dnstimelineTXT and SPF record history
Look up a domain to see the TXT records published on the name itself, each with the date it was first recorded: SPF, and the verification tokens services ask you to add. DMARC and DKIM sit on other names and are not included.
SPF changes
SPF starts with v=spf1 and authorises sending servers for a mail domain, often through include: terms. An unmatched sender reaches the final all mechanism: -all produces fail, ~all softfail, ?all neutral and +all pass. The receiver decides how to handle those results; -all does not itself guarantee rejection. See RFC 7208 §8.
An SPF policy ending in +all authorises any sender that reaches that mechanism. In late 2024 a botnet of about 13,000 MikroTik routers sent malware while spoofing roughly 20,000 domains whose SPF was that permissive (Infoblox).
An old vendor’s include: can remain after the service is no longer used. If the included domain expires, whoever registers it can send mail that passes SPF for yours. It was one of the techniques the SubdoMailing campaign, disclosed in 2024, used to send mail from subdomains of major brands (Guardio Labs).
Comparing SPF values
| Difference between values | What to investigate |
|---|---|
An include: appears | A new source of sending permission; the service may handle marketing or transactional mail rather than inboxes. |
An include: disappears | That value no longer explicitly includes the service. Other mechanisms can still authorise the same IPs. |
~all becomes -all | The unmatched result changed from softfail to fail; actual delivery depends on the receiving system. |
+all appears | Any sender reaching this mechanism gets SPF pass. Verify today’s policy before treating it as a current issue. |
SPF mechanisms are evaluated in order. This tool compares the published text. It does not resolve includes or redirects, check DNS-lookup limits or test whether the current policy is valid.
Example: an additional SPF include
These invented values illustrate a comparison. The example.org and example.net names are placeholders; neither value comes from a lookup on this site.
| Value | SPF policy |
|---|---|
| Earlier | v=spf1 include:_spf.example.org ~all |
| Later | v=spf1 include:_spf.example.org include:relay.example.net ~all |
The literal addition is include:relay.example.net. The earlier include and the final ~all term remain the same. This comparison describes a policy change; it cannot confirm a mailbox migration or show which service actually sent messages.
An SPF evaluator consults the included policy to determine its result, as specified in RFC 7208, section 5.2. DNS Timeline compares the recorded text without resolving includes or evaluating sending IPs. To investigate receiving mail separately, compare the MX records; to evaluate sending permission now, use the current TXT value and its current dependencies.
Verification tokens
A verification token shows that a service’s verification string was published on this name. Its first-recorded date does not establish when an account was opened, when the verification succeeded or when the service entered use.
| TXT value starts with | Service |
|---|---|
google-site-verification= | Google (Search Console, Workspace) |
MS= | Microsoft 365 |
facebook-domain-verification= | Meta |
atlassian-domain-verification= | Atlassian |
apple-domain-verification= | Apple |
docusign= | DocuSign |
adobe-idp-site-verification= | Adobe |
openai-domain-verification= | OpenAI |
Tokens are rarely removed once the check is done, so a token that is still published does not prove the service is still in use.
Where to find DMARC and DKIM records
DMARC is published at _dmarc.example.com and each DKIM key at selector._domainkey.example.com, so this history does not include them. To read the current values, query them directly, for example dig TXT _dmarc.example.com. For DKIM you need the selector, which appears as s= in the DKIM-Signature header of a message sent by the domain.
Frequently asked questions
How do I see a domain's previous SPF record?
Look up the domain and filter the results on TXT. SPF values start with v=spf1 and are listed with the date each was recorded. An email address in a value is replaced with [email-hidden].
When did a domain change its SPF record?
A new collected value has its own first-recorded date. This can help investigate an edit, but does not confirm when the old policy stopped being published. Multiple historical values do not mean multiple SPF records coexist today.
Is an old SPF include a security risk?
It can be. Check that each domain named in an include: is still registered to the vendor you expect. If one has expired, remove the include before someone else registers it.