What Is a TXT Record? The Versatile DNS Record Explained

What Is a TXT Record?

A TXT record (Text record) stores arbitrary text data in DNS. Originally designed for human-readable notes, TXT records are now critical for email authentication, domain ownership verification, and various security purposes.

The Basics

• TXT stands for "Text"
• Can contain any text data up to 255 characters per string
• Multiple strings can be concatenated for longer values
• Multiple TXT records can exist for the same hostname
• No specific format required (format depends on use case)

Common Uses

Example TXT Records

; SPF record
example.com.    3600    IN    TXT    "v=spf1 include:_spf.google.com ~all"

; DMARC policy
_dmarc.example.com.    3600    IN    TXT    "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

; Google site verification
example.com.    3600    IN    TXT    "google-site-verification=abc123xyz789"

; Microsoft 365 verification
example.com.    3600    IN    TXT    "MS=ms12345678"

SPF Records

SPF (Sender Policy Framework) tells receiving mail servers which IP addresses and servers are authorized to send email for your domain.

SPF Syntax

example.com.    3600    IN    TXT    "v=spf1 [mechanisms] [qualifier]all"

Common SPF Mechanisms

SPF Qualifiers

SPF Examples by Provider

Microsoft 365:

example.com.    TXT    "v=spf1 include:spf.protection.outlook.com -all"

Google Workspace:

example.com.    TXT    "v=spf1 include:_spf.google.com ~all"

Multiple Services:

example.com.    TXT    "v=spf1 include:spf.protection.outlook.com include:sendgrid.net ip4:198.51.100.25 -all"

SPF Best Practices

1. Only one SPF record per domain — Multiple SPF records cause failures
2. Stay under 10 DNS lookups — Include mechanisms count toward this
3. End with -all or ~all — Defines what happens to unauthorized senders
4. Be specific — Don't over-authorize with broad mechanisms

DKIM Records

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to emails, proving they haven't been altered and came from an authorized server.

How DKIM Works

1. Sending server signs email with private key
2. Public key published in DNS as TXT record
3. Receiving server retrieves public key from DNS
4. Signature verified against public key

DKIM Record Format

DKIM records are published at: selector._domainkey.example.com

selector1._domainkey.example.com.    3600    IN    TXT    "v=DKIM1; k=rsa; p=MIGfMA0GCS..."

DKIM Components

DKIM Examples

Microsoft 365 (CNAME-based):

selector1._domainkey.example.com.    CNAME    selector1-example-com._domainkey.example.onmicrosoft.com.
selector2._domainkey.example.com.    CNAME    selector2-example-com._domainkey.example.onmicrosoft.com.

Google Workspace:

google._domainkey.example.com.    TXT    "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A..."

Custom Mail Server:

mail._domainkey.example.com.    TXT    "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQ..."

DMARC Records

DMARC (Domain-based Message Authentication, Reporting & Conformance) tells receiving servers what to do when SPF or DKIM checks fail, and provides reporting.

DMARC Record Format

DMARC is always published at: _dmarc.example.com

_dmarc.example.com.    3600    IN    TXT    "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"

DMARC Tags

DMARC Policy Levels

Start permissive, gradually increase:

; Stage 1: Monitor only (no action taken)
_dmarc.example.com.    TXT    "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

; Stage 2: Quarantine suspicious email
_dmarc.example.com.    TXT    "v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.com"

; Stage 3: Full enforcement
_dmarc.example.com.    TXT    "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

Complete Email Authentication Example

; SPF - Who can send
example.com.    TXT    "v=spf1 include:spf.protection.outlook.com -all"

; DKIM - Signing verification
selector1._domainkey.example.com.    CNAME    selector1-example-com._domainkey.example.onmicrosoft.com.

; DMARC - Policy enforcement
_dmarc.example.com.    TXT    "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

Domain Verification

Many services require TXT records to prove domain ownership.

Google Search Console

example.com.    TXT    "google-site-verification=abc123xyz456789"

Microsoft 365

example.com.    TXT    "MS=ms12345678"

Facebook Domain Verification

example.com.    TXT    "facebook-domain-verification=abc123xyz789"

SSL Certificate Validation (DNS-01)

_acme-challenge.example.com.    TXT    "gfj9Xq...token-from-CA"

Keybase Verification

_keybase.example.com.    TXT    "keybase-site-verification=abc123"

Best Practices for MSPs

1. Audit Existing TXT Records

Many domains accumulate outdated TXT records. Regular audits prevent:

• Verification records for cancelled services
• Old SPF entries that waste DNS lookups
• Conflicting or duplicate records

2. Document Every TXT Record

Track:

• What service/purpose
• When it was added
• Whether it's still needed
• Contact for questions

3. Monitor SPF Lookup Limits

SPF is limited to 10 DNS lookups. Each include: counts as a lookup:

# Check SPF lookup count
dig +short TXT example.com | grep spf

# Use tools like mxtoolbox.com/spf.aspx

Solutions for too many lookups:

• Use ip4/ip6 instead of include where possible
• Consolidate email services
• Use SPF flattening services

4. Test Before Deploying DMARC Enforcement

1. Start with p=none to collect reports
2. Review reports for legitimate senders being blocked
3. Fix SPF/DKIM issues discovered
4. Gradually increase to p=quarantine then p=reject

5. Handle Long TXT Records Properly

Records over 255 characters must be split into multiple strings:

; Single long record split into strings
example.com.    TXT    "v=DKIM1; k=rsa; p=MIIBIjANBgkqhk" "iG9w0BAQEFAAOCAQ8AMIIBCgKCAQE..."

Most DNS providers handle this automatically.

Frequently Asked Questions

Can I have multiple TXT records for the same hostname?

Yes! Unlike some record types, multiple TXT records can coexist. However, you should only have one SPF record per domain (combine multiple sources into one).

Why is my SPF record failing?

Common causes:

• More than 10 DNS lookups
• Multiple SPF records (should be one)
• Missing authorized sender
• Syntax error in the record

How do I check if DKIM is working?

Send an email to a Gmail account and view the original message. Look for "DKIM: PASS" in the authentication results.

# Or query DNS directly
dig selector._domainkey.example.com TXT

What's the maximum length of a TXT record?

Each string is limited to 255 characters, but multiple strings can be concatenated. Most DNS providers support total lengths of 4096+ characters.

Do TXT records affect website performance?

No, TXT records are not queried during normal web browsing. They're only looked up when specifically requested by email servers, verification services, etc.

Get Started with Unified DNS

Email authentication with SPF, DKIM, and DMARC is critical but complex. Unified DNS lets you view, modify, audit, and backup TXT records across all your clients — with automated backups, Hudu documentation syncing, and support for multiple DNS providers in one dashboard.

Unified DNS is live — try it free for a month with code FREETRIAL2026 at billing setup. No commitment. Or request a demo for a walkthrough.