What is a DNS TXT record and what data does it store?
A DNS TXT record stores text strings on a name, the bare domain or a label such as a mail selector. Resolvers return that text for type TXT. The TTL is how long the answer may be cached. The value has no IP address. A verification code on an A record does not do this job.
example.com. 3600 IN TXT "v=spf1 include:_spf.example.net -all"That line is an illustration. The name, the TTL, and the string must be the ones your mail or verification provider gave you. The quotes show where the character-string starts and ends. Some panels add the quotes for you.
How are TXT records used for SPF, DKIM, DMARC, and Google Search Console verification?
SPF, DKIM, and DMARC are published as TXT rows, whatever people call them. SPF names servers allowed to send for the domain. DKIM publishes a public key under a selector. DMARC says what to do when SPF or DKIM fails, and where reports go. Search Console wants another TXT, usually on the bare domain, starting with a verification label.
| Job | Name you usually publish | What the text is |
|---|---|---|
| SPF | The bare domain | A string that starts with v=spf1 |
| DKIM | A selector such as selector._domainkey | A public key the receiver uses to check a signature |
| DMARC | _dmarc | A policy and a place to send reports |
| Search Console domain check | The bare domain, unless the screen says otherwise | A one-time verification string |
How the mail strings should be written is on SPF and DMARC setup and on what a DKIM record is. Copy the host and the value from the provider. Do not invent a selector.
What is the 255-character string limit in DNS TXT records and how does splitting work?
Each character-string in a TXT record is limited to 255 octets. Several strings may sit in one record. Resolvers join them and add nothing between them. Long SPF and DKIM values are stored that way. A panel may split the box on save or keep your quotes. Compare the joined text with what the provider asked for.
example.com. IN TXT "v=spf1 include:_spf.example.net " "include:mail.example.org -all"The space at the end of the first string is part of the SPF text, because the join does not insert a space for you. A split in the wrong place changes the policy. DKIM keys are long, so the same joining rule is why a key can look like two quoted chunks and still be one record.
How do you add or edit a TXT record in cPanel, Plesk, or ControlPanel.Systems?
Add the TXT only where live nameservers publish the zone. The registrar screen is that zone only when nameservers point at the registrar. If they point at the host, edit there. Create a TXT, use the host name shown, paste the value, and save. Wait out the old TTL. A copy at another company does not update the live zone.
- Find the NS records for the domain and open DNS at that provider.
- Add type TXT. Use @ or a blank host for the bare domain, or the exact label you were given.
- Paste the value. Keep provider quotes only if the panel does not add its own.
- On cPanel, follow the Zone Editor steps in the guide to adding a TXT record in cPanel.
- On Plesk, open the domain DNS settings and add a TXT row there.
- On WebJi shared hosting, edit the zone in ControlPanel.Systems. Shared plans do not use cPanel.
How do you verify that your new TXT record has propagated?
Query the authoritative nameservers first, then a public resolver. A new string on the authoritative host and an old string on the resolver means the old answer is cached until its TTL ends. If the authoritative host lacks the string, the edit is in the wrong zone or not loaded. A missing TXT can also sit in a negative cache.
- Ask the domain's own nameservers for TXT on the exact name. This is the copy you just edited.
- Ask a public resolver for the same name. A difference here is cache, not a second zone.
- Compare the joined text with the provider's value, including spaces.
- If mail still fails after the TXT matches, the problem is no longer propagation.
You can run that lookup from the DNS lookup tool instead of from a terminal. Check the name you published, not only the bare domain, or a DKIM selector will look missing when it is present.