A TXT record publishes text associated with a domain name. Services use it to prove domain ownership, configure email settings like SPF DKIM DMARC, or expose technical information.
A TXT record contains a name, a type, a value, and a TTL. The TTL indicates how long the response remains cached in the local resolver.
| Name | Type | Value | TTL in seconds |
|---|
| @ | TXT | "v=spf1 ip4:203.0.113.0/24 ~all" | 3600 |
In this example, the name @ targets the root of the domain. The value contains an SPF rule in text format. A TTL of 3600 corresponds to one hour.
| Name | Type | Value | TTL in seconds |
|---|
| selector1._domainkey | TXT | "v=DKIM1; k=rsa; p=MII...AB" | 3600 |
| _dmarc | TXT | "v=DMARC1; p=quarantine; adkim=s; aspf=s" | 3600 |
| @ | TXT | "property=token12345" | 300 |
These lines show a DKIM selector, a DMARC policy, and a verification token. The targeted name depends on the service used.
It is possible to publish multiple TXT records on the same label. Each value appears in the response. For SPF, keep only one entry per name and group the mechanisms in it. For DKIM, use a different selector for each key.
A short TTL makes a change visible faster. Useful during an SPF update or domain verification.
A medium or long TTL reduces queries to authoritative servers. Suitable for stable configuration.
Reduce the TTL a few hours before modification, then raise it back after validation.
Good to know
A TXT value can exceed 255 bytes. It is then split into multiple quoted strings in the zone. Resolvers concatenate these strings on the client side.
Publish the TXT on the name requested by the service. SPF is often placed at the apex. DKIM is published on selector._domainkey. DMARC is placed on _dmarc. Verification services provide a specific name. A TXT can coexist with A AAAA MX on the same name.
To avoid
Having two SPF entries on the same name. Merge into a single value.
Forgetting quotes or improperly escaping special characters.
Publishing DKIM to the wrong selector.
An online DNS lookup allows entering a domain name. You get the list of TXT values as well as the TTL visible from the Internet. This is a useful first check. Then perform a local test from your machine.
Windows provides nslookup. You can use it in interactive mode.
nslookup
set q=txt
example.com
nslookup
set q=txt
server 1.1.1.1
example.com
The first part queries, according to the machine's network configuration. The second forces the use of a third-party resolver, here Cloudflare's.
On these systems, the dig command is convenient and easy to use.
dig TXT www.example.com
dig TXT www.example.com @1.1.1.1
Multiple lines indicate multiple TXT values. Read the prefixes v=spf1 v=DKIM1 v=DMARC1 to identify the function of each entry.
A high remaining TTL may explain a delay after a change.
An empty or truncated value often indicates a missing quote or poorly handled splitting.
- Note the current values and TTL.
- Reduce the TTL to 300 or even 60 seconds a few hours before modification.
- Prepare the new value. For SPF, merge mechanisms into a single line.
- Publish the new value then remove the old one if necessary.
- Verify with nslookup or dig command from multiple networks and raise the TTL when everything is stable.
Practical tip
For DKIM, publish a new key on a new selector. Leave the old one during the transition period. Then remove the old key when everything is validated.
Publish an SPF rule at the apex with authorized addresses and domains. Test before production deployment.
Publish the public key to the selector provided by the email service. Verify that the key is complete.
Publish a policy on _dmarc with the p directive and useful options. Monitor reports if enabled.
Publish a temporary TXT token provided by a service. Remove it after validation if the service allows.
- If SPF is reported as invalid, verify that only one SPF entry exists at the same name.
- If DKIM fails, verify the selector and key. Look for breaks or extra spaces.
- If DMARC is not detected, verify the _dmarc name and the v=DMARC1 value.
- If the response remains old, wait for TTL expiration and purge the local resolver cache if possible.
In summary, a TXT record publishes text information for a domain name. It serves for verifications, email policies, and other technical uses. The TTL controls cache duration. Multiple TXT records can coexist on the same name, but only one SPF entry should exist. Verification goes through an online tool, then through nslookup and dig.
With these guidelines, management remains clear. Changes proceed without stress. Services work as expected.