TXT Record — SPF, DKIM & DMARC Explained

What is a TXT Record?

A TXT (text) record stores human-readable or machine-readable text in DNS. Originally intended for general notes, TXT records have become the backbone of email authentication, domain verification, and site ownership checks. They're incredibly versatile — if you've ever added a verification code to prove you own a domain, it was almost certainly a TXT record.

yourdomain.com.  TXT "v=spf1 include:_spf.google.com ~all"
yourdomain.com.  TXT "google-site-verification=abc123xyz"
_dmarc.yourdomain.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com"

Email Authentication: SPF, DKIM, and DMARC

The three pillars of email security are all configured via TXT records:

SPF (Sender Policy Framework)

SPF tells the world which servers are authorised to send email on behalf of your domain. Without it, spammers can easily forge your domain in the "From" address. SPF is a TXT record on your root domain.

# Only Google Workspace can send email from yourdomain.com
yourdomain.com. TXT "v=spf1 include:_spf.google.com ~all"

# Multiple sending services
yourdomain.com. TXT "v=spf1 include:_spf.google.com include:sendgrid.net include:mailchimp.com ~all"

# SPF qualifiers:
# +all  = allow all (never use!)
# ~all  = softfail (mark suspicious but deliver)
# -all  = hardfail (reject anything not in the list)

DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to every outgoing email. The receiving server uses the public key published in your DNS to verify the email wasn't tampered with in transit. It's set up as a TXT record at a specific subdomain provided by your email service.

# DKIM selector record format: selector._domainkey.yourdomain.com
google._domainkey.yourdomain.com. TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUA..."

# The "p=" value is the public key — your email provider generates this

DMARC (Domain-based Message Authentication, Reporting & Conformance)

DMARC builds on SPF and DKIM, telling receivers what to do when an email fails authentication — reject it, quarantine it, or deliver it anyway. It also requests reports sent back to you about email authentication failures, helping you detect spoofing attempts.

_dmarc.yourdomain.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"

# p= policies:
# none       = monitor mode, no action taken (start here)
# quarantine = send failing mail to spam folder
# reject     = block failing mail entirely (most secure)

Other Common TXT Record Uses

• ▸Domain verification — Google Search Console, Facebook, HubSpot, Stripe, etc. all use TXT records to verify ownership
• ▸Site verification — Proving you control a domain for SSL certificate issuance
• ▸BIMI (Brand Indicators) — Displays your company logo in email clients that support it
• ▸MTA-STS — Enforces TLS for email delivery to your domain

Common TXT Record Mistakes

• ▸Multiple SPF records — you can only have ONE SPF record per domain. Merge them instead.
• ▸Forgetting quotes around TXT values in zone files
• ▸TXT records longer than 255 characters in a single string — split into multiple strings if needed
• ▸Setting DMARC to p=reject before properly configuring SPF and DKIM — this will block legitimate email