TXT What is a TXT Record?
TXT records store free-form text in DNS, used for domain verification, SPF, DKIM, and DMARC. Learn how to read, configure, and troubleshoot TXT records.
What is a TXT record?
A TXT record stores arbitrary text data in DNS. Originally intended for human-readable notes, TXT records have become the standard mechanism for machine-readable domain metadata — particularly email security policies and domain ownership verification.
Anatomy of a TXT record
example.com. 3600 IN TXT "v=spf1 include:_spf.google.com ~all"| Field | Value | Description |
|---|---|---|
| Name | example.com. | The hostname. TXT records can also appear on subdomains (e.g. _dmarc.example.com.). |
| TTL | 3600 | Time-to-live in seconds. |
| Class | IN | Internet class. |
| Type | TXT | Record type. |
| Data | "v=spf1 ..." | The text string. Quoted in zone file notation. |
Common uses
SPF (Sender Policy Framework)
SPF declares which servers are authorised to send email for your domain. Receiving mail servers check this to detect spoofed senders.
example.com. IN TXT "v=spf1 include:_spf.google.com ~all"Important: A domain must have only one SPF record. Multiple SPF records cause a permanent error.
DKIM (DomainKeys Identified Mail)
DKIM stores a public key that recipients use to verify that email was signed by your mail server. The record is placed on a special subdomain.
selector._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCS..."DMARC (Domain-based Message Authentication)
DMARC ties SPF and DKIM together and specifies what to do with mail that fails both checks.
_dmarc.example.com. IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"Domain verification
Services like Google Search Console, GitHub, and Cloudflare ask you to add a TXT record to prove you control the domain.
example.com. IN TXT "google-site-verification=abc123..."Common mistakes
- Two SPF records — Only one SPF record is allowed per hostname. If you add a second one (e.g. to add a new mail provider), merge them into a single record instead.
- Long values — DNS limits each string chunk to 255 characters. For DKIM public keys that exceed this, the value is split into multiple quoted strings that resolvers concatenate:
"part1" "part2". - Wrong subdomain — DMARC goes on
_dmarc.example.com, notexample.com. DKIM goes onselector._domainkey.example.com. Check the exact name your provider specifies.
Frequently asked questions
Can I have multiple TXT records on the same hostname?
Yes, with one exception: only one SPF record is allowed per hostname. All other TXT records (DKIM, DMARC, verification tokens) can coexist freely.
What does ~all mean in an SPF record?
~all is a soft fail — mail from unlisted servers will be accepted but marked as suspicious. -all is a hard fail that rejects such mail outright. +all allows any server (dangerous). ?all is neutral.
What is a DKIM selector?
A selector is a label that lets a domain use multiple DKIM keys (e.g. one per mail provider). The selector appears in the email header and in the DNS record name: selector._domainkey.example.com.