What is a TXT record and how do you create one?

A TXT record is a type of DNS record that lets you attach small pieces of text to your domain. You use a TXT record to prove that a domain belongs to you and to protect your email with SPF, DKIM, and DMARC, among other things. This article explains what a TXT record is, what you use it for, how its content is structured, and how to create and check one yourself.

What is a TXT record?

A TXT record (TXT is short for text) is one of the standard record types in the Domain Name System (DNS), the system that translates domain names into IP addresses and other data. The record type was defined back in 1987 in RFC 1035, one of the original DNS specifications.

A TXT record was originally meant for free, human-readable text about a domain, such as a short note. These days it almost always holds machine-readable information: short lines of text that other systems read automatically. The record does not change your website or your email itself, but it gives other parties a reliable way to verify something about your domain.

What do you use a TXT record for?

A TXT record can be used for many things. Here are the most common use cases.

Domain verification

Many online services want to be sure that you really own a domain before they let you use them. Think of Google Search Console, Microsoft 365, or an advertising or social media platform. The service gives you a unique verification code, also called a token. You add that token to your DNS as a TXT record. The service reads the record, sees the correct code, and knows that you have access to the domain.

Email security with SPF, DKIM, and DMARC

The best-known use is email security. Three widely used standards are all published as a TXT record:

• SPF (Sender Policy Framework) defines which servers are allowed to send email on behalf of your domain. You publish one SPF record per domain, and it starts with v=spf1.
• DKIM (DomainKeys Identified Mail) adds a digital signature to your messages. The matching public key lives in a TXT record at a name such as selector._domainkey.yourdomain.com.
• DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving servers what to do with email that fails the checks. This record lives at _dmarc.yourdomain.com.

Together, these three standards help prevent someone from sending email that appears to come from your domain.

Other uses

A TXT record also shows up in other techniques. A few examples:

• Requesting an SSL certificate through DNS validation, the so-called ACME DNS-01 challenge used by Let's Encrypt among others, at a name such as _acme-challenge.yourdomain.com.
• BIMI, which can display your brand logo next to your email in the recipient's mailbox.
• MTA-STS and TLS-RPT, which improve the transport security of email.

The mechanism is always the same: a piece of text in DNS that another system reads.

What does a TXT record look like?

A TXT record consists of the same basic fields as other DNS records, plus the text value itself.

So the value of a TXT record is a character string in quotes. A single string can be at most 255 characters long. That is fine for short records, but a DKIM key is often longer. In that case you split the value into several chunks of up to 255 characters, each in its own set of quotes. The software that reads the record joins those chunks back together into one whole.

In a zone file, a few common TXT records look like this:

; Domain verification on the main domain
@        IN  TXT  "google-site-verification=AbC123exampletoken"

; An SPF record
@        IN  TXT  "v=spf1 include:_spf.example.com ~all"

; A DMARC record on a subname
_dmarc   IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"

In your provider's control panel you usually do not see a zone file, but separate input fields for the name, the TTL, and the value.

Creating a TXT record yourself

Creating a TXT record takes just a few steps with almost any provider. The exact screen names vary by hosting company or domain registrar, but the idea is the same everywhere.

1. Log in to the control panel provided by whoever manages your DNS. That is usually your hosting provider or your domain registrar.
2. Open the DNS management or zone editor for the correct domain.
3. Choose to add a new record and select TXT as the type.
4. In the name or host field, enter where the record should go. Use @ or leave the field empty for the main domain, or enter a subname such as _dmarc.
5. Paste the value you received or prepared into the value field. Copy the text exactly and do not add extra quotes yourself, because most panels do that automatically.
6. Set a TTL or leave the default value in place.
7. Save the record.

After that, simply wait for the change to take effect.

How long until a TXT record works?

A new or changed TXT record is usually visible within a few minutes to a couple of hours. Keep in mind that, because of caching, it can take 24 to 48 hours before the change has fully propagated everywhere. The TTL you set largely determines how quickly old data disappears. If you plan to change a record soon, lower the TTL in advance.

How to check a TXT record

You can check for yourself whether a TXT record is correct and already visible. On Windows you use the command prompt, and on macOS and Linux the terminal.

• Windows: nslookup -type=TXT yourdomain.com
• macOS and Linux: dig TXT yourdomain.com +short

You will then see the text value or values attached to that name. For a record on a subname, enter the full name, for example dig TXT _dmarc.yourdomain.com +short. There are also free online tools that let you look up a TXT record from several locations at once.

Common mistakes and how to fix them

So with a TXT record you handle important things like domain verification and email security with a simple line of text in your DNS. Still stuck? Get in touch with support.