Support Library
TXT Records Beyond SPF
What TXT records carry beyond SPF: DMARC, DKIM, MTA-STS, BIMI and verification tokens, where each lives, and the format details that cause trouble.
The short answer
A TXT record holds free-form text. DNS itself gives that text no meaning, so other standards and services define their own formats on top of it: SPF and DMARC policies, DKIM public keys, MTA-STS and TLS-RPT pointers, and the verification tokens that cloud and SaaS providers ask you to publish to prove you control a domain.
$ dig +short TXT example.com
"v=spf1 include:_spf.mail.example.net -all"
"google-site-verification=3f9a..."
"MS=ms12345678"Common TXT uses and where they live
| Use | Name | Starts with |
|---|---|---|
| SPF | The domain itself | v=spf1 |
| DMARC | _dmarc.example.com | v=DMARC1 |
| DKIM public key | selector._domainkey.example.com | v=DKIM1 |
| MTA-STS | _mta-sts.example.com | v=STSv1 |
| TLS reporting | _smtp._tls.example.com | v=TLSRPTv1 |
| BIMI | default._bimi.example.com | v=BIMI1 |
| Domain verification | Usually the domain itself, sometimes an underscore name the provider gives you | Provider-specific, such as google-site-verification= |
Names that start with an underscore are reserved for this kind of use, which keeps them apart from real host names. RFC 8552 keeps the registry of these names.
Format details that cause trouble
- 255-byte strings. One string inside a TXT record can be at most 255 bytes. Longer values, such as 2048-bit DKIM keys, are split into several quoted strings in the same record, which software joins without spaces. Some DNS control panels split them for you; others need you to do it.
- Several records at one name. A name can hold many TXT records, and each consumer picks out the ones it understands. SPF and DMARC are exceptions: more than one SPF record, or more than one DMARC record, is an error.
- Response size. Many verification tokens at the apex make every TXT response larger, which can push it past what UDP carries and force TCP retries. See EDNS and TCP Fallback.
- Quoting in zone files. In a zone file each string is written in double quotes; a value pasted without them may be split at spaces.
Keeping TXT records tidy
Verification tokens are often needed only once, or only while you use a service, but they tend to stay forever. Old tokens are not usually dangerous on their own, but they reveal which services you have used, and some providers re-check them to keep a domain linked to an account. Review apex TXT records once a year, note which service each belongs to, and remove the ones for services you no longer use, after checking the provider's guidance.
How DNS Panopticon helps
Domain Visualizer fetches the apex TXT records and the TXT records at _dmarc, _mta-sts, _smtp._tls, default._bimi and the DKIM selectors selector1 and selector2, and its findings interpret the SPF, DMARC, MTA-STS and BIMI ones. It does not judge verification tokens. To review every TXT record in a zone, load an export into Zone Analyzer and filter on the TXT type.