Understanding TXT Records: SPF, DKIM, and DMARC Security

DNS TXT records allow domain owners to publish arbitrary text data in DNS. They are the foundation of modern email authentication and domain security.

The Three Pillars of Email Authentication

1. SPF (Sender Policy Framework)

SPF specifies which mail servers and IP addresses are authorized to send email on behalf of your domain.

• Example: v=spf1 include:_spf.google.com ~all
• SoftFail (~all): Unlisted senders marked suspicious.
• HardFail (-all): Unlisted senders strictly rejected.

2. DKIM (DomainKeys Identified Mail)

DKIM uses cryptographic public-key signatures to verify that emails were not tampered with during transit.

• Stored at selector._domainkey.example.com.
• Contains public key data (p=MIGfMA0...).

3. DMARC (Domain-based Message Authentication)

DMARC links SPF and DKIM together and tells receiving mail servers how to handle messages that fail authentication.

• p=none: Monitoring only.
• p=quarantine: Send failing mail to spam folder.
• p=reject: Reject failing mail completely.

Free Security Inspector Tool

Audit your SPF, DKIM, and DMARC records with our free TXT Record & SPF/DKIM Inspector.

title: "TXT Records: SPF, DKIM, and DMARC Guide" description: "Learn how TXT records support SPF, DKIM, and DMARC email authentication and domain security." date: "2026-08-12" author: "DevTools" tags: ["dns", "txt", "spf", "dkim", "dmarc", "email-security"] relatedTools:

• name: "TXT Record & SPF/DKIM Inspector" href: "/txt-lookup"

---