# TXT record

A TXT record holds text. DNS doesn't care what it says, which made it the place every later standard put its settings: SPF, DKIM and DMARC for email, and the verification tokens that Google, Microsoft and hundreds of other services ask you to add to prove you own a domain.

- Record type: TXT
- Type number: 16
- Used for: Email
- How common: Everyday
- Defined in: RFC 1035, RFC 1464

## Format

```
<name> <ttl> IN TXT "<text>" ["<more text>" ...]
```

| Field | What it means | Accepted values |
| --- | --- | --- |
| Name | Where the text lives. `@` for SPF and most verification tokens; `_dmarc` for DMARC; `selector._domainkey` for DKIM. | A host name; underscores are allowed. |
| TTL | How long resolvers may cache it. | Seconds. |
| Text | One or more strings, joined together when read. | Each string up to 255 bytes, in double quotes. Longer values are split into several strings (most dashboards do it for you). A whole record can be a few thousand bytes, but keep it short. |

## Examples

### SPF

```
@ 3600 IN TXT "v=spf1 include:_spf.google.com ~all"
```

Lists who may send email as the domain. See [SPF](https://lemon.domains/dns-records/spf).

### DMARC

```
_dmarc 3600 IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
```

What receivers should do with mail that fails checks. See [DMARC](https://lemon.domains/dns-records/dmarc).

### Long value split in two

```
sel1._domainkey 3600 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq8..." "...IDAQAB"
```

A 2048-bit DKIM key is too long for one string, so it's stored as two, joined with nothing in between.

### Several TXT records at one name

```
@ 3600 IN TXT "v=spf1 include:_spf.google.com ~all"
@ 3600 IN TXT "MS=ms12345678"
```

Fine: each is a separate record. Only SPF has the rule of one per name.

## Strings, quotes and the 255 limit

Inside DNS, a TXT record is a list of strings, each at most 255 bytes. In a zone file you write each string in double quotes. When software reads the record it joins the strings with nothing in between, so "v=spf1 " "include:x ~all" reads as v=spf1 include:x ~all. Watch the spaces at the joins.

Dashboards differ: Cloudflare and most registrars take the text without quotes and split long values for you. Route 53 needs the quotes, and long values entered as several quoted strings.

## Which TXT records are safe to remove?

Verification tokens are usually only checked once, but some services check again later and disable features if the token is gone. Remove them only for services you've stopped using. Never remove SPF, DKIM or DMARC records unless you're replacing them.

## TTL

3600. Use 300 while you're testing SPF or DMARC changes.

## Common mistakes

- Two SPF records at the same name. Merge them into one; with two, SPF fails.
- A string longer than 255 characters entered at a host that doesn't split it, so the record is rejected or cut off.
- Quotes inside the value at a dashboard that adds its own, giving ""v=spf1 ..."".
- Putting the DMARC or DKIM record at @ instead of _dmarc or selector._domainkey.
- Smart quotes (“ ”) pasted from a document instead of plain double quotes.

## At your DNS host

- Cloudflare: enter the text without quotes; long values are split for you.
- Route 53: wrap each string in double quotes, and split values over 255 characters into several quoted strings on one line.
- GoDaddy, Namecheap, Porkbun: enter the text without quotes.

## Questions

### What is a TXT record used for?

Mostly email security (SPF, DKIM, DMARC) and proving domain ownership to services such as Google Search Console, Microsoft 365 and Stripe. DNS itself doesn't read it.

### Can a domain have several TXT records?

Yes, as many as you need. The one rule is that SPF must be a single record per name.

### How long can a TXT record be?

Each string is limited to 255 bytes, and a record can hold several strings. In practice keep the whole record under about 2,000 bytes; very large answers need TCP and some networks block it.

## Related

- [SPF record](https://lemon.domains/dns-records/spf.md)
- [DKIM record](https://lemon.domains/dns-records/dkim.md)
- [DMARC record](https://lemon.domains/dns-records/dmarc.md)
- [Domain verification TXT records](https://lemon.domains/dns-records/verification.md)
- [MTA-STS record](https://lemon.domains/dns-records/mta-sts.md)
- [BIMI record](https://lemon.domains/dns-records/bimi.md)

Interactive version with a record checker and live lookup: https://lemon.domains/dns-records/txt