Run a lookup
How it works
Paste the domains
One per line. Email addresses work too — the domain is taken from the right of the @.
Query TXT over DoH
The lookup goes from your browser straight to Cloudflare's resolver, with Google as a fallback.
Read the whole set
Every string is listed with its TTL, so you can see what is actually published rather than what you remember publishing.
Spot the conflicts
Two SPF records, an abandoned verification string, a policy pointing at a provider you left — they all show up here.
Why TXT is where domains go wrong
TXT is the junk drawer of DNS. It was never designed for any particular purpose, which is exactly why SPF, DMARC, DKIM, MTA-STS, BIMI, TLS reporting and every SaaS ownership check ended up living inside it. A single domain can easily carry a dozen TXT records added by five different people across three years, and nothing in a normal DNS panel encourages anyone to read them as a set.
That matters because several of these records are only valid in the singular. A domain with two SPF records does not get the union of both — it gets a permanent error, and every receiver that checks SPF treats the result as unauthenticated. The same applies to a second DMARC record at _dmarc. These are among the most common faults on a sending fleet, and they are invisible unless you list the records side by side.
What you are looking for
Duplicates. More than one v=spf1 string is a hard failure, not a warning. It usually happens when a new provider is onboarded by someone who adds a record rather than editing the existing one.
Abandoned includes. An SPF record still authorising a platform you stopped paying for last year is a live authorisation for whoever inherits that infrastructure. Removing them is free and takes a minute.
Verification strings that outlived their purpose. Harmless individually, but they map your vendor stack for anyone who reads them, and on a domain you are trying to keep quiet that is information you gave away for nothing.
Policy records pointing at the wrong place. An MTA-STS record whose id has not changed since the policy file was rewritten, or a TLS reporting address that bounces, both fail silently.
Where it fits
This is the raw view. When you want the record parsed and graded rather than just printed, use the SPF checker, DMARC checker or DKIM checker instead — each one knows the syntax of its own record and will tell you what is broken. TXT lookup is what you run first, when you want to see everything that exists before deciding which layer to dig into.
Frequently asked questions
Why does my domain show two SPF records?
Almost always because a second sending provider was onboarded by adding a record instead of editing the existing one. The result is a permanent SPF error — receivers do not merge them, they fail the check. Merge the includes into a single v=spf1 string and delete the other, then confirm you are still under ten DNS lookups.
Do TXT records slow down mail delivery?
Not meaningfully. They are cached like any other record and a receiver looks up only the ones it needs. What does cost you is nesting SPF includes, because each one is a separate DNS lookup against a hard limit of ten. Count them with the SPF lookup counter rather than guessing.
Is it safe to delete old verification strings?
Usually, but check first. Some platforms re-verify periodically and will disable a feature silently if the record has gone. The safe order is to confirm inside the vendor's console that the domain is still verified, remove the record, then re-check the console a week later.
Why can I see a TXT record in my DNS panel but not here?
Either the change has not propagated yet, or the panel you are editing is not the authoritative one. The second is more common than people expect on a fleet — run the NS checker to confirm which provider actually answers for the domain before you trust any panel.
What is the maximum length of a TXT record?
Each individual string is capped at 255 characters, but a record can hold several strings which are concatenated when read. This is why long DKIM keys appear split into quoted chunks. Providers handle the splitting for you; problems arise when a chunk is edited by hand and a quote goes missing.
Can I look up TXT records on a subdomain?
Yes — enter the full hostname. This matters for DKIM, where the record lives at selector._domainkey, and for MTA-STS and TLS reporting, which live at _mta-sts and _smtp._tls. A lookup on the bare domain will not show them.
Last reviewed
What to run next
The checks that most often follow this one.
More in this category
Guides that go deeper
When the tools tell you something is wrong
The diagnostics here are free and always will be. When the fix is bigger than a DNS record, this is the work I do.
Deliverability rescue
Mail landing in spam, replies gone quiet, or a domain suddenly blocked. I find the actual cause rather than guessing, and fix it.
- Authentication and alignment failures
- Blocklist delistings and reputation repair
- Gateway and filter-level blocks
- A written report on what broke and why
Email & sending infrastructure
Sending domains, inboxes, authentication and warmup, built to survive volume instead of burning down in a month.
- Domain and inbox fleets at any scale
- SPF, DKIM, DMARC and tracking domains
- Google Workspace and Microsoft 365 inboxes
- Handover documentation you actually own
Domain, DNS & migration
Changing registrar, mail provider or host without a day of downtime or a week of mail silently failing.
- Registrar and nameserver moves
- Workspace and Microsoft 365 migrations
- MX, SSL and subdomain cutover
- Staged rollout with rollback at every step
Monitoring & retainer
Infrastructure drifts. Records get edited, certificates expire, domains get listed. Ongoing eyes on the fleet.
- Scheduled checks across every domain
- Alerts before your clients notice
- Monthly reporting
- Priority response when something breaks
Start with a call
Bring a domain and the symptom. I will tell you what is actually wrong and whether you need me at all — plenty of people leave that call able to fix it themselves.
Thirty minutes, no pitch
We will run the checks together on your actual domains, and you will leave knowing what is broken, what it takes to fix, and what it should cost. If that is a job you can do in-house, I will say so.