# DNS TXT record

Canonical: https://inetgeek.com/dns/txt-record/

A TXT record holds free-form text. In practice it carries domain verification tokens and email authentication policy.

## What a TXT record is for

A TXT record attaches arbitrary text to a name. DNS itself assigns no meaning to the contents — the meaning comes from whatever reads it.
Most TXT records in practice do one of two jobs: proving to a third party that you control a domain, or publishing email authentication policy such as SPF and DMARC.

## What a TXT record looks like

A TXT record holds quoted text at a name: example.com. 3600 IN TXT "v=spf1 include:_spf.example.net ~all". The quotes are part of the format rather than part of the value.
Nothing in DNS interprets what is inside. The structure that makes a string an SPF policy or a domain verification token belongs to whatever reads it, which is why one record type carries so many unrelated jobs.

## Character strings and the 255-byte limit

A TXT record is made of one or more character strings, and each string is limited to 255 bytes. A longer value is split across several strings within the same record.
Readers are expected to concatenate those strings with nothing between them. A value split in the wrong place, or joined with a space, produces a policy that looks right in a dashboard and fails in practice.

(Interactive explainer on the canonical page — nothing to check live, this is reference text.)

## Checking TXT records

dig TXT example.com +short returns every TXT record at the name, one per line and still quoted. A record split into several strings comes back as several quoted pieces on one line, which is the format doing its job rather than a corrupted value.
Records used by email standards usually sit at a subname rather than at the domain: DMARC at _dmarc.example.com, and DKIM under a selector at selector._domainkey.example.com. Asking for TXT at the domain alone will not show them.

## Multiple TXT records at one name

Unlike a CNAME, a name may carry many TXT records, which is why several verification tokens can coexist on one domain.
Some consumers require exactly one matching record, though. A domain must publish at most one SPF record, and two is a configuration error rather than a redundancy.

Check this on a live domain: https://inetgeek.com/tools/dns-lookup/

## Related records

- [SPF](https://inetgeek.com/dns/spf/): Declares which servers may send mail using your domain.
- [DMARC](https://inetgeek.com/dns/dmarc/): Tells receivers what to do when SPF and DKIM fail.
- [DKIM](https://inetgeek.com/dns/dkim/): Signs outgoing mail with a key published in DNS.