TXT record
A TXT record holds text. DNS doesn't care what it says, which made it the place every later standard put its settings: SPF, DKIM and DMARC for email, and the verification tokens that Google, Microsoft and hundreds of other services ask you to add to prove you own a domain.
| Record type | TXT |
|---|---|
| Type number | 16 |
| Used for | |
| How common | Everyday |
| Defined in | RFC 1035, RFC 1464 |
Format
<name> <ttl> IN TXT "<text>" ["<more text>" ...]
| Field | What it means | Accepted values |
|---|---|---|
| Name | Where the text lives. @ for SPF and most verification tokens; _dmarc for DMARC; selector._domainkey for DKIM. | A host name; underscores are allowed. |
| TTL | How long resolvers may cache it. | Seconds. |
| Text | One or more strings, joined together when read. | Each string up to 255 bytes, in double quotes. Longer values are split into several strings (most dashboards do it for you). A whole record can be a few thousand bytes, but keep it short. |
Check a TXT record
Type or paste a record in zone-file form (name, TTL, type, value) or just its value. Each part is explained as you type.
A valid TXT record (Domain verification).
| Part | What it means |
|---|---|
| Name@ | @ means the domain itself (the root, or apex), such as example.com. |
| TTL3600 | Resolvers may keep this answer for 1 hour before asking again. Changes can take that long to reach everyone. |
| ClassIN | Internet. Every record you'll write uses IN. |
| TypeTXT | Free text: SPF, DKIM, DMARC, verification. |
| Textgoogle-site-verification=rXOxyZounnZasA8Z7oaD3c14JdjS9aKSWvsR1EbUSIQ | 68 bytes. |
| Tokengoogle-site-verification=rXOxyZounnZasA8Z7oaD3c14JdjS9aKSWvsR1EbUSIQ | Proves to Google (Search Console or Workspace) that whoever controls the domain's DNS set up the account. Safe to keep; remove it if you stop using the service. |
Examples
SPF
@ 3600 IN TXT "v=spf1 include:_spf.google.com ~all"
Lists who may send email as the domain. See SPF.
DMARC
_dmarc 3600 IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
What receivers should do with mail that fails checks. See DMARC.
Long value split in two
sel1._domainkey 3600 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq8..." "...IDAQAB"
A 2048-bit DKIM key is too long for one string, so it's stored as two, joined with nothing in between.
Several TXT records at one name
@ 3600 IN TXT "v=spf1 include:_spf.google.com ~all" @ 3600 IN TXT "MS=ms12345678"
Fine: each is a separate record. Only SPF has the rule of one per name.
Strings, quotes and the 255 limit
Inside DNS, a TXT record is a list of strings, each at most 255 bytes. In a zone file you write each string in double quotes. When software reads the record it joins the strings with nothing in between, so "v=spf1 " "include:x ~all" reads as v=spf1 include:x ~all. Watch the spaces at the joins.
Dashboards differ: Cloudflare and most registrars take the text without quotes and split long values for you. Route 53 needs the quotes, and long values entered as several quoted strings.
Which TXT records are safe to remove?
Verification tokens are usually only checked once, but some services check again later and disable features if the token is gone. Remove them only for services you've stopped using. Never remove SPF, DKIM or DMARC records unless you're replacing them.
See it on a real domain
Or use the full TXT record lookup.
TTL
3600. Use 300 while you're testing SPF or DMARC changes. How TTL works
Common mistakes
- Two SPF records at the same name. Merge them into one; with two, SPF fails.
- A string longer than 255 characters entered at a host that doesn't split it, so the record is rejected or cut off.
- Quotes inside the value at a dashboard that adds its own, giving ""v=spf1 ..."".
- Putting the DMARC or DKIM record at @ instead of _dmarc or selector._domainkey.
- Smart quotes (“ ”) pasted from a document instead of plain double quotes.
At your DNS host
- Cloudflare: enter the text without quotes; long values are split for you.
- Route 53: wrap each string in double quotes, and split values over 255 characters into several quoted strings on one line.
- GoDaddy, Namecheap, Porkbun: enter the text without quotes.
Questions
What is a TXT record used for?
Mostly email security (SPF, DKIM, DMARC) and proving domain ownership to services such as Google Search Console, Microsoft 365 and Stripe. DNS itself doesn't read it.
Can a domain have several TXT records?
Yes, as many as you need. The one rule is that SPF must be a single record per name.
How long can a TXT record be?
Each string is limited to 255 bytes, and a record can hold several strings. In practice keep the whole record under about 2,000 bytes; very large answers need TCP and some networks block it.
This page is also available as Markdown.
Lemon Domains keeps every domain you own in one place, with expiry reminders, change monitoring and DNS editing from your AI assistant. Get started free