Why is a TXT record limited to 255 characters?

Each character-string inside a TXT record is length-prefixed with a single byte, which caps one string at 255 bytes. The record as a whole can hold many such strings, so the real limit on the value is the DNS message size, not 255.

How does a resolver rejoin split TXT strings?

It concatenates them in order with no separator at all. That is the behaviour DKIM, SPF and verification tokens rely on, and it is why the split point does not matter as long as nothing is inserted between the pieces.

Where should I split a DKIM key?

Anywhere, as long as each piece is 255 bytes or fewer. The key is a single Base64 string to the verifier once the pieces are joined, so a split in the middle of the Base64 is fine.

How big can the whole TXT record be?

In practice a few kilobytes, but answers past about 512 bytes need EDNS or a TCP retry. Some resolvers and middleboxes handle that badly, so keeping a record under that size avoids intermittent failures.

Do I need to split an SPF record the same way?

Only if a single string exceeds 255 bytes, which happens with a long list of includes. Note that SPF has its own separate limit of ten DNS lookups, which splitting does nothing to help.

DNS TXT Record Splitter

Cut a long TXT value into the 255-byte strings DNS needs, ready to paste into a zone file.

The DNS TXT Record Splitter runs entirely in your browser. Keys and verification tokens are chunked on your device and never uploaded.

Generate a DKIM record

About DNS TXT Record Splitter

A TXT record is not one long string. RFC 1035 stores it as a sequence of character-strings, each at most 255 bytes, and a resolver joins them back together with nothing in between. That is why a 2048-bit DKIM key has to be handed to the zone file as several quoted chunks, and why splitting it in the wrong place — or joining the pieces with a space — quietly breaks mail signing in a way that is painful to debug. This tool cuts a value on byte boundaries, never through a character, and formats the result for BIND, a parenthesised zone entry or the JSON array most DNS APIs take. It runs the reverse trip too.

Features

Splits on 255-byte boundaries, counting bytes rather than characters
Never cuts a multi-byte character or a surrogate pair in half
Output formatted for BIND on one line, parenthesised, quoted strings only, or as a JSON array
Per-chunk byte counts, so you can see which strings are full
Warns about stray whitespace, existing quotes and records past the 512-byte UDP answer size
Joins quoted strings from a zone file or a dig answer back into one value
Samples for a 2048-bit DKIM key, a long SPF record and a verification token

How to use the DNS TXT Record Splitter

Paste the whole TXT value — no quotes needed, they are added for you
Set the record name and TTL if you want a complete zone-file line
Pick the output format your DNS provider expects
Copy the record, or switch to the join tab to reverse a split value

Example

Input

v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A… (392 bytes)

Output

default._domainkey 3600 IN TXT "v=DKIM1; k=rsa; p=MIIBIja…" "…QIDAQAB"

Two quoted strings, concatenated by the resolver with nothing between them.

Common errors & troubleshooting

The DNS provider rejects the record as too long. — It is enforcing the 255-byte limit on a single string. Paste the split version, with each chunk quoted separately — most providers accept several quoted strings in one value field.
DKIM verification fails after splitting. — Almost always a space between the chunks. Resolvers concatenate character-strings with nothing in between, so any added whitespace becomes part of the key and breaks the signature.
The record value already has quotes in it. — Paste the raw value instead. Quotes are added when the record is formatted, and pasting a pre-quoted value ends up double-quoting it.
The chunks are shorter than 255 characters. — The limit is 255 bytes, not characters. Any non-ASCII in the value takes two to four bytes per character, so a chunk can hold fewer characters while still being exactly full.

Frequently asked questions

Why is a TXT record limited to 255 characters?: Each character-string inside a TXT record is length-prefixed with a single byte, which caps one string at 255 bytes. The record as a whole can hold many such strings, so the real limit on the value is the DNS message size, not 255.
How does a resolver rejoin split TXT strings?: It concatenates them in order with no separator at all. That is the behaviour DKIM, SPF and verification tokens rely on, and it is why the split point does not matter as long as nothing is inserted between the pieces.
Where should I split a DKIM key?: Anywhere, as long as each piece is 255 bytes or fewer. The key is a single Base64 string to the verifier once the pieces are joined, so a split in the middle of the Base64 is fine.
How big can the whole TXT record be?: In practice a few kilobytes, but answers past about 512 bytes need EDNS or a TCP retry. Some resolvers and middleboxes handle that badly, so keeping a record under that size avoids intermittent failures.
Do I need to split an SPF record the same way?: Only if a single string exceeds 255 bytes, which happens with a long list of includes. Note that SPF has its own separate limit of ten DNS lookups, which splitting does nothing to help.

Related tools

DKIM Record Generator — Build and inspect the DKIM TXT record that publishes your mail signing key.
SPF Record Generator — Build and validate the SPF TXT record that stops others sending mail as your domain.
DMARC Record Generator — Build and validate a DMARC DNS TXT record with policy, reporting and alignment.
CAA Record Generator — Build the DNS record that names which certificate authorities may issue for your domain.
SRV Record Generator — Build and decode SRV records for SIP, XMPP, Minecraft, LDAP and Autodiscover.
Reverse DNS Generator — Turn IPs and prefixes into PTR names, zone files and RFC 2317 delegations.