What is a TXT record?
A TXT record is a DNS record that holds free text. It was meant for human notes, but today it carries machine-read settings: SPF and DMARC email policies, DKIM public keys, and the verification tokens that services such as Google, Microsoft 365 and Let's Encrypt use to confirm you control a domain.
What the labels mean
| Label | Starts with | Where it should live |
|---|---|---|
| SPF | v=spf1 | The domain itself (one record only) |
| DMARC | v=DMARC1 | _dmarc.example.com |
| DKIM | v=DKIM1 | selector._domainkey.example.com |
| MTA-STS / TLS-RPT | v=STSv1 / v=TLSRPTv1 | _mta-sts / _smtp._tls |
| BIMI | v=BIMI1 | default._bimi.example.com |
| Verification | google-site-verification=, MS=, facebook-domain-verification= … | Usually the domain itself |
Because each kind lives at its own name, a lookup of example.com shows SPF and verification tokens but not DMARC or DKIM. Enter _dmarc.example.com to see the DMARC record, or use the DMARC checker and DKIM checker, which know where to look.
Common TXT record mistakes
- Two SPF records. A domain may publish only one record starting with
v=spf1. With two, receivers return a permanent error and SPF fails for all mail. Merge them into one — the SPF checker shows the result. - Quotes inside the value. Some DNS panels add quotes automatically; typing your own produces
"\"v=spf1 …\"", which no receiver recognizes. - Records over 255 characters. A single TXT string is limited to 255 characters. Long values such as 2048-bit DKIM keys are split into several strings in one record, which receivers join. Most DNS panels do this for you; the tool shows the joined value.
- Tokens for services you no longer use. Harmless, but they reveal which vendors you use. Remove them once a service is gone.
How to add a TXT record
In your DNS provider's panel, add a record of type TXT. The *name* (or *host*) is the part before your domain — @ or empty for the domain itself, _dmarc for DMARC. Paste the value without surrounding quotes unless the panel asks for them.
example.com. 3600 TXT "v=spf1 include:_spf.google.com -all"
example.com. 3600 TXT "google-site-verification=rXOxyZounnZasA8Z7oaD3c14JdjS9aKSWvsR1EbUSIQ"
_dmarc.example.com. 3600 TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"A new TXT record is visible within minutes, a changed one after the old TTL expires. Check it from many resolvers at once with the DNS propagation checker.
TXT lookup from the command line
$ dig example.com TXT +short
$ dig _dmarc.example.com TXT +short
$ nslookup -type=TXT example.comWhy verification tokens exist
Services prove you control a domain by asking you to publish a random value they chose. Only someone with access to the domain's DNS can do that. Google Search Console, Microsoft 365, Apple Business, Atlassian, Stripe and certificate authorities all use this method. Some check once; others, such as Google Workspace and Microsoft 365, re-check periodically, so removing their token can break the service.
The tool recognizes about 35 common token formats and labels them with the service name. Anything unrecognized is shown as *Other*, so you can still review it and decide whether it belongs.
Tokens are not secrets — anyone can read your TXT records — but together they form a list of the vendors you use, which attackers sometimes use to tailor phishing. That is one more reason to remove tokens for services you have left. A token alone cannot be abused: it only proves control at the moment a service checks it, and the service ties it to your account.