TXT records are the Swiss Army knife of DNS. Originally meant for human-readable notes, they now carry nearly everything that proves who controls a domain or who is allowed to send mail for it: SPF policies, DKIM public keys, DMARC policies and the verification tokens that Google, Microsoft, Apple and countless other services ask you to publish. People search for what a TXT record is, how to add one, how to look one up and why a record they added "is not found". This guide explains what TXT records contain, the formatting rules that trip people up (quotes, the 255-character limit, doubled domain names and one-record-only restrictions), how to add and check them step by step and how to read the email-related ones. We never invent provider values: copy every token, selector and key from the service you are connecting. If you only need the overall picture of email DNS, start with DNS records for email explained.
What is a TXT record?
A TXT record attaches text to a DNS name. The text can be anything, which is why so many different systems use it. A resolver asks for the TXT records of a name and receives the strings. It is up to the program that asked to interpret them. A mail server looking for an SPF policy ignores TXT records that do not start with v=spf1. A service verifying domain ownership looks for its own token. This is why one domain can have many TXT records on the same name without them interfering, with a few important exceptions.
Where email-related TXT records live
| Purpose | Hostname | Starts with | Limit |
|---|---|---|---|
| SPF | The domain itself (@) or a sending subdomain | v=spf1 | Only one SPF record per name |
| DKIM public key | selector._domainkey.example.com | v=DKIM1 | One per selector |
| DMARC | _dmarc.example.com | v=DMARC1 | Only one per name |
| Domain verification | Usually the domain itself or a name the service specifies | A service-specific token | Several can coexist |
| BIMI | default._bimi.example.com | v=BIMI1 | One per selector |
Read about each in depth: SPF, DKIM, DMARC and BIMI.
Formatting rules that cause failures
Quotes and multiple strings
Inside DNS, a TXT value is a series of strings each limited to 255 characters. Most control panels hide this: you paste the value and the panel handles quoting and splitting. Some panels show quotes and some want you to omit them. If a record you added looks right but does not validate, check whether the panel stored literal quote characters as part of the value. Long values, such as a 2048-bit DKIM key, exceed 255 characters and must be split into several strings that the resolver joins together. Good panels do this automatically. Others require you to split manually. See TXT length and registrar quirks.
Whitespace and line breaks
Copying from an email or a web page can add line breaks or non-breaking spaces. A DKIM key with a hidden space in the middle is invalid and fails verification without any error message in DNS. Paste into a plain-text editor first, check for breaks and then paste into the DNS panel.
Doubled domain names
Most panels append your domain to the name field. If the instructions say the host is selector._domainkey.example.com and you type that in full, the panel may store selector._domainkey.example.com.example.com. Enter only selector._domainkey in such panels. Look up the record after saving to confirm the name.
One record only for SPF and DMARC
If a name has two SPF records, receivers treat the result as a permanent error and SPF fails. The same is true of DMARC. When a second service asks for SPF, you must merge its include into your existing record, not add another. See SPF with multiple senders and multiple vendors on one domain.
Several verification records are fine
Domain verification tokens can sit together on the same name. Do not delete another service's token while adding yours, or that service may mark your domain unverified.
How to add a TXT record
- Copy the exact name and value from the service. For our service, use the domain settings page in your dashboard.
- Open DNS management at the authoritative host for your domain. See adding DNS records at GoDaddy, Namecheap and Cloudflare.
- Create a TXT record. Enter the host, using
@for the root if your panel uses that convention, and paste the value into a plain-text editor first to remove stray characters. - Set the TTL. A lower value, such as a few minutes, speeds testing. You can raise it later.
- Save and wait for propagation.
- Verify with a lookup and then with the service's own verification button.
How to look up a TXT record
dig TXT example.com +short
dig TXT _dmarc.example.com +short
dig TXT selector._domainkey.example.com +short
nslookup -type=TXT example.comIf a lookup returns nothing, you either have the wrong hostname, the record is not saved or the change has not propagated. Query the authoritative nameserver directly to separate those cases. You can also use our free SPF, DKIM and DMARC checker, which looks up the relevant names for you.
Reading a TXT record
An SPF record reads from left to right. It starts with the version, lists mechanisms that authorise senders and ends with a policy for everything else. A DMARC record is a list of tag-value pairs separated by semicolons. A DKIM record contains tags such as v, k for key type and p for the public key. Verification tokens are opaque strings. If you cannot tell what a TXT record is for, do not delete it; ask your team which service created it, since removing a token can break a working integration.
Troubleshooting "record not found"
| Cause | How to check | Fix |
|---|---|---|
| Wrong hostname | Look up the exact name the service expects | Edit the host field |
| Doubled domain | Lookup shows the domain twice | Remove the appended part |
| Edited at the wrong DNS host | Compare the domain's nameservers with where you edited | Edit at the authoritative host |
| Not propagated | Query the authoritative server and a public resolver | Wait for the TTL |
| Quotes or stray characters stored | Lookup shows quote characters in the value | Re-enter without quotes |
| Value split incorrectly | Key looks truncated in a lookup | Re-enter the full value or let the panel split |
| Two SPF or DMARC records | Lookup shows two | Merge into one |
Security note
Treat access to your DNS as a high-privilege permission. Anyone who can edit TXT records can change who may send as your domain and can verify the domain for third-party services. Use named accounts, multi-factor authentication where your DNS host offers it and remove access for people who leave. After any change, recheck authentication. For a sending-side overview see authenticating your sending domain, and if you have domains that never send, see protecting non-sending domains.
Common TXT record examples at a glance
Because TXT records serve so many purposes, it helps to recognise the shapes. An SPF record is a single line beginning with the version tag and ending with an all mechanism. A DMARC record is a set of tag-value pairs. A DKIM record carries a version tag, a key type and a long public key. Domain verification tokens vary: some are a single random string, some are a short prefix followed by a code. When you add one, you rarely need to understand the contents; you need to copy them exactly. When you remove one, you need to know what depends on it. A simple habit that prevents outages is to keep a short list of every TXT record on your domain with the service it belongs to and the person who added it. Review the list whenever you stop using a vendor, and remove the matching records only after confirming that nothing still relies on them.
Finally, remember that TXT records are public. Anyone can look them up, so never put secrets, passwords or private keys in them. DKIM publishes only the public half of a key pair, which is safe to share.
Check your records in one step Look up SPF, DKIM and DMARC for any domain with the free checker.
References and further reading
Frequently asked questions
What is a TXT record?
A DNS record that attaches text to a name. It is used for SPF, DKIM, DMARC, domain verification tokens and other purposes, interpreted by whichever service reads it.
Can I have more than one TXT record on the same name?
Yes, for different purposes such as verification tokens. But a name must have only one SPF record and only one DMARC record.
Why is my TXT record not found?
Common causes are a wrong or doubled hostname, editing the wrong DNS host, caching until the TTL expires, stored quote characters or a value split incorrectly.
Why do TXT values get split into pieces?
Each DNS string is limited to 255 characters. Long values such as 2048-bit DKIM keys are split into several strings that the resolver joins together.
How do I look up a TXT record?
Run dig TXT name +short or nslookup -type=TXT name, or use an online checker, querying the authoritative nameserver to avoid cache confusion.