TXT Record Lookup
Type a domain to see all its TXT records, with the two that decide whether its email is trusted read out for you. SPF (the v=spf1 record) lists the servers allowed to send its mail; this lookup follows every include: and counts the DNS lookups the record costs, because more than 10 makes the whole record fail (RFC 7208). DMARC lives at _dmarc.<domain> and tells receivers what to do with mail that fails: p=none only reports, p=quarantine sends it to spam, p=reject refuses it. Most of the other TXT records are ownership proofs such as google-site-verification.
Free, no sign-in, 20 lookups a minute. Answers are cached for 5 minutes. Also: DNS lookup, MX lookup, Nameserver lookup.
SPF and DMARC on well-known domains
Looked up on November 4, 2026 through Cloudflare's resolver, the same one this tool asks. Click a domain to run it live.
| Domain | TXT | SPF lookups | SPF ends | DMARC |
|---|---|---|---|---|
| google.com | 17 | 1 of 10 | ~all | p=reject |
| github.com | 24 | 10 of 10 | ~all | p=quarantine |
| stripe.com | 39 | 7 of 10 | ~all | p=reject |
| microsoft.com | 60 | 6 of 10 | -all | p=reject |
| wikipedia.org | 3 | 1 of 10 | ~all | p=reject |
Lookups are counted with every include followed. github.com sits at exactly 10, the most RFC 7208 allows; ~all soft-fails other senders, -all fails them.
TXT Record Lookup questions
What happens when SPF needs more than 10 DNS lookups?
The record fails with a permerror, and receivers treat the domain as having no valid SPF, so mail that relies on SPF to pass DMARC can land in spam or bounce. Every include:, a, mx, ptr, exists and redirect= counts, including the ones inside each include. github.com used exactly 10 of 10 on 4 November 2026, so one more include would break it. The fixes: remove services you no longer send through, swap an include for its ip4: ranges, or send bulk mail from a subdomain with its own record.
Should DMARC be p=none, quarantine or reject?
Start at p=none with a rua= address so you get the reports, fix every legitimate sender that fails, then move to quarantine and finally reject. Since February 2024 Gmail and Yahoo require bulk senders to publish at least p=none. On 4 November 2026 google.com, stripe.com, microsoft.com and wikipedia.org all published p=reject and github.com p=quarantine.
Can a domain have two SPF records?
No. With more than one v=spf1 record receivers cannot tell which applies and the check fails as a permerror (RFC 7208 section 3.2), which is worse than having none. This usually happens when a new email service asks you to add its own SPF record: merge its include: into the existing record instead. The lookup flags a second one.
Can I delete old verification TXT records?
For services you have stopped using, yes. For ones you still use, check first: Google Search Console keeps checking its google-site-verification record and drops your ownership if it disappears, while other services only check once at setup. They pile up: amazon.com published 66 TXT records and microsoft.com 60 on 4 November 2026, most of them verification tokens.
More free domain tools
The DNS lookup shows every record a domain publishes. The MX lookup shows which servers take a domain's email and who runs them. The Nameserver lookup shows a domain's nameservers and which company hosts its DNS. For who registered a name and when, use the WHOIS lookup, Domain age checker or Domain expiration checker. See which extensions a name is still free in with the domain availability checker, or price one in the domain value calculator.