[ DNS & domains ]

Why a DNS editor's display may differ from the published record

Distinguish TXT string chunks, record boundaries, quoting and cached answers before treating a DNS editor’s display as a publication error.

By the EmailAuth research team · 8 min read

[ Key points ]

  • Compare the logical record and owner, not just screenshot formatting.
  • Multiple TXT strings within one record are not multiple resource records.
  • Separate saved configuration, authoritative data and cached recursive answers.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Classify a display difference before changing DNS: preserve correct logical data, repair actual structure or byte errors, and verify the final message separately.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Inspect record boundaries

Visual line breaks do not identify DNS resource-record boundaries.

Next steps

  1. Capture the complete authoritative answer set.
  2. Reconstruct TXT values under SPF or DKIM rules.
  3. Keep alias and target observations separate.

CISO / SecOps

Avoid cosmetic edits with real consequences

A formatting change can corrupt key material or create duplicate policies.

Next steps

  1. Preserve issued values and current records.
  2. Distinguish literal characters from presentation syntax.
  3. Require a specific documented difference before editing.

Founder / Non-technical

Make the evidence easy to review

Disagreement between screenshots does not automatically mean delivery is broken.

Next steps

  1. Ask for a classified discrepancy and accountable owner.
  2. Avoid repeated unneeded changes while caches expire.
  3. Require controlled-message acceptance for affected workflows.

[ FAQs ]

Frequently asked questions

Are two quoted TXT strings necessarily two TXT records?

No. A single TXT resource record can contain multiple character strings. Inspect the resource-record boundary rather than counting visible quotes or lines.

RFC1035

How are strings inside one SPF TXT record combined?

SPF concatenates the character strings without inserting spaces. An editor’s visual separation should not become extra policy data.

RFC7208

Can DKIM public-key TXT data span several strings?

Yes. DKIM key retrieval concatenates TXT character strings. Confirm that the resulting logical record matches the issued key and that the record set is otherwise valid.

RFC6376

Should I copy visible quotation marks into the authentication value?

Not merely because a display shows them. Quotes can be presentation delimiters. Use the editor’s supported input format and inspect what was actually published.

RFC1035

Can I split an SPF policy into two separate TXT records?

Not as a substitute for multiple strings within one record. Multiple SPF policies at the same owner create a record-selection error rather than a combined policy.

RFC7208

Why does a panel show a CNAME while a lookup shows key data?

The panel can show the configured alias while resolution follows its target. Record the alias and target answers separately before comparing the expected record type.

RFC9499

Does a save confirmation prove external receivers can see the record?

No. The edited zone must be publicly authoritative for that owner, and recursive caches can still hold earlier answers. Verify the delegation and publication directly.

RFC9499

What if the logical value matches but the message still fails DKIM?

Stop changing correct DNS for cosmetic reasons. Investigate the actual signature, selector, corresponding key and received-message verification outcome.

RFC6376

[ Sources ]

Sources

  1. RFC1035

    Sections §3.3.14 TXT RDATA format · §5.1 Format

  2. RFC7208

    Sections §3.2 Multiple DNS Records · §3.3 Multiple Strings in a Single DNS Record

  3. RFC6376

    Sections §3.6 Key Management and Representation · §6.1.2 Get the Public Key

  4. RFC2308

    Sections §2. Negative Responses · §5. Caching Negative Answers

  5. RFC9499

    Sections §6. DNS Servers and Clients · §7. Zones

[ Glossary ]

Glossary

Character string
A length-delimited string within DNS data; a TXT record can contain more than one.

RFC1035

Resource record
A DNS data item with an owner, type, class, TTL and record-specific data.

RFC1035

Logical TXT value
The application-interpreted value obtained from the strings in a TXT record under that protocol’s rules.

RFC7208

Presentation format
A textual rendering of DNS information, such as quoted strings or absolute names in a master file.

RFC1035

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base