Query DNS TXT records to verify SPF, DKIM, DMARC, and domain verification entries for any domain.
TXT is the catch-all DNS record type, and this tool fetches every TXT record published at a hostname you enter. SPF policies, DKIM public keys, DMARC policies, and domain-verification strings all live in TXT records - and at three different names. SPF sits at the bare domain (example.com), DMARC at _dmarc.example.com, and a DKIM key at selector._domainkey.example.com. The query is sent from your browser to a public DNS resolver over HTTPS, so the answer reflects live DNS state. The usual mistake is entering only the bare domain and expecting everything: you get SPF and verification strings, never DKIM or DMARC.
A concrete input and expected output from the current implementation.
Input
spf.google.com
Expected output
v=spf1 include:_spf.google.com ~all
This is the record Google's own setup documentation tells Workspace customers to publish at spf.google.com, and the one google.com itself references. It contains no IP ranges: the include= delegates to _spf.google.com, whose records list Google's sending networks, and ~all soft-fails everything else.
The hostname you enter is queried exactly as typed, for DNS type TXT. Browsers cannot send raw DNS packets, so the request goes from your browser to a public resolver over HTTPS (DNS-over-HTTPS), and the resolver answers with the TXT records at that name - nothing more. The only network traffic this page generates is that query.
A TXT record is one or more quoted character-strings, each capped at 255 characters, which DNS consumers concatenate (RFC 1035); the result is shown joined, so a DKIM key split across several fragments reads as one continuous key. Records at one name are listed separately, and the leading version tag - v=spf1, v=DMARC1, v=DKIM1 - is how SPF, DMARC, and DKIM records are told apart from verification strings.
That the record is published, not that receivers accept it. SPF evaluation fails when there is more than one v=spf1 record at the MAIL FROM domain, when the record runs past 512 characters, or when its include chain exceeds 10 DNS lookups (RFC 7208). Start by counting the v=spf1 records the lookup returns - there must be exactly one.
No - the selector is chosen by whoever signs your mail, so you have to find it. Open a message you sent, view its raw headers, and read the s= tag of the DKIM-Signature line; then query s=._domainkey.yourdomain.com. Common defaults: google for Google Workspace, and selector1 or selector2 for Microsoft 365.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Format, validate, and beautify JSON with syntax highlighting and error detection.
Encode text or files to Base64 and decode Base64 strings back to their original form.
Format and indent SQL queries for better readability across all major dialects.
Convert HTML markup into clean Markdown syntax with support for tables and lists.
Write Markdown and see the rendered HTML output in real time with live preview.
Visualize unified diffs and patch files with color-coded additions and deletions.