TXT Record
Text Record
A DNS record that stores arbitrary text. It carries no address, but it has quietly become one of the most important record types on the internet — the home of email authentication and domain verification.
A TXT record lets a domain owner attach free-form text to a name in DNS. Unlike an A record or MX record, it does not point at a server — it simply publishes a string that any service can read. That openness is exactly why it became the universal place to put machine-readable policy and proof-of-ownership data.
What a TXT record looks like
; name TTL type value
example.com. 3600 TXT "v=spf1 include:_spf.google.com ~all"
example.com. 3600 TXT "google-site-verification=AbCdEf123..."
_dmarc.example.com. 3600 TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"
selector._domainkey.example.com. 3600 TXT "v=DKIM1; k=rsa; p=MIGfMA0..."The value is always quoted text. Long values (like a DKIM public key) may be split into multiple quoted chunks that resolvers concatenate.
The three big jobs of TXT records
| Use | Lives at | Purpose |
|---|---|---|
| SPF | the domain itself | Lists which servers may send mail for the domain |
| DKIM | selector._domainkey | Publishes the public key that verifies mail signatures |
| DMARC | _dmarc subdomain | Sets the policy tying SPF and DKIM to the visible sender |
| Verification | the domain or a token name | Proves you control the domain to a service or CA |
Domain verification, explained
When you add a custom domain to Google Workspace, Microsoft 365, a CDN, or request a TLS certificate, the provider often asks you to add a unique TXT record containing a token they generate. Because only someone with control of the domain's DNS can publish that exact string, seeing it appear proves ownership. Once verified, many providers tell you the record can be removed — though leaving it usually does no harm.
The one-SPF-record rule
TXT records are happy to coexist: a name can have a dozen of them at once. The critical exception is SPF. A domain must publish exactly one SPF TXT record — if a resolver finds two strings beginning with v=spf1, SPF evaluation returns permerror and email authentication breaks. When you need to authorise several mail sources, you merge them into a single record using include: mechanisms rather than adding a second SPF record.
Reading and debugging TXT records
# All TXT records for a domain
dig example.com TXT +short
# A DMARC policy lives on the _dmarc subdomain
dig _dmarc.example.com TXT +short
# Windows
nslookup -type=TXT example.comWhen a verification or email-auth record "isn't working," the cause is almost always one of: the change hasn't propagated past its TTL yet, it was placed on the wrong name, the quoting is malformed, or there is a duplicate SPF record. Reading the raw value with dig and comparing it character-for-character against what the service expects resolves most cases.