A TXT record holds arbitrary text. DNS itself gives it no meaning; SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI and site-ownership checks all build on it.
google.com. 207 IN TXT "MS=E4A68B9AB2BB9670BCE15412F62916164C0B20BB" ; Microsoft 365 domain verification google.com. 207 IN TXT "Z29vZ2xl" google.com. 207 IN TXT "_r4rd1pvwyrpi7sw4a3hzmw8e51yh9td" google.com. 207 IN TXT "apple-domain-verification=30afIBcvSuDV2PLX" ; Apple domain verification google.com. 207 IN TXT "arcules-domain-verification=2R4t5G7nI6tRCo61lpxxbLksPYstxhGmtV75cpr8x9K" ; service ownership token google.com. 207 IN TXT "cisco-ci-domain-verification=47c38bc8c4b74b7233e9053220c1bbe76bcc1cd33c7acf7acd36cd6a5332004b" ; Cisco Webex domain verification google.com. 207 IN TXT "docusign=05958488-4752-4ef2-95eb-aa7ba8a3bd0e" ; DocuSign domain verification google.com. 207 IN TXT "docusign=1b0a6754-49b1-4db5-8540-d2c12664b289" ; DocuSign domain verification ; ... and 9 more TXT records at this name
github.com. 168 IN TXT "00Dd0000000hHE0=1TBKg000000TN2r" github.com. 168 IN TXT "MS=6BF03E6AF5CB689E315FB6199603BABF2C88D805" ; Microsoft 365 domain verification github.com. 168 IN TXT "MS=ms44452932" ; Microsoft 365 domain verification github.com. 168 IN TXT "MS=ms58704441" ; Microsoft 365 domain verification github.com. 168 IN TXT "TAILSCALE-xOzoDvFUzZr5YYVCQFuD" github.com. 168 IN TXT "adobe-idp-site-verification=b92c9e999aef825edc36e0a3d847d2dbad5b2fc0e05c79ddd7a16139b48ecf4b" ; Adobe domain verification github.com. 168 IN TXT "anthropic-domain-verification-4az7qn=if8YWuRRqwLycGJDooumzHtxm" ; service ownership token github.com. 168 IN TXT "apple-domain-verification=RyQhdzTl6Z6x8ZP4" ; Apple domain verification ; ... and 16 more TXT records at this name
example.com. 300 IN TXT "_k2n1y4vw3qtb4skdx9e7dxt97qrmmq9"
example.com. 300 IN TXT "v=spf1 -all"
; SPF policy: 1 term, 0 includes, ends with -all
The RDATA is a sequence of one or more character-strings, each up to 255 octets long. Long values such as 2048-bit DKIM keys or SPF records with many includes are split into several strings inside one record, and consumers join them with no separator. Several separate TXT records at the same name are different values and are not joined.
Because every protocol shares the same record type, a name such as the apex often carries a mix: an SPF record, verification tokens for Google, Microsoft or Atlassian, and others. Each consumer picks out the value with its own prefix (v=spf1, google-site-verification=, ...). Purpose-specific names (_dmarc, selector._domainkey) avoid that crowding.
example.com. 3600 IN TXT "v=spf1 include:_spf.google.com ~all"
example.com. 3600 IN TXT "google-site-verification=abc123"
k1._domainkey.example.com. IN TXT ( "v=DKIM1; k=rsa; p=MIIBIjANBg..." "...IDAQAB" )Wire format: RDATA is one or more length-prefixed strings: a length octet (0-255) followed by that many bytes. Total size is bounded by the 65535-octet RDATA limit and, in practice, by UDP response size.
| Field | Meaning |
|---|---|
| Owner | The name the consuming protocol looks at (example.com, _dmarc.example.com, ...). |
| Strings | Quoted in zone files. A quote or backslash inside is escaped with a backslash. |