# DNS TXT Record Lookup: dig, nslookup & Online Tools

> Look up DNS TXT records with dig, nslookup, PowerShell, or our free online checker. Find and interpret SPF, DKIM, DMARC, BIMI, and verification records.

A DNS TXT record lookup returns the text records published at one exact DNS name. The fastest options are:

- **Browser:** enter the hostname in the free [DNS lookup tool](/tools/dns-lookup) and select TXT.
- **macOS or Linux:** run `dig TXT example.com`.
- **Windows:** run `nslookup -type=TXT example.com` or `Resolve-DnsName -Name example.com -Type TXT` in PowerShell.

For email authentication, the hostname matters as much as the record type. SPF is usually published at the sending domain, DMARC at `_dmarc.example.com`, DKIM at `<selector>._domainkey.example.com`, and BIMI at `default._bimi.example.com`.

![DNS TXT record lookup commands and common email-authentication hostnames](/images/generated/demystifying-dns-txt-record-lookups-a-comprehensive-guide-for-windows-mac-and-linux-users.webp)

## Run a DNS TXT lookup online

Use the [Palisade DNS lookup tool](/tools/dns-lookup) when you want the public answer without opening a terminal:

1. Enter the full hostname you need to inspect, such as `_dmarc.example.com`.
2. Select **TXT** as the record type.
3. Run the lookup and read each returned string.
4. Repeat with the exact hostname used by the service or protocol you are troubleshooting.

A lookup reads public DNS. It does not change the domain, prove that a production message was signed correctly, or show a private mailbox provider decision.

## DNS TXT lookup commands you can copy

### macOS and Linux with dig

Query TXT records at the root domain:

```bash
dig TXT example.com
```

Return a shorter answer without the surrounding DNS response:

```bash
dig +short TXT example.com
```

Query the most common email-security TXT records:

```bash
dig +short TXT _dmarc.example.com
dig +short TXT selector1._domainkey.example.com
dig +short TXT default._bimi.example.com
dig +short TXT _smtp._tls.example.com
```

Replace `selector1` with the DKIM selector used by the sending service. A generic DKIM lookup cannot discover every selector; the selector normally comes from the provider's setup instructions or a real message header.

To compare a specific resolver with your default resolver, add its IP address:

```bash
dig +short TXT _dmarc.example.com @1.1.1.1
dig +short TXT _dmarc.example.com @8.8.8.8
```

### Windows with nslookup

Run a one-line TXT query in Command Prompt or PowerShell:

```text
nslookup -type=TXT example.com
```

Query a DMARC hostname through Cloudflare's public resolver:

```text
nslookup -type=TXT _dmarc.example.com 1.1.1.1
```

You can also open the interactive `nslookup` prompt:

```text
nslookup
set type=TXT
_dmarc.example.com
```

Type `exit` when you are finished.

### Windows with PowerShell

PowerShell returns structured DNS output that is easier to filter or reuse in a script:

```powershell
Resolve-DnsName -Name example.com -Type TXT
```

For DMARC:

```powershell
Resolve-DnsName -Name _dmarc.example.com -Type TXT
```

If your system resolver appears stale, specify another DNS server:

```powershell
Resolve-DnsName -Name _dmarc.example.com -Type TXT -Server 1.1.1.1
```

## Which hostname should you query?

| Record | Typical hostname | Value usually starts with |
|---|---|---|
| SPF | `example.com` | `v=spf1` |
| DKIM | `<selector>._domainkey.example.com` | `v=DKIM1` or a public key |
| DMARC | `_dmarc.example.com` | `v=DMARC1` |
| BIMI | `default._bimi.example.com` | `v=BIMI1` |
| TLS reporting | `_smtp._tls.example.com` | `v=TLSRPTv1` |
| Service verification | Provider-specific | A token supplied by the provider |

The root domain is not a universal shortcut. Querying `example.com` can reveal SPF and verification tokens, but it will not normally return DMARC, DKIM, or BIMI because those records use dedicated hostnames.

## How to read the result

### Quoted strings may be one logical record

DNS software can split a long TXT value into several quoted character strings. Tools may display an SPF or DKIM record as two adjacent quoted sections even though DNS returns one logical TXT record. Join the strings in order before interpreting the value.

### An empty answer is different from an error

- **No TXT answer:** the hostname resolves, but no TXT record is published there.
- **NXDOMAIN:** the queried hostname does not exist.
- **SERVFAIL:** the resolver could not complete the lookup, often because of a DNS or DNSSEC problem.
- **Timeout:** the resolver or network did not answer in time.

Check the exact hostname before assuming a record is missing.

### TTL explains part of propagation

The time to live (TTL) tells recursive resolvers how long they may cache an answer. After you change a TXT record, one resolver can show the new value while another still serves the cached value. Compare more than one public resolver and the authoritative nameserver before declaring propagation complete.

Use the [DNS propagation guide](/learning/how-long-does-dns-propagation-take-for-email-records) for a step-by-step comparison.

## How to interpret email-authentication TXT records

### SPF

An SPF record starts with `v=spf1` and lists mechanisms that authorize sending infrastructure. A domain must not publish multiple SPF records at the same hostname; use the [SPF checker](/tools/spf) to inspect syntax and the DNS-lookup chain.

### DKIM

A DKIM record is tied to a selector. The query name looks like `selector._domainkey.example.com`. DNS can show the published public key, but only a real signed message proves which selector and signing domain the production stream used. The [DKIM checker](/tools/dkim) is useful once you know the selector.

### DMARC

A DMARC record starts with `v=DMARC1` and is published at `_dmarc.example.com`. Read the `p=` policy, reporting addresses, and alignment tags. The [DMARC checker](/tools/dmarc) validates the public record and explains each state.

### BIMI

A BIMI record starts with `v=BIMI1` and is normally published at `default._bimi.example.com`. It points to the logo and, when used, certificate evidence. Use the [BIMI checker](/tools/bimi) to validate the public record, but remember that each mailbox provider applies its own display criteria.

## Troubleshoot a TXT record that is missing or stale

Work through these checks in order:

1. **Confirm the full hostname.** `_dmarc`, `_domainkey`, and `_bimi` are not interchangeable.
2. **Check the provider's host-field convention.** Some DNS panels want only `_dmarc`; others want `_dmarc.example.com`. Entering the full domain when the panel appends it automatically can create `_dmarc.example.com.example.com`.
3. **Check authoritative DNS.** Make sure you edited the DNS zone used by the domain's current nameservers, not an old registrar panel.
4. **Compare resolvers.** Query your default resolver, `1.1.1.1`, and `8.8.8.8`.
5. **Wait out the previous TTL.** Lowering the TTL after a change does not erase answers already cached under the old TTL.
6. **Look for duplicates.** Multiple SPF or DMARC records at the same hostname can invalidate evaluation even though the lookup returns text.
7. **Preserve exact punctuation.** Missing semicolons, smart quotes, copied line breaks, or an incorrect hostname can make a record unusable.

## Frequently asked questions

### How do I look up a TXT record for a domain?

Run `dig TXT example.com` on macOS or Linux, `nslookup -type=TXT example.com` on Windows, or use the browser-based [DNS lookup tool](/tools/dns-lookup). Replace the root domain with the full protocol hostname when checking DMARC, DKIM, BIMI, or TLS-RPT.

### Why does my TXT record show multiple quoted sections?

DNS permits one TXT record to contain multiple character strings. Many tools display those strings separately. Join them in order before reading a long SPF or DKIM value.

### Why can one DNS checker see my new record while another cannot?

Recursive resolvers cache answers according to TTL. They may refresh at different times. Compare public resolvers and the authoritative nameserver, then wait until the previous cached answer expires.

### Can a TXT lookup confirm that email authentication passes?

It can confirm what public DNS currently publishes. It cannot prove that a particular message used the expected Return-Path, DKIM selector, signing domain, or aligned identity. Use a real message header or the [email deliverability test](/tools/email-deliverability-test) for message-path evidence.

### Is a TXT record private?

No. Standard DNS TXT records are publicly queryable. Do not publish passwords, private keys, or secrets in them.

## Check the full public email-security posture

Use the [Email Security Score](/tools/email-security-score) when you want one public-domain assessment across DMARC, SPF, DKIM, BIMI, MX, MTA-STS, and TLS-RPT. It is a point-in-time DNS assessment, not continuous monitoring or proof of inbox placement.