TXT Records Explained: Domain Verification, SPF and More

What a TXT Record Is

A TXT record stores free text on a DNS name. DNS itself does not interpret it; other services read it. Because only someone who controls a domain’s DNS can add records, TXT records are the standard way to prove domain ownership and to publish email policies.

View all TXT records of a domain with our DNS Record Lookup.

Common Uses

Domain Verification

Services ask you to add a unique value to prove you own the domain. Examples:

• google-site-verification=... – Google Search Console and other Google services;
• MS=ms... – Microsoft 365;
• facebook-domain-verification=... – Meta business tools.

These records can stay after verification; some services re-check them periodically.

Email Authentication

• SPF on the domain itself: v=spf1 ... -all
• DMARC at _dmarc.example.com
• DKIM public keys at selector._domainkey.example.com

See SPF, DKIM and DMARC explained.

Certificate Validation

Certificate authorities can verify domain control with a TXT record at _acme-challenge.example.com (used by Let’s Encrypt and other ACME clients). This is required for wildcard certificates.

Rules and Mistakes

• Multiple TXT records are allowed on the same name — but only one SPF record. Two records starting with v=spf1 make SPF fail.
• Long values: a single text string is limited to 255 characters. Longer values (such as DKIM keys) are split into several strings within one record; most DNS panels do this automatically.
• Quotes: some panels need the value in quotes, others add them. Doubled quotes end up in the value and break verification.
• Wrong name: panels that automatically append the domain turn _dmarc.example.com into _dmarc.example.com.example.com. Enter only _dmarc in such panels.
• Edited at the wrong provider: TXT records must be added where the domain’s nameservers point.

Cleaning Up

Over the years domains collect TXT records for services no longer used. Old verification records are mostly harmless, but they reveal which services you use. Remove records for services you have left, and keep a short note of what each remaining record is for.

After Adding a Record

Verification can fail if the service checks before resolvers see the new record. Check it with the DNS Propagation Checker and try again once it appears.