Skip to content
Webmaster Tools
DNS & domainsDNS LookupTXT record

TXT record

TXT records hold text on a domain: SPF, DKIM and DMARC policies and verification codes. The 255-byte string rule, real examples, how to check them and common mistakes.

What it is

A TXT record attaches free-form text to a name. RFC 1035 defined it for "descriptive text", but today it mostly carries machine-readable data: email authentication policies and proofs that you control a domain. A name can have many TXT records, and each service picks out the one that starts with its own prefix.

example.com.         3600  IN  TXT  "v=spf1 include:_spf.google.com ~all"
example.com.         3600  IN  TXT  "google-site-verification=abc123..."
_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

How it works

Field Example Meaning
Name example.com. or _dmarc.example.com. Where the text lives; many uses require a specific label
TTL 3600 Seconds resolvers may cache it
Type TXT Text record
Data "v=spf1 -all" One or more quoted character strings

Each character string holds at most 255 bytes. Longer values, such as a 2048-bit DKIM key, are split into several strings in one record, and readers join them with no separator:

selector1._domainkey.example.com. IN TXT ( "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."
                                            "...IDAQAB" )

So a space at the end of one chunk or the start of the next becomes part of the value. Most DNS panels split long values for you; paste the key as one line.

Common setups

  • SPF (RFC 7208) on the domain itself: v=spf1 include:_spf.google.com ~all for Google Workspace, v=spf1 include:spf.protection.outlook.com -all for Microsoft 365.
  • DKIM (RFC 6376) at <selector>._domainkey.example.com: the public key that signatures are checked against. Some providers use a CNAME there instead.
  • DMARC (RFC 7489) at _dmarc.example.com: what receivers should do when SPF and DKIM fail, and where to send reports.
  • Domain verification: google-site-verification=... for Search Console and Workspace, MS=ms12345678 for Microsoft 365, and similar tokens for other SaaS tools. They can usually stay after verification; delete the ones for services you no longer use.

How to check it

Use our DNS Lookup to list every TXT record on a name. For email records, the SPF Checker counts DNS lookups, the DMARC Checker parses the policy, and the Email Checker checks a DKIM selector too. From a terminal:

dig example.com TXT +short
dig _dmarc.example.com TXT +short
dig google._domainkey.example.com TXT +short
nslookup -type=TXT example.com

Common mistakes

  • Two SPF records. A domain may publish only one v=spf1 record; with two, SPF returns a permanent error. Merge them into one.
  • More than 10 DNS lookups in SPF. Each include:, a, mx, exists and redirect counts, nested includes too; past 10 the result is a permerror.
  • DMARC or DKIM on the wrong name. Panels that append the domain turn _dmarc.example.com into _dmarc.example.com.example.com; enter just _dmarc.
  • Smart quotes or extra quotes pasted from a document end up inside the value.
  • A TXT record on a name that has a CNAME. They can't coexist; see the CNAME rules.