TXT Record

In one line

The TXT record stores arbitrary text associated with a domain. It is the standard DNS mechanism for email authentication (SPF, DKIM, DMARC), domain ownership verification (Google Search Console, GitHub, AWS), and security policies. Multiple TXT records can coexist at the same name. Values over 255 bytes must be split into multiple quoted strings that the DNS implementation concatenates.

Description

TXT records contain human-readable or machine-readable text. Originally designed for informational annotations, they became the universal DNS extension point because of their flexibility. Virtually every DNS-based verification or policy mechanism uses TXT records. Syntax rules: Single value: example.com. IN TXT "v=spf1 include:_spf.google.com ~all" String chunking: a single TXT RR value is limited to 255 bytes per string. For longer values (DKIM public keys), split into adjacent quoted strings: google._domainkey.example.com. IN TXT ( "v=DKIM1; k=rsa; " "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQ..." "...rest of key..." ) The resolver concatenates the strings. RFC 4408 §3.1.3 specifies this. SPF (v=spf1...): Published at the zone apex: example.com TXT. Authorizes which IPs may send email on behalf of the domain. Only ONE SPF record is allowed per domain (multiple = PermError). Maximum 10 DNS lookups per evaluation (include: each count). DKIM (v=DKIM1...): Published at selector._domainkey.domain. Contains the public key for verifying message signatures. Multiple selectors are fine (key rotation). DMARC (v=DMARC1...): Published at _dmarc.domain. Sets policy (p=none/quarantine/reject) and reporting email (rua=). Domain verification: Services like Google Search Console, GitHub Pages, AWS Certificate Manager ask you to add a unique token as a TXT record to prove domain control. These can coexist with SPF, DKIM, and DMARC at the same name. Multiple TXT records: Unlike SPF, having multiple TXT records at the same name is valid DNS. Resolvers return all of them; the application picks the relevant one by prefix (v=spf1, v=DKIM1, v=DMARC1, google-site-verification=, etc.).

Fields

Examples

example.com.    3600    IN    TXT    "v=spf1 include:_spf.google.com include:sendgrid.net -all"

# Lookup:
dig TXT example.com +short

google._domainkey.example.com.    3600    IN    TXT    (
  "v=DKIM1; k=rsa; "
  "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC2v3VvVq"
  "...rest of base64-encoded public key..."
)

# Lookup:
dig TXT google._domainkey.example.com +short

_dmarc.example.com.    3600    IN    TXT    "v=DMARC1; p=reject; rua=mailto:[email protected]; adkim=r; aspf=r"

# Lookup:
dig TXT _dmarc.example.com +short

# Multiple TXT records at the same name are valid
example.com.    3600    IN    TXT    "v=spf1 include:_spf.google.com ~all"
example.com.    3600    IN    TXT    "google-site-verification=abc123def456"
example.com.    3600    IN    TXT    "MS=ms12345678"

# All are returned by the resolver; each app reads the one it recognises

# Check SPF:
dig TXT example.com +short

# Check DKIM:
dig TXT google._domainkey.example.com +short

# Check DMARC:
dig TXT _dmarc.example.com +short

# Check from a specific resolver (bypass cache):
dig TXT example.com @8.8.8.8 +short

# See raw TTL and authoritative answer:
dig TXT example.com

Related Record Types