How to Check DNS TXT Records on Linux

Performing a dns txt record lookup reveals verification data, security policies, and other human-readable information associated with a domain. TXT records store arbitrary text strings. Organizations use them for email authentication (SPF, DKIM, DMARC), domain ownership verification, and ACME (Let's Encrypt) challenges.

dns txt record lookup

This guide demonstrates how to perform a dns txt record lookup using command-line tools and web-based utilities. You will retrieve TXT records for a specified domain. These records often contain critical security configurations for email, domain validation, and other services.

Prerequisites

• A computer with an internet connection.
• Access to a command-line interface (CLI) on Linux, macOS, or Windows.
• Basic understanding of DNS concepts.

Step-by-step instructions with exact commands and expected output

You can perform a dns txt record lookup using various command-line tools. Each operating system provides slightly different default utilities. We will cover `dig`, `nslookup`, and `host`.

Method 1: Using `dig` (Linux/macOS)

The `dig` utility is a flexible tool for querying DNS name servers. It is typically pre-installed on Linux and macOS systems. 1. Open your terminal. Launch a new terminal window. On macOS, find "Terminal" in Applications/Utilities. On Linux, search for "Terminal" in your applications menu. 2. Execute the `dig` command for TXT records. Specify the domain you want to query and the record type `TXT`. For example, to query `example.com`:

dig example.com TXT

This command asks your configured DNS resolver for TXT records for `example.com`. 3. Analyze the output. The output contains several sections. Look for the `ANSWER SECTION`. This section lists the TXT records found.

; <<>> DiG 9.16.1-Ubuntu <<>> example.com TXT
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36724
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags:; udp: 65494
    ;; QUESTION SECTION:
    ;example.com.                   IN      TXT

    ;; ANSWER SECTION:
    example.com.            3599    IN      TXT     "v=spf1 -all"
    example.com.            3599    IN      TXT     "google-site-verification=someverificationstring"

    ;; Query time: 1 msec
    ;; SERVER: 127.0.0.53#53(127.0.0.53)
    ;; WHEN: Mon May 06 10:30:00 UTC 2024
    ;; MSG SIZE  rcvd: 120

In this example, two TXT records exist: `v=spf1 -all` (an SPF record) and `google-site-verification=someverificationstring` (a domain verification record). 4. Query a specific subdomain for TXT records. TXT records can also exist on subdomains. For instance, many DKIM records are found under `selector._domainkey.example.com`.

dig selector1._domainkey.example.com TXT

Expected output will show the DKIM public key if available:

;; ANSWER SECTION:
    selector1._domainkey.example.com. 300 IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDYJtY..."

Method 2: Using `nslookup` (Windows/Linux/macOS)

The `nslookup` utility is available on Windows, Linux, and macOS. It offers an interactive mode for multiple queries. 1. Open your command prompt or terminal. On Windows, search for "cmd" or "PowerShell". On Linux/macOS, open your terminal. 2. Enter `nslookup` interactive mode. Type `nslookup` and press Enter. The prompt changes to `>`.

nslookup
    >

3. Set the query type to TXT. At the `>` prompt, type `set type=TXT` and press Enter.

nslookup
    > set type=TXT

4. Query the domain. Enter the domain name you want to query, e.g., `example.com`, and press Enter.

nslookup
    > set type=TXT
    > example.com

Expected output:

Server:     192.168.1.1
    Address:    192.168.1.1#53

    Non-authoritative answer:
    example.com     text = "v=spf1 -all"
    example.com     text = "google-site-verification=someverificationstring"

The `text =` lines show the TXT record content. 5. Exit `nslookup` interactive mode. Type `exit` and press Enter.

nslookup
    > set type=TXT
    > example.com
    ...
    > exit

6. Perform a direct `nslookup` query (non-interactive). You can also use `nslookup` directly from the command line without entering interactive mode.

nslookup -query=TXT example.com

Expected output:

Server:     192.168.1.1
    Address:    192.168.1.1#53

    Non-authoritative answer:
    example.com     text = "v=spf1 -all"
    example.com     text = "google-site-verification=someverificationstring"

Method 3: Using `host` (Linux/macOS)

The `host` command is a simpler utility for performing DNS lookups. It is often faster for quick queries. 1. Open your terminal. Launch a new terminal window. 2. Execute the `host` command for TXT records. Use the `-t TXT` option followed by the domain name.

host -t TXT example.com

Expected output:

example.com descriptive text "v=spf1 -all"
    example.com descriptive text "google-site-verification=someverificationstring"

The `descriptive text` lines indicate the TXT record content.

Method 4: Using Secably's Online DNS Lookup Tool

Web-based tools offer a convenient alternative without command-line interaction. Secably provides a free DNS lookup tool. 1. Navigate to the Secably DNS Lookup tool. Open your web browser and go to Secably's DNS lookup tool. 2. Enter the domain and select TXT record type. Input `example.com` into the "Domain or IP" field. Select "TXT" from the "Record Type" dropdown menu. 3. Initiate the lookup. Click the "Lookup" button. 4. Review the results. The tool displays all found TXT records clearly. This includes the record content, TTL, and record type. This method simplifies the dns txt record lookup process for users unfamiliar with CLI. You can also use other Secably tools, like the free website vulnerability scanner, to assess overall domain security.

Verification steps

After performing a dns txt record lookup, verify the returned information against expected values. This ensures the records are correctly configured and publicly accessible. 1. Confirm SPF record presence and correctness. Many domains use SPF records to prevent email spoofing. Look for a record starting with `v=spf1`. Check if it includes all legitimate sending servers and has an appropriate `~all` (softfail) or `-all` (hardfail) mechanism. An incorrect SPF record can cause email delivery issues or leave your domain vulnerable to spoofing. 2. Validate DKIM records. If your domain uses DKIM for email authentication, locate records typically named `selector._domainkey.yourdomain.com`. These contain the public key (`p=`). You can often compare this public key with the one provided by your email service provider (e.g., Google Workspace, Microsoft 365) to ensure they match. Missing or incorrect DKIM records weaken email security. 3. Check for domain verification tokens. Services like Google, Bing, and various certificate authorities use TXT records for domain ownership verification. These records contain unique strings. Confirm the presence of these tokens if you expect them. For example, `google-site-verification=...` or `_acme-challenge=...` for Let's Encrypt certificates. The absence of an expected verification token indicates a setup problem. 4. Cross-reference with multiple tools. Use more than one lookup method to confirm consistency. Querying with `dig`, `nslookup`, and an online tool like Secably's DNS lookup provides a broader view. Discrepancies might indicate DNS propagation delays or misconfigurations on specific DNS servers. You can also explore DNS history for a domain using resources like How to Check DNS History on Linux, Mac.

Troubleshooting section

Encountering issues during a dns txt record lookup is common. Here are a few typical problems and their solutions. 1. "No TXT records found" or empty answer section.

• Problem: The command returns an empty `ANSWER SECTION` or explicitly states "No TXT records found". This can happen even if you believe records exist.
• Reason: The domain might genuinely lack TXT records, or you might be querying the wrong domain/subdomain. DNS propagation delays can also cause this if records were recently added.
• Solution:
• Double-check the domain name for typos.
• Ensure you are querying the correct subdomain for specific records (e.g., `_dmarc.example.com` for DMARC, `selector._domainkey.example.com` for DKIM).
• Wait for DNS propagation. New DNS records can take minutes to hours to propagate globally. Use a tool like `dig @8.8.8.8 example.com TXT` to query Google's public DNS server directly, bypassing your local resolver.
• Contact your domain registrar or DNS hosting provider to confirm if TXT records are configured correctly on their end.

dig nonexistantdomain12345.com TXT

Expected output for no records:

;; ANSWER SECTION:
    ;; (empty)

2. DNS server timeout or connection refused.

• Problem: The command hangs, returns a timeout error, or indicates a connection refusal.
• Reason: Your local DNS resolver might be unresponsive, or network connectivity issues prevent reaching the DNS server.
• Solution:
• Verify your internet connection.
• Try querying a different DNS server directly using `dig @8.8.8.8 example.com TXT` (Google DNS) or `dig @1.1.1.1 example.com TXT` (Cloudflare DNS). This bypasses your default resolver.
• Restart your network equipment (router, modem).
• Check your firewall settings. Ensure outbound UDP port 53 (DNS) is not blocked.

dig @192.0.2.1 example.com TXT  # Assuming 192.0.2.1 is an unreachable/invalid DNS server

Expected output for timeout:

; <<>> DiG 9.16.1-Ubuntu <<>> @192.0.2.1 example.com TXT
    ; (1 server found)
    ;; global options: +cmd
    ;; connection timed out; no servers could be reached

3. Incorrect or unexpected TXT record content.

• Problem: You retrieve TXT records, but their content is not what you expect (e.g., an old SPF record, a malformed DKIM key).
• Reason: The records might be outdated, incorrectly entered, or multiple conflicting records exist for the same type.
• Solution:
• Review the TTL (Time To Live) value in the `dig` output. If it's high, changes take longer to propagate.
• Access your DNS hosting provider's control panel. Verify the exact TXT record values entered. Look for duplicate or conflicting entries. For instance, multiple `v=spf1` records are invalid.
• Ensure no hidden characters or formatting issues exist in the record content. Sometimes, copy-pasting can introduce invisible errors.
• If troubleshooting email authentication, use specific validation tools from your email provider or a third-party SPF/DKIM validator.
• Consider using tools like Zondex for broader internet-wide scanning and reconnaissance to see how your DNS records appear from various vantage points.

example.com.            3599    IN      TXT     "v=spf1 ip4:192.168.1.1 -all"
    example.com.            3599    IN      TXT     "v=spf1 include:otherservice.com ~all"

This shows two SPF records, which is an invalid configuration. Only one `v=spf1` record should exist per domain. 4. Permissions errors on Windows (nslookup).

• Problem: On some locked-down Windows systems, `nslookup` might fail or show permission-related errors.
• Reason: Insufficient user privileges to execute network commands or access DNS settings.
• Solution:
• Run your Command Prompt or PowerShell as an administrator. Right-click the shortcut and select "Run as administrator." This elevates privileges for the session.

# Attempting nslookup without admin privileges on a restricted system
    nslookup -query=TXT example.com

Expected error (example):

*** Can't find server name for address 192.168.1.1: No response from server
    *** Default servers are not available

Running as administrator often resolves this by allowing proper communication with DNS resolvers. Secably offers various paid monitoring plans, starting at $19/month, for continuous vulnerability scanning and attack surface management. A free tier is also available for instant tools without signup.