📝

TXT Record Lookup

Text (TXT) records hold arbitrary, machine-readable text data used for various verification and security functions.

RFC: RFC 1035
TYPE: Resource Record
USAGE: Authentication, Verification

What is TXT Record Lookup?

TXT records were originally designed for human-readable notes, but have evolved into the internet standard for hosting policy frameworks and proving domain ownership because they can store arbitrary string data without affecting routing.

How it Works

Third-party providers instruct domain owners to create a TXT record with a unique string. The provider then queries the domain's TXT records. If the string is present, the provider considers the ownership validated.

Key Use Cases

Proving domain ownership for Google Workspace, Microsoft 365, and GitHub.

Publishing critical Email Security policies via SPF, DMARC, and DKIM.

Establishing federated trust directives (like MTA-STS or BIMI indicators).

Advanced Details

While single TXT strings can carry up to 255 characters, longer values are supported by seamlessly splitting the string into multiple chunked quotes inside the same record. The DNS resolver handles concatenating them upon delivery.

Cybersecurity Pros & Cons

Security Advantages
  • TXT records host SPF, DMARC, and DKIM — the three pillars of email authentication that prevent spoofing.
  • Domain ownership verification via TXT prevents unauthorized third parties from claiming your domain in SaaS platforms.
  • TXT records expose the full security posture of a domain at a glance: SPF strictness, DMARC policy, DKIM selectors.
  • Security researchers audit TXT records to discover misconfigured SPF `+all` entries that allow universal spoofing.
Security Limitations
  • TXT records are completely public — attackers can read your SPF and DMARC policies to craft evasion strategies.
  • Multiple SPF TXT records on the same domain cause PermError, silently breaking email authentication for all senders.
  • Accumulation of old verification tokens from decommissioned SaaS tools bloats TXT records and increases attack surface.
  • No authentication on TXT records — a DNS zone compromise allows complete silent rewriting of security policies.
Ready to Test?

Use our professional-grade tool to perform a real-time check for this module.

Run Module Now
Related Docs