What are the security risks with adding TXT records for third party tools? Can they get any information back from your servers with adding that record for them?
The example below is from the "have i been pwned" Web site:
Yes, under certain circumstances, they can.
TXT records are frequently used to verify the domain name ownership for various reasons, including (but not limited to) TLS (HTTPS) certificate issuance. For instance, this is how it is done with DigiCert which is one of, if not the, largest certificate authority in the world.
Note that the process is just the same as in your case: you need to take a seemingly arbitrary alphanumeric string (provided to you by the tool) and to put it in the TXT record of your domain.
A potential attacker can supply you with a string they have obtained from a CA's validation agent on your behalf and then obtain a valid HTTPS certificate for your domain. The certificate could then in turn be used e.g. for man-in-the-middle attacks against your Web site.
To address that scenario, most validation agents these days generate not just an arbitrary alphanumeric string for a TXT record but a string with a prefix which is expected to rather uniquely identify the validation agent. At the time of writing, the service you have mentioned seems to do exactly that: it just provided me with a string
have-i-been-pwned-verification=e6c252c87a4bd0e0fd7cb39a057bb0b3, which contains an easily recognizable and apparently innocent prefix
See, it's highly unlikely that a different Web service (including CAs) would issue anyone a string with exactly that prefix.
(Make sure the prefix still stays there when you are going through validation.)
Aside from potential (and severe, thus unlikely) vulnerabilities in validation agents, prefixed strings with long and seemingly unique prefixes may be considered safe to put into a TXT record for a rather short period of time.