What is a DNS TXT record?
A DNS TXT record stores text data in DNS. It is used for email authentication (SPF, DKIM, DMARC), domain verification, and security policies.
Detailed Answer
DNS TXT (text) records store arbitrary text data associated with a domain name. They are the backbone of email security.
Common uses of TXT records:
Email authentication:
- SPF:
v=spf1 include:_spf.google.com -all - DKIM:
v=DKIM1; k=rsa; p=MIIBIjAN...(at selector._domainkey) - DMARC:
v=DMARC1; p=reject; rua=mailto:...(at _dmarc) - MTA-STS:
v=STSv1; id=20240101(at _mta-sts) - BIMI:
v=BIMI1; l=https://.../logo.svg(at default._bimi)
Domain verification:
- Google:
google-site-verification=abc123... - Microsoft:
MS=ms12345678 - Facebook:
facebook-domain-verification=abc123
Security:
- DANE/TLSA: Certificate pinning for TLS
- CAA: Certificate Authority Authorization
- _security TXT: Security contact information
TXT record limits:
- Maximum 255 characters per string (can be split into multiple strings)
- Multiple TXT records allowed per name
- No practical limit on number of TXT records
- SPF must be a single TXT record (not split across multiple)
How to add a TXT record:
- Log into your DNS provider (Cloudflare, Route 53, etc.)
- Add a new TXT record
- Set the name (@ for root, or a subdomain like _dmarc)
- Enter the value
- Save and wait for propagation
Check your TXT records: https://intodns.ai (scan your domain to see all DNS records)
Check your domain now
Use IntoDNS.ai to scan your domain and get instant dns insights.
Scan Your DomainRelated Questions
What is SPF, DKIM, and DMARC?
SPF, DKIM, and DMARC are email authentication standards that verify sender identity and prevent email spoofing.
What is DNS propagation and how long does it take?
DNS propagation is the time it takes for DNS changes to spread across all DNS servers worldwide. It typically takes 1-48 hours depending on TTL values.
What is DNSSEC and why does it matter?
DNSSEC adds cryptographic signatures to DNS records, preventing attackers from forging DNS responses. It protects against DNS spoofing and cache poisoning attacks.