TXT lookup

A TXT holds one or more text strings (RFC 1035 §3.3.14), each up to 255 characters; SPF and DKIM join them when reading (RFC 7208 §3.3). Mail keeps SPF here (at the domain), DMARC (at _dmarc.), DKIM keys (at selector._domainkey.), MTA-STS (at _mta-sts.) and TLS-RPT (at _smtp._tls.).

• NXDOMAIN, NODATA or an error

  NXDOMAIN: the name does not exist. NODATA: the name exists but lacks the type asked (RFC 2308 §2.1, §2.2). Both are definite answers. A timeout or SERVFAIL says nothing about the record, so we show them as "unavailable".

• TTL

  How long the answer may be cached, in seconds; the number shown is what is left in our resolver's cache. Negative answers are cached too, at most for the SOA MINIMUM field (RFC 2308 §4, §5): a newly created record may only appear after it.

• DNSSEC

  "DNSSEC validated" means our resolver checked the signatures and considers the answer authentic (the AD bit, RFC 4035 §3.2.3). "No DNSSEC": the zone is not signed, or the chain of trust does not reach it.

• Aliases (CNAME)

  A CNAME points a name at another, and the resolver follows the chain and answers for its target (RFC 1034 §3.6.2). A name with a CNAME can have no other records, and MX and NS must not point at an alias (RFC 2181 §10.3).

Sources: RFC 1034 · RFC 1035 · RFC 2181 · RFC 2308 · RFC 4035