC1 |
| BIMI | default._bimi.example.com | v=BIMI1 |
| TLS reporting | _smtp._tls.example.com | v=TLSRPTv1 |
| Service verification | Provider-specific | A token supplied by the provider |
The root domain is not a universal shortcut. Querying example.com can reveal SPF and verification tokens, but it will not normally return DMARC, DKIM, or BIMI because those records use dedicated hostnames.
How to read the result
Quoted strings may be one logical record
DNS software can split a long TXT value into several quoted character strings. Tools may display an SPF or DKIM record as two adjacent quoted sections even though DNS returns one logical TXT record. Join the strings in order before interpreting the value.
An empty answer is different from an error
- No TXT answer: the hostname resolves, but no TXT record is published there.
- NXDOMAIN: the queried hostname does not exist.
- SERVFAIL: the resolver could not complete the lookup, often because of a DNS or DNSSEC problem.
- Timeout: the resolver or network did not answer in time.
TTL explains part of propagation
The time to live (TTL) tells recursive resolvers how long they may cache an answer. After you change a TXT record, one resolver can show the new value while another still serves the cached value. Compare more than one public resolver and the authoritative nameserver before declaring propagation complete.
Use the DNS propagation guide for a step-by-step comparison.
How to interpret email-authentication TXT records
SPF
An SPF record starts with v=spf1 and lists mechanisms that authorize sending infrastructure. A domain must not publish multiple SPF records at the same hostname; use the SPF checker to inspect syntax and the DNS-lookup chain.
DKIM
A DKIM record is tied to a selector. The query name looks like selector._domainkey.example.com. DNS can show the published public key, but only a real signed message proves which selector and signing domain the production stream used. The DKIM checker is useful once you know the selector.
DMARC
A DMARC record starts with v=DMARC1 and is published at _dmarc.example.com. Read the p= policy, reporting addresses, and alignment tags. The DMARC checker validates the public record and explains each state.
BIMI
A BIMI record starts with v=BIMI1 and is normally published at default._bimi.example.com. It points to the logo and, when used, certificate evidence. Use the BIMI checker to validate the public record, but remember that each mailbox provider applies its own display criteria.
Troubleshoot a TXT record that is missing or stale
Work through these checks in order:
- Confirm the full hostname.
_dmarc,_domainkey, and_bimiare not interchangeable. - Check the provider's host-field convention. Some DNS panels want only
_dmarc; others want_dmarc.example.com. Entering the full domain when the panel appends it automatically can create_dmarc.example.com.example.com. - Check authoritative DNS. Make sure you edited the DNS zone used by the domain's current nameservers, not an old registrar panel.
- Compare resolvers. Query your default resolver,
1.1.1.1, and8.8.8.8. - Wait out the previous TTL. Lowering the TTL after a change does not erase answers already cached under the old TTL.
- Look for duplicates. Multiple SPF or DMARC records at the same hostname can invalidate evaluation even though the lookup returns text.
- Preserve exact punctuation. Missing semicolons, smart quotes, copied line breaks, or an incorrect hostname can make a record unusable.
Check the full public email-security posture
Use the Email Security Score when you want one public-domain assessment across DMARC, SPF, DKIM, BIMI, MX, MTA-STS, and TLS-RPT. It is a point-in-time DNS assessment, not continuous monitoring or proof of inbox placement.
Questions readers ask
Frequently asked questions
Written by
Taylor TabusaCo-Founder & Head of Business Development, Palisade
Taylor Tabusa is the co-founder and Head of Business Development at Palisade, helping managed service providers turn email security into a practical, valuable service.
More from Taylor →
