What is a TXT record?
Author: Domeny.ForSale editorial team Published
In brief: A TXT record is an entry in DNS, the system that handles domain names, which stores text information. It is used, among other things, to confirm control over a domain and publish email authentication settings. It does not redirect a website or specify a web server’s address — its meaning depends on the service that reads the stored text.
How does a TXT record work, and what does it contain?
DNS associates domain names with various types of information, not just server IP addresses. A TXT record makes text available under a specific name, such as example.com or _dmarc.example.com. A program querying DNS reads this text and interprets it according to the rules of the relevant service.
In a DNS management panel, you will usually see the following fields:
| Field | Meaning |
|---|---|
| Type | Select TXT. |
| Name / host | Specifies the name under which the record will be available. |
| Value / content | Text supplied by the service provider or determined by the configuration. |
| TTL | The length of time a DNS response may be cached. |
For the root domain, the name field often takes the @ symbol or is left blank. This is a convention used by a particular panel, not a universal instruction. Other panels require the full domain name, so check the guidance next to the field before saving.
A TXT record is publicly readable. Do not put passwords, private keys or confidential data in it. A verification token that a service provider intends for publication in DNS can be placed there according to its instructions.
What are TXT records used for?
One of the simplest uses is confirming control over a domain. An email provider, analytics tool or other service supplies a unique text string and asks you to add it to DNS. Reading the correct value allows the provider to verify that you can change the domain’s configuration. However, this is not proof of legal ownership of the name or the entire business.
Another important use concerns email:
- SPF specifies which servers may send email using a given domain in the envelope sender address. An SPF policy is published as a TXT record.
- DKIM allows the recipient to check a message’s cryptographic signature. The public key is usually published in TXT under a name such as
selektor._domainkey.example.com; some providers instead require a CNAME record pointing to their configuration. - DMARC sets rules for assessing whether authentication aligns with the domain visible in the “From” field, handling messages that do not meet these conditions, and reporting. The TXT record is placed under the name
_dmarc.example.com.
These mechanisms help reduce domain spoofing, but they do not guarantee that messages will reach the inbox. TXT is also sometimes used when issuing TLS certificates: DNS-01 validation involves publishing a specified value under the _acme-challenge name for the domain being validated.
How do you add a TXT record step by step?
Suppose a service asks you to add a TXT record with the value service-verification=abc123 to the root domain example.com. This is only an example — for an actual configuration, you need the value supplied by your own provider.
- Find out where the domain’s DNS is hosted. Add the record with the operator that runs its authoritative DNS servers, meaning the servers that are the source of answers for the domain. This does not have to be the company you pay for registration.
- Open the DNS zone for the correct domain. A zone is the set of records serving that domain. Choose to add a new TXT record.
- Enter the name according to the panel’s instructions. For the root domain, this may be
@, a blank field orexample.com. - Paste the exact value. Do not add spaces, line breaks or your own explanations. You can leave the TTL at its default unless the provider recommends otherwise.
- Save the record and start verification in the service. If the first attempt fails, check the DNS response before you start changing the record’s content.
Adding a separate verification record usually does not require deleting existing TXT records. After verification, check the service’s documentation to see whether the record should remain — some systems check it again.
How do you check the record and avoid errors?
You can check the record using a DNS query tool. In a terminal with dig available, use dig TXT example.com, or for DMARC: dig TXT _dmarc.example.com. An alternative is the command nslookup -type=TXT example.com.
A change may not be visible everywhere immediately. Some resolvers, the servers that act as intermediaries for DNS queries, may still cache the previous response according to its TTL. Information that a record does not exist may also be cached, so lowering the TTL only after making a change does not remove earlier cached copies.
The most common error is an incorrect record name. If the panel automatically appends the domain, entering the full _dmarc.example.com may create _dmarc.example.com.example.com. Another problem is editing DNS with an operator whose servers no longer serve the domain.
Several TXT records may exist under one name, but do not publish multiple independent SPF policies for the same name. When adding another email sender, you need to consolidate the required sources into a single policy rather than add a second record starting with v=spf1.
Quotation marks visible in a DNS query result are often simply a way of displaying the text. A single TXT record may also contain several strings, each up to 255 bytes long; this does not mean there is a limit of 255 characters for the entire record. For a long DKIM key, follow the DNS operator’s instructions rather than splitting it into independent records yourself.
Before saving, compare three elements against the service’s official instructions: the record type, the full target name and the value. After saving, check them in the DNS response — the mere appearance of the record in the panel does not yet confirm that it has been published correctly.
See also: What is Linux?
Read also
