DNS TXT Records Explained: SPF, DKIM, Verification, and Common Uses

TXT records store text values in DNS.

Duck Cloud's DNS Lookup can inspect public TXT records alongside A, AAAA, CNAME, MX, and NS records.

Domain verification

Services often ask you to create a TXT record such as:

service-verification=abc123

The provider checks DNS to confirm you control the domain.

SPF

Sender Policy Framework commonly uses a TXT record beginning with v=spf1.

It describes systems authorized to send email for a domain.

Avoid creating multiple conflicting SPF policy records for the same domain.

DKIM

DKIM commonly publishes public-key information at a selector-based hostname such as:

selector._domainkey.example.com

The private signing key must remain secret; the DNS-published public information is intended to be public.

DMARC

DMARC policies are commonly published through TXT records at _dmarc.

Follow your mail provider's current documentation for SPF, DKIM, and DMARC configuration.

Hostname mistakes

DNS dashboards may expect only the host portion rather than the full domain. Entering the domain twice can create a record at the wrong hostname.

Quotation marks

Lookup tools may display TXT values with quotation marks or split a long TXT value into multiple quoted strings. Compare the logical value rather than presentation alone.

Propagation

After adding a TXT record:

1. Confirm it was saved.
2. Query the exact hostname.
3. Compare the expected value.
4. Allow for TTL and caching.
5. Retry verification.

Do not create duplicate records every few minutes.

Security

DNS TXT data is publicly queryable. Never store private API keys, passwords, private signing keys, or access tokens there unless a specific public-verification protocol explicitly requires a generated public value.

TXT records are flexible and useful, but hostname and copy-paste mistakes are common. Verify the exact name and exact logical value before changing anything else.