Read the TXT records of a domain: SPF, site verification codes and other text
Runs in your browser. Only the lookup you start is sent to cloudflare-dns.com or dns.google; nothing else leaves your device. Updated on 25 Oct 2026.TXT records hold short pieces of text that other services read: the SPF line that lists who may send your mail, the codes Google, Microsoft and others ask you to add to prove you own a domain, and keys for DKIM when they sit at a selector name.
Leave Record type on TXT, which this page selects for you.
Type the domain, such as google.com, and press Look up.
Read each TXT record in the Data column, joined into one line, with its TTL beside it.
Compare it with the value your provider asked you to add, then press Copy records to keep a copy.
Type the domain and every TXT record comes back joined into one readable line each, with its TTL, so you can see whether the value you just added is live.
This DNS lookup asks a public resolver, Cloudflare 1.1.1.1 or Google 8.8.8.8, the same question dig or nslookup would, and shows the answer in a table. Pick one record type, or "All common types" to ask for A, AAAA, CNAME, MX, NS, TXT, SOA, CAA and HTTPS together. Every record shows its TTL in seconds and in words, because the TTL is how long any copy of it may be cached.
The records that are hard to read by eye are split into labelled fields. An SOA becomes its primary server, the contact mailbox, the serial and four timers. A CAA record becomes flags, tag and value. An SRV record becomes priority, weight, port and target, with the service named from the record's own name. DS and DNSKEY records show the algorithm by name, and the key tag of each DNSKEY is worked out so you can match it against the DS record at the parent.
The tool does not do zone transfers, query a domain's own name servers directly, or show records at names you do not type: DNS has no way to list every subdomain.
The rest of the article, and all 6 questions about DNS Lookup, are on the DNS Lookup page.
Only the name and the record type, sent from your browser to the resolver you chose: Cloudflare at cloudflare-dns.com or Google at dns.google. The resolver needs them to answer. Nothing else leaves your device, and this site never sees the names you type.
NXDOMAIN is the DNS answer for a name that does not exist at all, for any record type. Common causes are a typo, a subdomain that was never created, or a domain that has expired. A name that exists but lacks the type asked for gets a different answer: no records.
SERVFAIL means the resolver tried and could not get a trustworthy answer. Either the domain's own name servers did not reply, or the answer failed DNSSEC validation. The DNS Propagation Checker asks again with DNSSEC checking off, which shows which of the two it is.
No. DNS answers questions about names you already know; there is no query that lists every name in a zone, and zone transfers are refused by almost every public server. Certificate transparency logs are the usual way to discover subdomains, and this tool does not search them.
Still stuck? Ask about DNS Lookup and anybody who knows can answer. No account needed.
Same job, other tools: AS Number Lookup – Turn an AS number into the network name, registry and allocation date · IP to ASN Lookup – Map an IP address to the ASN that announces it, with the BGP prefix.
On the related tools: Open Port Checker – See if a port forwarded on your router is reachable from the internet.