Documentary review: 8 November 2026. No live DNS query, provider-panel inspection or message test was performed. The comparison worksheet and fictional incident are operational proposals whose acceptance fields remain uncompleted.
Compare meaning before comparing screenshots
A DNS editor is a presentation of configuration, not the DNS response itself. It may add quotation marks, hide a repeated zone suffix, wrap a long value or display several values in one row. A command-line tool also renders DNS data into text. Two displays can therefore look different while describing the same record, and two similar-looking screens can represent materially different records.
Begin with the exact owner and type required by the sending service. Record the authoritative zone, the intended data and the display being compared. A claim that “DNS changed my key” is too broad until the investigator identifies whether the difference concerns the owner name, record count, TXT string boundaries, literal bytes, alias target or cached answer. DNS record and message formats
Keep three artifacts separate: the provider-issued instruction, the editor's saved representation, and the authoritative response. An external recursive response is a fourth observation, with its own timestamp and cache context. The goal is to explain differences between these artifacts without changing valid data merely to make screenshots look identical.
Understand TXT strings within one record
A TXT resource record can contain one or more character strings. Each character string has a length limit, so a long logical value can be represented using several strings within the same record. Those strings are not automatically several independent TXT resource records. RFC 1035 defines TXT data as one or more character strings; protocol-specific interpretation determines how the application uses them. TXT RDATA format
SPF explicitly requires the strings in one TXT record to be concatenated without adding spaces. DKIM likewise defines concatenation of TXT character strings when retrieving its key record. Consequently, a key displayed as two adjacent quoted strings can still be one complete published key. Do not insert a space between chunks merely because the UI shows visual separation. SPF multiple strings DKIM key retrieval
In master-file presentation, quoted strings describe TXT character strings, whose DNS format limits each string to 255 data octets. Treat the quotes as presentation syntax, not as proof that quote characters belong in the authentication value. A web interface may perform splitting or quoting itself; its input contract must be checked independently. TXT and character-string formats
The crucial boundary is the resource record, not the line break on screen. One TXT record containing several strings differs from two TXT records each containing an SPF policy. SPF does not resolve the latter by choosing whichever policy looks more complete. Preserve the complete answer set and identify each record separately before diagnosing a duplicate-policy error. SPF record selection
Distinguish harmless formatting from changed data
Visual wrapping does not necessarily insert a newline. Presentation quotes and escape sequences are not automatically literal data. Conversely, a copied typographic quotation mark, an unintended space inside key material or a value truncated by a failed paste can alter what is published. Use a representation that exposes the complete returned strings and reconstruct the logical value according to the relevant protocol.
Do not normalize everything indiscriminately. Domain names and authentication payloads have different rules; a cosmetic-looking change in public-key data is not safely ignored just because DNS names are commonly case-insensitive. Compare the issued and returned key material, tags and separators deliberately. Retain a sanitized comparison that omits private keys and credentials, not the public key needed for verification. DKIM key record syntax
Owner-name displays can also differ. An editor may show only a relative label while a DNS tool prints the full name with a terminal dot. Master-file syntax defines absolute and relative names, but the web editor's contract must be checked independently. Do not append a suffix simply to make the panel resemble a command-line response. Confirm that both representations identify the same fully qualified owner. DNS presentation syntax
Verify the active authority and the full answer
A saved record can be correct in an inactive zone. Follow the public delegation to the authoritative servers for the exact owner, including any child-zone boundary. Ask those servers for the required type and preserve status, answer records, authority information and timestamp. A successful lookup against a server that is not reached through public delegation does not prove that external receivers use its data. Authority and delegation
For a CNAME-based setup, record the alias and the target's answer separately. A panel showing the alias target is not displaying the target's current public key. Follow the relevant chain and check the provider's documented expected record type. Do not replace a supported CNAME with a copied target TXT merely because that makes one tool's output easier to read.
Compare every authoritative server when diagnosing inconsistent publication. Then query from a documented external recursive vantage point and record the resolver. If authority is consistent but a recursive answer differs, investigate caching before editing again. A prior missing-record response can remain in a negative cache, and a newly corrected panel cannot erase that remote cache on demand. Negative caching
Published-record comparison worksheet
This original worksheet makes the comparison reviewable without pretending a screenshot is a completed test.
- Intended object: sending provider ___; exact owner ___; type ___; issued logical value or target ___; instruction date ___.
- Panel representation: active account/zone ___; saved owner display ___; number of rows ___; wrapping/quoting behavior documented at ___.
- Authority: parent referral ___; authoritative server set ___; each response status and timestamp ___.
- TXT structure: resource-record count ___; strings per record ___; reconstructed logical value ___; comparison result ___.
- Alias handling: customer-side CNAME ___; target owner ___; target record type/value ___; unresolved chain errors ___.
- Recursive observation: vantage point ___; resolver ___; answer/TTL ___; positive or negative cache explanation ___.
- Decision: cosmetic difference ___; real data difference ___; proposed approved change ___; preserved previous state ___.
- End-to-end acceptance: sender verification ___; controlled message ___; actual selector ___; trusted receiver result ___; owner sign-off ___.
A discrepancy should be classified before repair. If the logical value and record structure are correct, leave the data alone and document the presentation difference. If the bytes, owner or resource-record count are wrong, make a narrowly scoped approved correction. Avoid converting one correct record into several records simply to imitate line breaks.
Fictional example: a key split correctly across strings
This scenario is fictional. A DNS operator sees a long DKIM key split into two quoted strings in the saved editor. The mail administrator expects one long line and asks for the quotes and space between the displayed chunks to be copied into a new value. That proposed edit would confuse presentation with the logical key.
The diagnostic plan first inspects the authoritative TXT structure. If it is one record with two strings whose concatenation exactly matches the issued key record, the display difference requires no DNS repair. The team records that comparison and tests the actual signed message. If instead the provider interface created two independent records or literal unwanted characters, the team investigates that specific difference and follows the documented entry syntax to correct it.
Neither branch is declared successful here. This fictional example illustrates why record boundaries and protocol interpretation matter more than visual line count. The manuscript remains a draft until live publication evidence, a received-message test, visual review and human owner release have been completed.