Scan TXT Records

Scanning TXT records…

Reading Your Scan Results Line by Line

This scanner performs three separate lookups in one pass: the domain's raw TXT records, its DMARC policy at _dmarc.yourdomain.com, and DKIM public keys across eight commonly used selectors (default, google, mail, k1, selector1, selector2, s1, s2). Together they paint a complete picture of a domain's email posture and service integrations.

Decoding an SPF Record

An SPF record is a single TXT entry starting with v=spf1. Take this realistic example:

v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.7 ~all

Read left to right: mail may be sent by Google's servers (include:_spf.google.com — this domain uses Gmail/Workspace), by SendGrid (a transactional email service, so the domain sends automated mail), and by one dedicated server at 203.0.113.7. The tail matters most: ~all (softfail) asks receivers to mark everything else as suspicious, while -all (hardfail) tells them to reject it outright. A record ending in +all is a serious misconfiguration — it authorizes the entire internet to send mail as that domain.

One hard limit trips up many setups: SPF allows at most 10 DNS lookups per evaluation. Every include: costs at least one. Chain too many services and SPF silently breaks with a permerror — one of the most common causes of legitimate mail landing in spam.

DKIM: Why Selectors Exist

DKIM keys live at selector._domainkey.domain.com, and the selector name is chosen by whoever sends the mail: Google uses google, Microsoft 365 uses selector1 and selector2, many ESPs use k1 or s1. That is why this tool probes eight selectors — finding a key at selector1 instantly tells you the domain runs Microsoft 365, even before you look at MX records. Multiple active selectors mean multiple sending systems, typical of a company using both a mail suite and a marketing platform.

DMARC Policies in Practice

DMARC ties SPF and DKIM together and instructs receivers what to do on failure. The p= tag is the heart of it: p=none is monitoring mode (deliver anyway, send me reports), p=quarantine sends failures to spam, and p=reject blocks them at the gate. Two lesser-known tags are worth checking in results: pct= applies the policy to only a percentage of mail (a staged rollout — pct=25 means three quarters of spoofed mail still gets through), and rua= reveals which address collects aggregate reports, which often exposes the security vendor a company uses.

Beyond email, TXT records double as a service fingerprint: google-site-verification= proves someone claimed the domain in Google Search Console, MS=ms… is Microsoft 365 tenant verification, and entries from Stripe, Atlassian, or Zoom reveal the SaaS stack behind a business — all public, all visible in one scan.

Frequently Asked Questions

The domain sends no authenticated email and has never verified ownership with common services. For an investor that suggests a dormant or parked domain; for a business owner it means email from this domain is trivially spoofable and likely to land in spam.
It can, but it must not — the standard requires exactly one record starting with v=spf1. Two SPF records cause receivers to return a permanent error and treat the domain as having no SPF at all. It is one of the most common misconfigurations this scanner reveals.
Start at p=none with a rua= reporting address, watch reports for two to four weeks, fix legitimate senders that fail, move to p=quarantine with pct=25 and ratchet up, and finish at p=reject. Jumping straight to reject without monitoring is how companies accidentally block their own invoices.
The domain may use a selector outside the eight we probe — selectors are arbitrary names, and some providers generate random ones. Check a real email's headers: the s= tag in the DKIM-Signature header names the exact selector to look up.
Not directly — search engines do not rank domains by TXT records. Indirectly they matter: verification records and mature email authentication signal an actively operated domain, which correlates with the traffic and backlink profiles that do carry value.