Engineering Glossary · DNS Records
TXT Records Are Config, and They Have Limits Worth Knowing
Your SPF record looks correct, validates in a checker, and mail is still failing authentication for some recipients.
The short answer
A TXT record stores arbitrary text in your DNS zone, and because only whoever controls a domain can write into its zone, that text works as proof of control. Domain verification, SPF policy and DKIM public keys all ride on it.
It is configuration, which means it has limits that behave like bugs when you cross them. SPF evaluation stops permanently after ten DNS lookups, a single TXT string cannot exceed 255 characters so DKIM keys are split into concatenated chunks, and only one SPF-format record is permitted per name — adding a second breaks both rather than merging them.
By the HostingFast team · Reviewed 12 August 2026
100+
Terms defined properly
2 min
Read time, end to end
Plain
English, no hand-waving
24/7
Engineers on shift
Every verify your domain screen that hands you a token to paste is using this mechanism. The service asks for a value only you could publish, then queries for it. Once it has seen the record, most services re-check on their own schedule, which is why deleting an unrecognised token can un-verify something weeks later with nothing obvious to blame.
Mail authentication is published the same way. The permitted-sender list for SPF, the public key for DKIM at a selector name, and the enforcement policy for DMARC are each a TXT record at a prescribed label.
The ten-lookup limit, and how it fails
SPF evaluation is capped at ten DNS lookups. Every include, a, mx, ptr and exists mechanism costs one, and the includes you add can contain includes of their own. Cross the limit and a receiver returns permerror — which many treat as a failure and some treat as no policy at all.
The failure is quiet because a syntax checker will happily call the record valid. Count the lookups your record actually triggers, including nested includes, and flatten or remove providers you no longer send from. Old marketing platforms are the usual dead weight.
Why DKIM keys look mangled in a panel
A single character-string in a TXT record cannot exceed 255 bytes, and a 2048-bit DKIM key is longer than that. The record therefore holds several quoted strings which resolvers concatenate back together, and panels differ in whether they do that splitting for you or expect you to paste it pre-split.
Query the selector directly after publishing and confirm the reassembled value matches the key you were given. A key that is correct in the panel and wrong on the wire is a formatting problem, not a cryptography problem.
Auditing a zone full of tokens
Query all the TXT records at your apex and read them as a list. Most zones accumulate verification tokens from services abandoned years ago, and each one is a small standing claim that somebody else can check your domain.
Delete from knowledge rather than from tidiness. Keep a note beside each record saying what it verifies, and the next person to audit the zone — quite possibly you — will not have to guess.
Publishing records on this platform
TXT records are edited in the panel alongside everything else in the zone, and free SSL is issued and renewed automatically, so certificate validation is not another record for you to maintain by hand.
Staging environments are available for rehearsing a change, though for DNS the more useful discipline is lowering the TTL before you edit, so a mistake expires in minutes rather than in a working day.
Limits, not just definitions
The useful half of a reference is the part that tells you where a thing stops working. These entries carry the ceilings, the caps and the silent failures alongside the explanation.
The rate you sign up at is the rate you renew at, so a plan costs the same in year two as it did in year one.
- 100+ entries, limits and caps included
- SPF lookup counting explained properly
- Wired into SPF, DKIM and DMARC
- Written by the engineers who read the headers
Why HostingFast
Standard on every plan
The limits stated
Ten lookups, 255-character strings, one SPF record — the caps that fail quietly, named up front.
TXT Record, as configuration
Treated as config with constraints rather than as a box for free text.
DKIM formatting demystified
Why a long key arrives split into chunks and how to confirm it reassembled correctly.
Zone audit method
How to read every token at your apex and decide what is safe to remove.
Silent failure warning
A checker calling a record valid is not the same as receivers accepting it.
Continues into its neighbours
SPF, DKIM and DMARC follow straight on.
Quick Start
From order to online
- 1
Count your SPF lookups
Expand every include in your record, including nested ones, and add up the DNS lookups. Ten is the ceiling and there is no partial credit.
- 2
Verify DKIM on the wire
Query the selector and reassemble the answer. Compare it with the key you were issued rather than with what the panel displays.
- 3
List every TXT record at the apex
Read them as a set. Anything you cannot identify is a candidate for research, not for immediate deletion.
- 4
Lower the TTL before you edit
Drop the TTL a cycle ahead of a change so a mistake in a policy record expires in minutes rather than ruining a day of deliverability.
Built In
Loaded onto every plan
- Full TXT record editing from the control panel
- Free SSL issued and renewed without manual validation records
- Spam and virus screening on every mailbox as standard
- Mailboxes on your own domain included with hosting
- LiteSpeed caching built into the server
- Staging environments for rehearsing changes
- Renewal price identical to your signup price
- No setup charges on any plan
Frequently Asked
What people ask us most often
Why does my SPF record pass a checker but still fail for some recipients?
Almost always the ten-lookup limit. Every include, a, mx and exists mechanism costs a DNS lookup, nested includes count too, and crossing ten produces a permerror that receivers handle differently. Syntax checkers validate the string, not the lookup budget, so count the expansions yourself and drop providers you no longer send through.
Why is my DKIM key split into several quoted strings?
Because a single TXT character-string is capped at 255 bytes and a 2048-bit key is longer. Resolvers concatenate the pieces back together transparently. Panels vary in whether they split it for you, so publish it, query the selector, and confirm the reassembled value matches the key you were issued.
Can I have more than one SPF record?
No. Exactly one SPF-format TXT record is permitted per name, and publishing a second does not extend the first — it invalidates both. If you need to authorise another sender, add an include to the existing record and then recount your lookups.
Is it safe to delete TXT records I do not recognise?
Only the ones you can positively identify. Services re-check on their own schedules, so removing a verification token can un-verify something weeks later with nothing obvious to connect it to. Research first, note what each record does, and delete from knowledge.
Keep reading
DKIM (DomainKeys Identified Mail)
The signature on outgoing mail, and the selector record that publishes the key.
SPF (Sender Policy Framework)
The sender policy record, and the ten-lookup ceiling that breaks it quietly.
How to Create an SPF Record
Building a sender policy that stays inside the lookup budget.
VPS Hosting
KVM virtual servers with root access, DDoS filtering and a flat monthly price.
Web Hosting
cPanel hosting on NVMe with LiteSpeed, free SSL and a migration included.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Publish policy that actually evaluates.
NVMe, LiteSpeed and free SSL on every plan, engineers who answer at any hour, and a renewal price that matches the day you signed up.
View VPS Hosting plans