DNS TXT records are usually added for email auth or vendor verification and rarely revisited. We scanned TXT records across Fortune 500 domains to see what they expose at scale, and found they consistently reveal email infrastructure, SaaS dependencies, legacy tooling, and long-lived operational artifacts. The analysis shows how much actionable security and intelligence context is visible through public DNS alone, without touching a single endpoint.

I would also add that these dangling TXT records also build up into a amplification DDoS risk for recursive name servers. When running public recursive servers I have had to strip the TXT records for several domains including but not limited to 500px.com box.com ebay.com google.com hm.com lenovo.com nordstrom.com realtor.com tmz.com wired.com. Take a look:

    for i in $(echo "500px.com box.com ebay.com google.com hm.com lenovo.com nordstrom.com realtor.com tmz.com wired.com");do dig +short +nocookie -t TXT "${i}";echo;done

To strip them in Unbound I used:

    local-zone: ebay.com typetransparent
    local-data: 'ebay.com. TXT "[ddos redacted]"'

My public name servers served a specific purpose so stripping such records were perfectly splendid.

Indeed! Good point, TXT records pile up fast with SPF, DKIM, DMARC, and vendor checks, which increases amplification risk for resolvers, and it's the same sprawl we’re seeing as long-lived infrastructure signals from the outside!