GlossaryDNS
TXT record
Definition
A TXT record attaches free text to a domain name. DNS itself gives it no meaning: the services that read it — mail systems, platforms, search engines — are the ones that decide what its contents mean.
Two uses, and almost nothing else
The first is proof of ownership: a platform generates a string, asks you to publish it, then confirms it is there. Only somebody with control of the domain's DNS could have done that, which is proof enough. The second is email authentication: SPF, DKIM and DMARC are three TXT records, published at three different places in the zone.
One name can carry several TXT records, and that is normal — verification tokens pile up over the years, one per tool. There is one exception, and it is brutal: SPF. A domain must publish exactly one. Two SPF records on the same name do not give you the more permissive of the two, they give you an error.
Four TXT records from one domain
Four lines, four jobs, and above all four different names.
example.com. 3600 IN TXT "v=spf1 include:_spf.example.net ~all"
example.com. 3600 IN TXT "example-site-verification=7f3b9a2c41"
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
selector1._domainkey.example.com. 3600 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."Only the first two lines sit at the root. DMARC lives on the name “_dmarc”, DKIM on a name containing its selector: looking for a DKIM key at the domain root will never find one, even when it is published correctly.
The usual mistake
Adding a second SPF record to authorize a new sending tool, instead of extending the one that already exists. Each line is valid on its own; together they make the domain's SPF unusable, and legitimate mail starts being treated as suspicious.
How to avoid it: One SPF per domain: the new sender goes inside the existing record. And after any change, read back all the TXT records on that name — this is the part of the zone where old tokens accumulate and nobody ever tidies up.
Source: The TXT record is defined in RFC 1035. SPF uniqueness is a rule from RFC 7208, which also sets the 255-character chunking of the text.
Related terms
Where to go next
Knowing the words is half the job
The other half is knowing which of your domains is about to become a problem. DomainVigil watches expiry, DNS, certificates and reputation, and tells you before your client does.
Start for freeFive domains free, forever. No card required.