What Is a TXT Record? SPF, DKIM, DMARC & Verification
DNS TXT records carry free-form text used for SPF, DKIM, DMARC and domain verification. The format, the 255-character string limit, and common mistakes.
ProfitTool Team
Security & Dev
What a TXT Record Is
A DNS TXT record holds arbitrary text associated with a domain. Originally designed for human-readable information, TXT records have become the standard mechanism for machine-readable domain metadata — email authentication, domain ownership verification, and service configuration.
Format
example.com 3600 IN TXT "v=spf1 include:sendgrid.net -all"TXT records can hold up to 255 characters per string, but multiple strings in a single record are concatenated by resolvers. Records longer than 255 characters (common for DKIM public keys) are split across multiple quoted strings.
Common TXT Record Uses
Email Authentication
- SPF:
v=spf1 ...at the domain root - DMARC:
v=DMARC1; ...at_dmarc.domain.com - DKIM: public key at
selector._domainkey.domain.com
Domain Ownership Verification
Services like Google Search Console, Microsoft 365, and Mailchimp use TXT records to verify that you control a domain before granting access:
example.com TXT "google-site-verification=abc123..."BIMI (Brand Indicators for Message Identification)
default._bimi.example.com TXT "v=BIMI1; l=https://example.com/logo.svg"Apple Domain Verification
_atproto.example.com TXT "did=did:plc:abc123"Multiple TXT Records
A domain can have multiple TXT records at the same name. Resolvers return all of them. SPF, however, must have exactly one TXT record starting with v=spf1 at the root — multiple SPF records cause a PermError.
Inspect TXT records for any domain with our DNS Lookup tool.
ProfitTool Team
Security & DevWritten and maintained by the ProfitTool team. Where an article references a ProfitTool utility, the behaviour described is the behaviour of the tool on this site — you can open it and check the output yourself.
More from the Knowledge Hub
What Is DMARC and How Do You Set It Up?
DMARC builds on SPF and DKIM to give domain owners control over what happens to unauthenticated email. This guide covers how DMARC works and how to configure it safely.
Privacy & SecurityHow to Read and Analyse Email Headers
Email headers contain a complete trace of every server an email passed through. This guide explains how to find headers in major email clients, what to look for, and how to detect spoofing.
Privacy & SecuritySPF vs DKIM vs DMARC: How Email Authentication Works
SPF, DKIM and DMARC work together to protect your domain from email spoofing and phishing. This guide explains what each one does and why you need all three.