A DNS TXT record is a text entry attached to a domain name that other systems can read during trust or configuration checks. Organisations use it for ownership verification, email authentication, and policy publication, so the content can have security and governance impact even though it looks simple.
What a DNS TXT record does
A DNS TXT record stores arbitrary text at a domain name, but in practice that text often carries trust signals that other systems verify automatically. Because third parties can read it during authentication or ownership checks, the record becomes part of the domain’s security posture, not just a descriptive note.
TXT records are intentionally flexible, which is why they are widely used for ownership verification, email authentication, and publishing policy statements. That flexibility is useful, but it also means the record can influence security decisions far beyond the DNS layer itself.
Why TXT records matter in security workflows
Many security and platform services treat a TXT record as evidence that a domain owner controls the zone. This is why TXT values are often used for domain validation, SaaS onboarding, certificate-related checks, and email security mechanisms. The trust comes from the lookup path, not from the text being inherently trustworthy.
Because the record can be read by anyone who can query DNS, it should be treated as public configuration data. A TXT value that is stale, copied between environments, or left behind after a service is removed can create unintended trust relationships, especially when another party later reuses the same domain or subdomain.
For a protocol-level view of how records fit into resolution and defender visibility, see the DNS Protocol Fundamentals for Defenders Guide.
Common TXT record use cases
TXT records are most familiar in email and domain verification. SPF, DKIM, and DMARC all rely on DNS-published policy or key material, while many cloud and SaaS platforms ask an organisation to place a TXT token in DNS to prove domain control. In both cases, the record is a control-plane input for another system.
They are also used in broader trust and configuration checks, including environment-specific validation, service discovery, and tenant onboarding. In multi-tenant or business-to-business identity flows, DNS verification can become a boundary for who may claim a domain, route mail, or assert organisational ownership.
That operational pattern is why DNS-based domain verification is often part of B2B CIAM and Organisation Management Guide style workflows, where a TXT record helps prove control before SSO or tenant setup is allowed.
Failure modes and what to watch for
The main failure modes are not syntax errors, but trust errors. A TXT record can point to an abandoned service, support a hijacked subdomain, or continue to validate an integration after the underlying owner has changed. Misplaced trust in a public record can also let an attacker satisfy a verification workflow if the domain or subdomain has been left dangling.
Security teams should also watch for overbroad exposure, copied production values in test zones, and TXT records that embed sensitive material such as verification tokens, signing keys, or security policy fragments that no longer match current operations. The issue is usually not the existence of the record, but whether the recorded statement still matches the real control boundary.
Where TXT-based ownership is used for subdomains, the risk of leftover records and stale validation paths is well illustrated in the Subdomain Takeover and Dangling DNS Guide, especially when a record outlives the service it was meant to prove.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST Zero Trust (SP 800-207) and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | TXT records support authentication and verification workflows that warrant logging and review. |
| CM-8 — System Component Inventory | TXT records are part of the domain configuration surface that should be inventoried and governed. | |
| IA-5 — Authenticator Management | TXT records often carry verification tokens, keys, or policy material used in trust checks. | |
| Recommendation — Review DNS verification activity and investigate unexpected TXT record changes. Inventory domain TXT records and remove stale entries tied to retired services. Manage TXT-based tokens and verification material with explicit lifecycle controls. | ||
| NIST Zero Trust (SP 800-207) | AC-6 — Least Privilege | TXT-based trust checks should support tightly scoped access and validation decisions. |
| Recommendation — Limit validation trust to the minimum TXT assertion needed for the workflow. | ||
| CIS Controls v8 | 5 — Account Management | TXT records often underpin ownership and service validation that should be removed when no longer needed. |
| Recommendation — Remove obsolete TXT verification records when the associated service or account is retired. | ||
Practitioner Guidance
Governance implication: Treat DNS TXT records as security-relevant configuration, not as harmless metadata. Ownership-verification and authentication tokens should have a clear owner, a change process, and a removal path when the related service is decommissioned or the trust relationship ends.
What to watch for: Review TXT records whenever you onboard a platform, rotate an email or domain security control, or retire a subdomain. If the record exists only to satisfy a one-time verification check, it should not remain in place indefinitely without a reason.
Practitioner takeaway: The safest TXT record is one that still matches a live control requirement, and nothing more. If the business no longer needs the trust assertion, remove the record rather than preserving inherited trust by accident.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org