A TXT record stores free-form text in DNS. That simple idea is used for some of the most important parts of a domain: email authentication with SPF, DKIM and DMARC, and proving domain ownership to services like Google, Microsoft and certificate authorities. This guide explains DNS TXT records and how to get them right.
Before you start
Have the exact value from the service you are setting up, and access to your DNS zone (for example cPanel → Domains → Zone Editor).
What a TXT record looks like
example.com. 3600 IN TXT "v=spf1 include:_spf.example.net ~all"The name can be the root (@) or a specific label such as _dmarc or selector._domainkey.
Common TXT records
| Purpose | Name | Example value |
|---|---|---|
| SPF | @ | v=spf1 a mx include:relay.example ~all |
| DKIM | default._domainkey | v=DKIM1; k=rsa; p=MIIBIjAN... |
| DMARC | _dmarc | v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com |
| Domain verification | @ or a given label | google-site-verification=... |
| Let's Encrypt DNS-01 | _acme-challenge | Token from the ACME client |
| MTA-STS / TLS reporting | _mta-sts, _smtp._tls | v=STSv1; id=... |
Rules and limits
- Several TXT records on one name are allowed – you can have SPF and a verification record both on
@. - But only one SPF record. Two records starting with
v=spf1cause SPF to fail (permerror). Merge them into one. - 255-character strings. A single string in a TXT record can be at most 255 characters. Long values like 2048-bit DKIM keys are split into several quoted strings in one record:
"part1" "part2". Most control panels split automatically. - SPF lookup limit. SPF allows at most 10 DNS-querying mechanisms (
include,a,mx, etc.).
Add a TXT record in cPanel
- Open cPanel → Domains → Zone Editor → Manage.
- Click Add Record and choose TXT.
- Enter the name exactly as given (for example
_dmarc.example.com.) and paste the value without extra quotes. - Save. For email authentication, cPanel can also create SPF and DKIM for you in Email → Email Deliverability.
Check TXT records
dig example.com TXT +short
dig _dmarc.example.com TXT +short
dig default._domainkey.example.com TXT +shortTroubleshooting
- Verification fails: the record was added to the wrong name (e.g.
_dmarc.example.com.example.com) or DNS has not refreshed yet. - SPF permerror: two SPF records, or more than 10 lookups.
- DKIM fails: the key was cut off or line breaks were pasted in.
- Extra quotes: some panels add quotes automatically; pasting your own creates
""value"".
FAQ: DNS TXT records
Can I delete old verification TXT records?
Some services re-check periodically, so keep records for services you still use. Remove those for services you have left.
Is the SPF record type still used?
No. The dedicated SPF record type is deprecated; publish SPF as a TXT record.
How long do TXT changes take?
Like other records, it depends on the TTL – usually minutes to a few hours.