DNS TXT Record (Text Record)
Detailed technical specification, security configuration analysis, threat modeling, and defensive whitelists.
Asset Risk Analysis Context
DNS records govern critical mapping parameters. Stale or misconfigured records are swept continuously by external threat monitors and passive asset enumerators.
Scan Your DNS Zone NowWhat is a DNS TXT Record?
The Text (TXT) resource record allows domain administrators to insert arbitrary text into DNS zone files. Historically used for human-readable notes, TXT records have evolved into the primary vehicle for hosting security policies, domain verification metadata, and cryptographic public keys.
Key Uses of TXT Records in Modern Security
- SPF (Sender Policy Framework): Declares which IP addresses are authorized to send email from the domain.
- DMARC (Domain-based Message Authentication): Defines how receivers handle emails that fail SPF/DKIM verification.
- Domain Verification: Services like Google Search Console, Microsoft 365, and SSL CAs require domain owners to add specific TXT records to prove ownership.
- DKIM (DomainKeys Identified Mail) Keys: TXT records store the cryptographic public keys used to verify email header signatures.
Security Exposures of TXT Records
Because TXT records are publicly queryable, they present several security considerations:
- Information Leakage: TXT records often leak internal infrastructure details, disclosing which CRM, hosting, or analytics platforms the organization uses.
- Dangling Verification Records: Organizations often fail to remove validation TXT records after verifying a service. Threat actors search for these stale records to hijack unclaimed SaaS accounts.
- TXT Syntax Hijacking: Small typos in SPF or DMARC TXT records can invalidate your email authentication, causing legitimate emails to go to spam or allowing attackers to spoof your domain.
Hardening TXT Configurations
- Minimize Information Footprint: Remove validation TXT records immediately once the third-party service verification is complete.
- Audit Syntax Integrity: Use tools like ReconShield to validate SPF and DMARC syntax, ensuring there are no double-declaration issues.
- DKIM Selector Rotation: Regularly rotate your DKIM selector TXT keys (e.g., every 6 months) to invalidate compromised cryptographic signatures.
Frequently Asked Questions
What is a TXT record?
A DNS record that stores arbitrary text data, primarily used for security configurations and domain ownership verification.
Can I have multiple TXT records?
Yes. You can configure multiple TXT records, but you must ensure they do not conflict, especially for SPF policies.
How is a TXT record used for email security?
It hosts the configuration text for SPF (~all or -all rules) and DMARC enforcement records.
What is the maximum character limit for a TXT record?
A single TXT string can be up to 255 characters, but multiple strings can be chained together up to a total of 65,535 bytes.
Why should I delete verification TXT records?
Deleting completed verification records prevents information disclosure and blocks attackers from claiming old accounts.