How to check TXT records from the command line?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Need to verify your email authentication records are actually live in DNS? The command line is your fastest path. You don't need fancy tools. Just a terminal and three simple commands.
Using dig (best for details): Open your terminal and type:
dig TXT yourdomain.com
This pulls back everything. For DKIM records, add the selector:
dig TXT selector._domainkey.yourdomain.com
For DMARC records:
dig TXT _dmarc.yourdomain.com
Pro tip: Add +short at the end to clean up the output and make it easier to read.
Using nslookup (simpler syntax):
nslookup -type=TXT yourdomain.com
Using host (quickest):
host -t TXT yourdomain.com
All three do the same job. Pick whichever feels natural to you.
Want to dig deeper? You can query a specific nameserver with dig @8.8.8.8 TXT yourdomain.com. You can also check authoritative servers: dig +trace TXT yourdomain.com. This shows you the full resolution chain, which helps if you're troubleshooting DNS propagation issues.
Now when your records are working, you'll see the full text returned. Long records (like DKIM keys) may show as multiple quoted strings. If you see nothing, your record isn't published yet. If you see an error, something's misconfigured.
Still once you've got these commands down, you can quickly verify your SPF, check your DKIM setup, and confirm your DMARC policy is live. Want to cross-check results? Use a TXT record lookup tool for a second opinion.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
