TxtRelay ClickFix kit

TxtRelay is an injected loader that reads its next script address from a DNS TXT record. We have matched it on 55 sites since 1 October.

Research by Kirk

TxtRelay in numbers

Since 1 October, the first TxtRelay match in our records, counted on 12 October 2026. How we count.

Sites with TxtRelay code	55
Sites with a match in the last 30 days	55
New sites in September	0
Sites running WordPress (captured since 25 September)	100%

DNS controls the next script

TxtRelay is our name for an injected loader that uses a DNS TXT record as remote configuration. It sends an HTTPS request to Cloudflare's JSON DNS service with type=TXT and an Accept: application/dns-json header. The browser makes this request directly; the operating system's DNS resolver is not involved.

The loader parses the JSON response, takes Answer[0].data, then parses that value again to remove the TXT record's JSON quoting. It prefixes https://, assigns the result to a new script element and appends that element to the page head.

infected page
  -> query one DNS TXT name over HTTPS
  -> parse the first answer twice
  -> add https:// to the returned value
  -> append a script using that address

Changing the TXT record redirects every infected page using that name while their injected code stays untouched.

Two builds, one relay

Public captures from 2 to 4 October preserve an inline build, a whitespace-stripped copy and a second build appended to a first-party copy of Elementor's frontend-modules.min.js. The builds use different variable names and string-table order. Both keep the same DNS request, double JSON parse, https:// prefix and script insertion.

Recent production captures keep the loader inline in the document. Its string table exposes the DNS request and TXT name only after the surrounding indexes are resolved. That small table is the useful distinction from a generic script injector.

What we see

Month	New sites
September	0
October so far	55

100% of TxtRelay sites captured since 25 September run WordPress. 55 sites also carry LenAI.

Checking a WordPress site

Search the logged-out HTML, plugin JavaScript and cached copies for:

cloudflare-dns.com/dns-query?name= beside &type=TXT
an application/dns-json accept value
two JSON parses around the first Answer item's data field
a new script whose source is https:// plus the decoded TXT value
unfamiliar code appended to frontend-modules.min.js

Remove the injection and compare the changed plugin file with a trusted copy. Purge WordPress, server and CDN caches, then confirm the page no longer makes its own DNS-over-HTTPS request.